WO2018145605A1

WO2018145605A1 - Authentication method and server, and access control device

Info

Publication number: WO2018145605A1
Application number: PCT/CN2018/075201
Authority: WO
Inventors: 袁哲
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2017-02-07
Filing date: 2018-02-05
Publication date: 2018-08-16
Also published as: CN106657152A; CN106657152B

Abstract

The embodiments of the present application provide an authentication method and server, and an access control device, said method comprising the following steps: a server receiving a resource access request and first signature sent by an access control device, said first signature being generated by the access control device using a stored temporary key to encrypt a resource access request; the server obtaining the stored temporary key allocated to the access control device, and using the temporary key to encrypt the resource access request to generate first verification data; if the first signature is consistent with the first verification data, then the server authenticating the resource access request; if the result of authentication of the resource access request is successful authentication, then the server processing the resource access request.

Description

Authentication method, server, access control device

This application claims the priority of the Chinese Patent Application filed on Dec. 7, 2017, the Chinese Patent Application No. 201710067062.8, entitled "An authentication method and server, access control device", the entire contents of which are incorporated by reference. In this application.

Technical field

The present application relates to the field of information security technologies, and in particular, to an authentication method, a server, and an access control device.

Background technique

With the increasing popularity and a large number of applications of cloud computing technologies, cloud computing has become more and more recognized by the industry in terms of achieving high availability of services and scalability of processing capabilities. Cloud service providers can provide users with a large number of cloud services or cloud products. The cloud resources on which the cloud services are based can be managed through a management platform. In the cloud service authentication system, users can access cloud resources through the cloud service management platform. However, not all users have the right to access cloud resources. Therefore, the access user needs to be authenticated to determine whether the user has access. Permissions.

Summary of the invention

The embodiment of the present invention provides an authentication method, a server, and an access control device. By using a temporary key to generate a signature for authentication, the risk of the inherent private key being compromised can be avoided, and the security of the inherent private key is ensured.

An embodiment of the present application provides an authentication method, including:

Receiving, by the server, a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Obtaining, by the server, the temporary key allocated for the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

If the first signature matches the first verification data, the server authenticates the resource access request;

If the authentication result of the resource access request is authentication, the server processes the resource access request.

The access control device receives the resource access request initiated by the user;

The access control device encrypts the resource access request by using a stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control device;

The access control device sends the resource access request and the first signature to the server to enable the server to authenticate the resource access request.

An embodiment of the present application provides a server, including: a processor and a memory, where the computer stores readable instructions, where the computer readable instructions are executed by the processor to complete the following operations:

Receiving a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Acquiring the stored temporary key allocated to the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

And if the first signature matches the first verification data, the resource access request is authenticated;

And if the authentication result of the resource access request is an authentication pass, the resource access request is processed.

An embodiment of the present application provides an access control apparatus, including: a processor and a memory, where the computer stores computer readable instructions that are executed by the processor to perform the following operations:

Receiving a resource access request initiated by a user;

Encrypting the resource access request by using the stored temporary key to generate a first signature, the temporary key being previously allocated by the server for the access control device;

Sending the resource access request and the first signature to the server to enable the server to authenticate the resource access request.

The embodiment of the present application provides an authentication method for a server, where the server includes a processor and a memory, and the method includes the following steps:

The embodiment of the present application provides an authentication method for accessing a control device, where the access control device includes a processor and a memory, and the method includes:

Embodiments of the present application provide a non-volatile storage medium in which computer readable instructions are stored, which may be executed by a processor to perform the following operations:

Receiving a resource access request initiated by a user;

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only It is some embodiments of the present application.

1 is a schematic diagram of an application environment of an authentication method provided by an embodiment of the present application;

2a is a schematic flowchart of an authentication method provided by an embodiment of the present application;

2b is a schematic flowchart of another authentication method provided by an embodiment of the present application;

3 is a schematic flowchart of another authentication method provided by an embodiment of the present application;

4 is a diagram showing an example of an authentication method provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a server according to an embodiment of the present disclosure;

6 is a schematic structural diagram of an access control apparatus according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of another server according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of another access control apparatus according to an embodiment of the present application.

Mode for carrying out the invention

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

It should be noted that the terminology used in the embodiments of the present application is for the purpose of describing the specific embodiments, and is not intended to limit the application. The singular forms "a", "the", and "the" It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items. In addition, the terms "first", "second", "third", and "fourth" and the like in the specification and claims of the present application and the above drawings are used to distinguish different objects, and are not used to describe specific order. Furthermore, the terms "comprises" and "comprising" and "comprising" are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the listed steps or units, but may also include steps or units not listed, or may also include Other steps or units inherent to the method, product or device.

In some technical solutions, the cloud service management platform needs to generate a signature for the access request of the user to access the cloud resource, and send the signature and the access request to the server corresponding to the cloud service management platform, so that the server verifies the signature, if the verification passes The access request is authenticated to determine the authentication result, and the signature in the cloud service management platform is generated by encrypting the access request according to the user's inherent private key, because the user's inherent private key is saved by the server, and the cloud service is When the management platform needs to generate a signature, it will directly obtain the user's inherent private key from the server, so that in the process of transmitting the inherent private key, the inherent private key is easily exposed, and the security of the user's inherent private key transmission is reduced. .

The embodiment of the present application provides an authentication method, a server, and an access control device, which can reduce the risk of user key leakage and improve the overall security of the authentication system.

FIG. 1 is a schematic diagram of an application environment of an authentication method according to an embodiment of the present application. These include the client 101 and the server 102. Among them, the client 101. Client 101 and server 102 can communicate over a network.

The access control device according to the embodiment of the present application may be any device having communication and storage functions, such as a computer, a mobile phone computer, etc.; or the function of the access control device may be in any device having communication and storage functions. Implementation, such as client 101 of FIG. 1 or server 102. The client 101 can be any device capable of implementing intelligent input and output, such as a computer, or other devices having the above structure. The access control device receives the user-initiated resource access request; the access control device encrypts the resource access request by using the stored temporary key to generate a first signature, where the temporary key is previously controlled by the server for the access control Assigned by the device; the access control device sends the resource access request and the first signature to the server to enable the server to authenticate the resource access request.

The server 102 involved in FIG. 1 may be a background device that allocates a key and can authenticate a resource access request, etc., which is not limited in this embodiment of the present application. The server can provide services such as computing, storage, database, video, security, network, content distribution network (CDN) and acceleration, big data, artificial intelligence (AI), etc., along with other devices of the cloud service provider. Receiving, by the server, a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request; a temporary key allocated by the access control device, and encrypting the resource access request by using the temporary key to generate first verification data; if the first signature matches the first verification data, the The server authenticates the resource access request; if the authentication result of the resource access request is authentication, the server processes the resource access request.

FIG. 2 is a schematic flowchart of an authentication method according to an embodiment of the present application. As shown in FIG. 2a, the method in the embodiment of the present application is performed by a server, and may include the following steps 101-104.

101. The server receives a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request.

The application programming interface (API) in the server authenticates each resource access request, that is, each resource access request needs to include signature information (Signature) in the public request parameter to verify the identity of the requester. Specifically, the server receives the resource access request and the first signature sent by the access control device. The first signature is generated by the access control device, and is specifically generated by encrypting the resource access request by using a stored temporary key.

The temporary key may be allocated by the server for the access control device. The temporary key has a certain timeliness, that is, the temporary key is valid within a certain time range and fails in other time ranges. The temporary key is, for example, a key Key. When the server allocates a temporary key to the access control device, the server may simultaneously allocate a key ID for identifying the identity of the access control device, and the server may configure a certain key ID to invoke the API. The key ID can be transmitted over the clear text network. The access control device can simultaneously transmit the key ID when transmitting the resource access request and the first signature to the server. The temporary key can also include a session token (Token).

In an example, the server and the access control device stipulate a preset encryption algorithm, and the access control device encrypts the resource access request by using a temporary key according to a preset encryption algorithm to generate a first signature. The preset encryption algorithm may be, for example, a Data Encryption Standard (DES), an International Data Encryption Algorithm (IDEA), or the like.

The resource access request is a request by a user to request a server to access a target access resource. The resource access request includes, for example, a user identification, information of a target access resource, and a target operation mode of accessing the resource to the target. The user identifier is used to mark a user who performs a target operation mode on the target access resource, for example, a user account. In the case where the user has multiple accounts, the user's root account and sub-account may be included. The target access resource may be, for example, a file, data, or the like in the server, and the target operation mode may be a read instruction, a delete instruction, a write instruction, or the like. The manner in which the target operation mode is included in the embodiment of the present application is not limited. In addition, the target access resources may also be cloud server resources, databases, virtual private clouds (VPCs), and the like. Users can use the API provided by the cloud server to perform related operations on the cloud server: such as creating, changing bandwidth, restarting, and so on. The creation operation is, for example, to create a volume-based cloud server. The restart operation is, for example, restarting one or more cloud servers. Changing the bandwidth operation is, for example, changing the bandwidth of the cloud server.

102. The server acquires the stored temporary key allocated to the access control device, and encrypts the resource access request by using the temporary key to generate first verification data.

Specifically, the server acquires the stored temporary key allocated to the access control device, where the temporary key stored by the server corresponds to the access control device, and at the same time, There is only one temporary key corresponding to the access control device. The server may save the temporary key and the device identifier of the access control device, and further, the access control device may carry the access control device together with the resource access request and the first signature. Device identifier, for example, a key ID, such that after the server receives the resource access request, the first signature, and the device identifier, the server searches for a temporary key corresponding to the device identification key ID, ie, the key Key . Further, the server encrypts the resource access request by using a stored temporary key to generate first verification data. The first verification data is used to compare with the received first signature to determine whether the access control device is legitimate.

103. If the first signature matches the first verification data, the server authenticates the resource access request.

Specifically, the server matches the received first signature with the generated first verification data, and if the first signature matches the first verification data, the server determines that the access control device is legal. And authenticating the resource access request.

If the first signature is inconsistent with the first verification data, the server determines that the access control device is invalid, and does not authenticate the resource access request. The server may transmit a notification message to the access control device indicating that the access control device fails to pass the verification.

The specific process of the server for authenticating the resource access request may obtain, by the server, an accessible resource corresponding to the user identifier and an operable manner for the accessible resource. Determining, by the server, whether the target access resource exists in the accessible resource; if the target access resource exists, the server determining whether the target operation mode exists in an operable manner of the target access resource; If the target operation mode exists, the server determines that the authentication result of the resource access request is an authentication pass. If the target access method does not exist in the accessible resource, or the target operation method does not exist in the operable mode, the server determines that the authentication result of the resource access request is that the authentication fails. In this case, the server may send a notification message to the access control device that the resource access request cannot be performed.

104. If the authentication result of the resource access request is authentication, the server processes the resource access request.

Specifically, if the authentication result of the resource access request is authentication, the server processes the resource access request. The server processes the target access resource according to the target operation mode in the resource access request, and after the process is completed, the server may feed back the processing result to the access control device, so that the user knows that the The result of processing the resource access request.

In the embodiment of the present application, the server receives the resource access request and the first signature sent by the access control device, where the first signature is generated by the access control device using the stored temporary key to encrypt the resource access request; and the server adopts the stored access control. The temporary key allocated by the device encrypts the resource access request to generate the first verification data. If the first signature matches the first verification data, the server authenticates the resource access request; if the authentication is passed, the server pairs Resource access requests are processed. In the authentication process, the signature to be verified is generated by using a temporary key, so that the server does not need to transmit the inherent key, thereby avoiding the risk of the inherent private key being leaked, thereby ensuring the security of the inherent private key.

Referring to FIG. 2b, a schematic flowchart of another authentication method is provided in the embodiment of the present application. As shown in FIG. 2b, the method in the embodiment of the present application is performed by the access control device, and may include the following steps 201-203. The access control device can be on the client side or on the server side.

201. The access control device receives a resource access request initiated by the user.

Specifically, the access control device receives a resource access request initiated by the user to access the target access resource, and the user may initiate a resource access request by using an access control platform or page provided by the access control device. Further, the user can initiate a resource access request after successfully logging in through the user name and login password in the access control platform or page.

202. The access control device encrypts the resource access request by using a stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control device.

Specifically, the access control device encrypts the resource access request by using a stored temporary key to generate a first signature. The temporary key is allocated by the server to the access control device. It can be understood that the temporary key has a certain time validity, that is, the temporary key is valid within a certain time range. Invalid in other time frames. The temporary key is, for example, a key Key. When the server allocates a temporary key to the access control device, the server may simultaneously allocate a key ID for identifying the identity of the access control device, and the server may configure a certain key ID to invoke the API. The key ID can be transmitted over the clear text network. The access control device can simultaneously transmit the key ID when transmitting the resource access request and the first signature to the server. The temporary key can also include a session token (Token).

In an example, the server and the access control device stipulate a preset encryption algorithm, and the access control device encrypts the resource access request by using a temporary key according to a preset encryption algorithm to generate a first signature. The preset encryption algorithm may be, for example, DES, IDEA, or the like.

203. The access control apparatus sends the resource access request and the first signature to the server, so that the server authenticates the resource access request.

Specifically, the access control device sends the resource access request and the first signature to the server, so that the server authenticates the resource access request.

In addition to transmitting the resource access request and the first signature, the access control device may further carry the device identifier of the access control device, that is, the key ID, so that the resource access request, the first signature, and the server are received at the server. After the device is identified, the server searches for a temporary key corresponding to the device identification key ID, that is, a key Key, and after the server finds the temporary key corresponding to the device identifier, generates the first verification data to complete the authentication. .

In the embodiment of the present application, the access control device encrypts the received resource access request by using a temporary key to generate a first signature, and the temporary key is previously allocated by the server for the access control device, and the resource access request and the first The signature is sent to the server, so that the server authenticates the resource access request, so that the inherent private key of the user is not needed, and the risk of the inherent private key being compromised is avoided, thereby ensuring the security of the inherent private key.

FIG. 3 is a schematic flowchart diagram of another authentication method according to an embodiment of the present application. As shown in FIG. 3, the method in the embodiment of the present application is performed by a server and an access control device, and may include the following steps 301-314.

301. The access control device receives a resource access request initiated by a user.

Specifically, the access control device receives a resource access request initiated by the user to request access to the target access resource. For example, the user may initiate a resource access request by using an access control platform or a page provided by the access control device. Further, for example, the user can initiate a resource access request after successfully logging in through the user name and login password in the access control platform or page.

The resource access request includes, for example, a user identifier, a target access resource, and a target operation mode for accessing the resource to the target. The user identifier is used to mark the user who performs the target operation mode on the target access resource. For example, the target access resource may be, for example, a file, data, or the like in the server, and the target operation mode may be a read instruction, a delete instruction, a write instruction, or the like. The embodiment of the present application does not limit the manner in which the target operation mode is included.

302. The access control device encrypts the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device.

Specifically, the access control device encrypts the resource access request by using a fixed key to generate a second signature. The fixed key is allocated by the server for the access control device, and the fixed key is in one-to-one correspondence with the access control device.

In one example, after the server assigns a fixed key to the access control device, the fixed key is sent to the access control device, and after receiving the fixed key, the access control device will The fixed key is saved, and when the access control device needs to send a temporary key acquisition request to the server, acquiring the stored fixed key, and encrypting the resource access request by using a fixed key to generate Second signature.

303. The access control device sends a temporary key acquisition request to the server.

Specifically, the access control device sends a temporary key acquisition request to the server, where the temporary key acquisition request carries the resource access request and the second signature, so that the server pairs the second signature The temporary key is assigned to the access control device after the verification is passed.

The server and the access control device may jointly agree on an encryption algorithm used for the second signature in the temporary key acquisition request, so that the server can determine the second signature after receiving the temporary key acquisition request. The encryption algorithm used.

304. The server receives a temporary key acquisition request sent by the access control device.

Specifically, the server receives a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries a resource access request and a second signature.

Further, the temporary key acquisition request may further carry the device identifier of the access control device, so that the server determines, after receiving the temporary key acquisition request, a fixed density corresponding to the device identifier. key.

305. The server acquires a fixed key allocated to the access control apparatus, and encrypts the resource access request by using the fixed key to generate second verification data.

Specifically, the server acquires a fixed key allocated for the access control device. For example, the server may search for a fixed key corresponding to the device identifier according to the device identifier carried in the temporary key acquisition request, and encrypt the resource access request by using the fixed key to generate a second verification. data.

Further, the encryption algorithm used by the server to generate the second verification data is the same as the encryption algorithm used by the access control device to generate the second signature.

306. If the second signature matches the second verification data, the server allocates a temporary key to the access control device.

Specifically, if the second signature matches the second verification data, the server allocates a temporary key to the access control device. The temporary key may have a certain timeliness, that is, the temporary key is valid within a certain time range and fails in other time ranges.

If the second signature does not match the second verification data, the server does not allocate a temporary key, and may also send a notification message to the access control device that the temporary key cannot be allocated due to the verification failure.

307. The server stores and sends the temporary key to the access control device.

Specifically, the server stores the allocated temporary key to determine a temporary key of the access control device. The server may store the temporary key in association with the device identifier of the access control device, and record the effective duration of the temporary key. After the valid duration of the record is exceeded, the temporary key may be deleted.

308. The access control device receives the temporary key allocated by the server, and stores the temporary key.

309. The access control device encrypts the resource access request by using a stored temporary key to generate a first signature.

310. The access control device sends the resource access request and the first signature to the server.

The access control device may further carry the device identifier of the access control device, in addition to the resource access request and the first signature, after the server receives the resource access request, the first signature, and the device identifier, The server searches for a temporary key corresponding to the device identifier, and after the server finds the temporary key corresponding to the device identifier, generates the first verification data to complete the authentication.

311. The server receives the resource access request and the first signature sent by the access control device.

Specifically, the server receives the resource access request and the first signature sent by the access control device. The first signature is generated by the access control device, and is specifically generated by encrypting the resource access request by using a stored temporary key.

312. The server acquires the stored temporary key allocated to the access control device, and encrypts the resource access request by using the temporary key to generate first verification data.

Specifically, the server acquires the stored temporary key allocated to the access control device, where the temporary key stored by the server corresponds to the access control device, and at the same time, There is only one temporary key corresponding to the access control device.

Further, after the server receives the resource access request, the first signature, and the device identifier, the server searches for a temporary key corresponding to the device identifier.

Further, the server encrypts the resource access request by using a stored temporary key to generate first verification data. The first verification data is used to compare with the received first signature to determine whether the access control device is legitimate.

Further, the encryption algorithm used by the server to generate the first verification data is the same as the encryption algorithm used by the access control device to generate the first signature.

If the server deletes the temporary key due to timeliness, even if the temporary key acquisition request sent by the access control device is received, the first signature of the access control device cannot be verified, so that the verification cannot be performed. The access control device transmits a notification message that the temporary key has expired.

313. If the first signature matches the first verification data, the server authenticates the resource access request.

The specific process of the server for authenticating the resource access request may obtain, by the server, an accessible resource corresponding to the user identifier and an operable manner for the accessible resource; the server determines that the Whether the target access resource exists in the access resource; if the target access resource exists, the server determines whether the target operation mode exists in an operable manner of the target access resource; if the target operation mode exists And determining, by the server, that the authentication result of the resource access request is an authentication pass. If the target access method does not exist in the accessible resource, or the target operation method does not exist in the operable mode, the server determines that the authentication result of the resource access request is that the authentication fails. In this case, the server may send a notification message to the access control device that the resource access request cannot be performed.

314. If the authentication result of the resource access request is authentication, the server processes the resource access request.

In the embodiment of the present application, the server first verifies the access control device. When the verification passes, the server allocates a temporary key, and sends the temporary key to the access control device, and the access control device uses the temporary key to access the resource. The request for encryption generates a first signature, and the server performs verification and authentication again after receiving the first signature sent by the access control device. In the authentication process, the first signature to be verified is generated by using a temporary key, so that the server does not need to transmit the inherent key, thereby avoiding the risk of the inherent private key being leaked, and ensuring the security of the inherent private key. The accuracy of authentication is also ensured by means of verification of the access control device and verification of the identity of the user.

The steps in the embodiment shown in Figure 3 that are similar to Figures 2a, 2b can be referred to the related description of Figures 2a, 2b.

FIG. 4 is a schematic diagram of an authentication method provided by an embodiment of the present application, so as to further understand the technical solutions described in the present application. As shown in FIG. 4, the authentication method is jointly performed by the client 1 and the server 2, wherein the client 1 has an access control platform, and the server 2 includes an authentication service module, a key service module, and a resource access request processing module. . These can correspond to the various functions that the server has.

The access control platform may receive a resource access request initiated by the user, and encrypt the resource access request by using the stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control platform. The access control platform sends the resource access request and the first signature to the server after generating the first signature. The authentication service module in the server receives the resource access request and the first signature sent by the access control platform, and the authentication service module obtains the stored temporary key allocated for the access control platform from the key service module, and the authentication service module adopts The temporary key encrypts the resource access request to generate first verification data; the authentication service module matches the first signature with the first verification data, if the first signature matches the first verification data If the authentication service module authenticates the resource access request, the resource access request processing module is triggered to process the resource access request.

The access control platform encrypts the resource access request by using the stored temporary key. Before generating the first signature, the resource access request may be encrypted by using a fixed key to generate a second signature. The key is allocated by the server for the access control platform; the access control platform sends a temporary key acquisition request to the server, where the temporary key acquisition request carries the resource access request and the second signature, And causing the server to allocate a temporary key to the access control platform after the second signature verification is passed; the authentication service module in the server receives the temporary key acquisition request sent by the access control platform; the authentication service module slave key The service module acquires a fixed key allocated to the access control platform, and the authentication service module encrypts the resource access request by using the fixed key to generate second verification data; if the second signature and the first If the verification data matches consistently, the authentication service module allocates a temporary key to the access control platform, and the The time key is stored in the key service module and the temporary key is sent to the access control platform. The access control platform receives the temporary key allocated by the server and stores the temporary key.

The key service module may include a temporary key storage module and a fixed key storage module to store the temporary key and the fixed key, respectively.

The authentication service module can include a rights library that maintains the accessible resources of various users and the manner in which the resources are accessible.

It should be noted that the authentication service module, the key service module, and the resource access request processing module shown in FIG. 4 are logical functional descriptions. The servers involved in the embodiment shown in Figures 2a, 2b and 3 can perform the corresponding method steps by means of the various modules shown in Figure 4. The access control device of the embodiment shown in Figures 2a, 2b and 3 can perform the corresponding method steps through the access control platform shown in Figure 4. The authentication service module, the key service module, and the resource access request processing module in the server 2 may be respectively deployed on the same physical machine, or deployed in different virtual machines of the same physical machine, or deployed in different physical machines. This example does not limit this.

FIG. 5 is a schematic structural diagram of a server according to an embodiment of the present application. As shown in FIG. 5, the server 10 of the embodiment of the present application may include: a data receiving unit 11, a first generating unit 12, a request authentication unit 13, and a request processing unit 14. The server 10 may further include a request receiving unit 15, a second generating unit 16, and a key assigning unit 17.

The data receiving unit 11 is configured to receive a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request.

Specifically, the data receiving unit 11 receives the resource access request and the first signature sent by the access control device. The first signature is generated by the access control device, and is specifically generated by encrypting the resource access request by using a stored temporary key.

The temporary key is allocated by the server 10 for the access control device. It can be understood that the temporary key has a certain time limit, that is, the temporary key is valid within a certain time range. And expires in other time frames.

In a feasible solution, the server 10 and the access control device stipulate a preset encryption algorithm, and the access control device encrypts the resource access request by using a temporary key according to a preset encryption algorithm to generate a first A signature. The preset encryption algorithm may be, for example, DES, IDEA, or the like.

The resource access request may include a user identifier, a target access resource, and a target operation mode for accessing the resource to the target. The user identifier is used to mark the user who performs the target operation mode on the target access resource. For example, the target access resource may be a file, data, or the like in the server 10. The target operation mode may be a read instruction, a delete instruction, a write instruction, or the like. The embodiment of the present application does not limit the manner in which the target operation mode is included.

The first generating unit 12 is configured to obtain the stored temporary key allocated to the access control device, and encrypt the resource access request by using the temporary key to generate first verification data.

Specifically, the first generating unit 12 acquires the stored temporary key allocated to the access control device, where the temporary key stored by the server 10 corresponds to the access control device, and is in the same At the moment, there is only one temporary key corresponding to the access control device. The server 10 may save the temporary key and the device identifier of the access control device, and further, the access control device may carry the access control together with the resource access request and the first signature. The device identifier of the device, such that after the data receiving unit 11 receives the resource access request, the first signature, and the device identifier, the first generating unit 12 searches for a temporary key corresponding to the device identifier.

Further, the server 10 encrypts the resource access request by using the stored temporary key to generate first verification data. The first verification data is used to compare with the received first signature to determine whether the access control device is legitimate.

The request authentication unit 13 is configured to authenticate the resource access request if the first signature matches the first verification data.

Specifically, the request authentication unit 13 matches the received first signature with the generated first verification data, and if the first signature matches the first verification data, the server 10 determines the location. The access control device is legal and authenticates the resource access request.

If the first signature is inconsistent with the first verification data, the server 10 determines that the access control device is invalid and does not authenticate the resource access request. The server 10 may transmit a notification message to the access control device indicating that the access control device fails to pass the verification.

The request authentication unit 13 includes an information acquisition subunit, a first judgment subunit, and a second judgment subunit, and a result determination subunit.

And an information obtaining subunit, configured to acquire an accessible resource corresponding to the user identifier and an operable manner of the accessible resource.

The first determining subunit is configured to determine whether the target access resource exists in the accessible resource.

a second determining subunit, configured to determine whether the target operating mode exists in an operable mode of the target access resource if the first determining subunit determines that the target access resource exists in the accessible resource .

And a result determining sub-unit, configured to determine that the authentication result of the resource access request is an authentication pass if the second determining sub-unit determines that the target operating mode exists in an operable manner for accessing the target resource.

The request processing unit 14 is configured to process the resource access request if the authentication result of the resource access request is the authentication pass.

Specifically, if the authentication result of the resource access request is authentication, the request processing unit 14 processes the resource access request. The server 10 processes the target access resource according to the target operation mode in the resource access request, and after the process is completed, the server 10 may feed back the processing result to the access control device, so that the user knows The processing result of the resource access request.

The server 10 may further execute the request receiving unit 15, the second generating unit 16, and the key assigning unit 17 before executing the data receiving unit 11.

The request receiving unit 15 is configured to receive a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries a resource access request and a second signature.

The second generating unit 16 is configured to acquire a fixed key allocated to the access control device, and encrypt the resource access request by using the fixed key to generate second verification data.

The key distribution unit 17 is configured to: if the second signature matches the second verification data, the server 10 allocates a temporary key to the access control device, and stores and sends the temporary key to The access control device.

It should be noted that the specific implementation manners of the request receiving unit 15, the second generating unit 16, and the key allocating unit 17 can be described in detail in the embodiment shown in FIG. 3, and details are not described herein again.

Referring to FIG. 6, a schematic structural diagram of an access control apparatus according to an embodiment of the present application is provided. As shown in FIG. 6, the access control apparatus 20 of the embodiment of the present application may include a request receiving unit 21, a first generating unit 22, and a data transmitting unit 23. The access control device 20 may further include a second generating unit 24, a request transmitting unit 25, and a key receiving unit 26.

The request receiving unit 21 is configured to receive a resource access request initiated by the user.

Specifically, the request receiving unit 21 receives a resource access request initiated by the user. For example, the user may initiate a resource access request by using an access control platform or a page provided by the access control device 20. Further, the user can initiate a resource access request after successfully logging in through the user name and login password in the access control platform or page.

The resource access request includes, for example, a user identifier, a target access resource, and a target operation mode for accessing the resource to the target. The user identifier is used to mark the user who performs the target operation mode on the target access resource. For example, the target access resource may be a file, data, or the like in the server, and the target operation mode may be a read instruction, a delete instruction, a write instruction, or the like. The embodiment of the present application does not limit the manner in which the target operation mode is included.

The first generating unit 22 is configured to encrypt the resource access request by using the stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control device 20.

Specifically, the first generating unit 22 encrypts the resource access request by using the stored temporary key to generate a first signature. The temporary key is allocated by the server to the access control device 20. It can be understood that the temporary key has a certain timeliness, that is, the temporary key is valid within a certain time range. And expires in other time frames.

In a feasible solution, the server and the access control device 20 agree on a preset encryption algorithm, and the access control device 20 encrypts the resource access request by using a temporary key according to a preset encryption algorithm. First signature. The preset encryption algorithm may be, for example, DES, IDEA, or the like.

The data sending unit 23 is configured to send the resource access request and the first signature to the server, so that the server authenticates the resource access request.

Specifically, the data sending unit 23 sends the resource access request and the first signature to the server, so that the server authenticates the resource access request.

The data sending unit 23 carries the device identifier of the access control device 20 in addition to the resource access request and the first signature, so that after the server receives the resource access request, the first signature, and the device identifier, The server searches for a temporary key corresponding to the device identifier, and after the server finds the temporary key corresponding to the device identifier, generates the first verification data to complete the authentication.

The access control device 20 may further execute the second generation unit 24, the request transmission unit 25, and the key reception unit 26 after executing the request reception unit 21 and before executing the first generation unit 22.

The second generating unit 24 is configured to encrypt the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device 20.

a request sending unit 25, configured to send a temporary key acquisition request to the server, where the temporary key acquisition request carries the resource access request and the second signature, so that the server verifies the second signature The temporary key is then assigned to the access control device 20.

The key receiving unit 26 is configured to receive the temporary key allocated by the server, and store the temporary key.

The key receiving unit 26 is further configured to receive an inherent key allocated by the server for the access control device 20, and store the unique key.

It should be noted that the specific implementation manners of the second generating unit 24, the request sending unit 25, and the key receiving unit 26 may be described in detail in the embodiment shown in FIG. 3, and details are not described herein again.

FIG. 7 is a schematic structural diagram of another server according to an embodiment of the present application. As shown in FIG. 7, the server 1000 may include at least one processor 1001, such as a CPU, at least one network interface 1004, a memory 1005, and at least one communication bus 1002. Network interface 1004 can include, for example, a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 1005 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory. The memory 1005 may also be, for example, at least one storage device located remotely from the aforementioned processor 1001. Among them, the communication bus 1002 is used to implement connection communication between these components.

The server 1000 can include a user interface 1003, wherein the user interface 1003 can include a display, a keyboard. As shown in FIG. 7, an operating system, a network communication module, a user interface module, and an authentication application may be included in the memory 1005 as a computer storage medium.

In the server 1000 shown in FIG. 7, the network interface 1004 is mainly used to exchange data with the access control device, for example, a resource access request, a first signature, a temporary key acquisition request, and the like; and the processor 1001 can be used to call the memory. The authentication application stored in 1005, and specifically performs the following operations:

In a possible embodiment, before the processor 1001 performs the resource access request and the first signature sent by the access control device, the processor 1001 further performs:

Receiving, by the server, a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries the resource access request and the second signature;

Obtaining, by the server, a fixed key allocated by the access control device, and encrypting the resource access request by using the fixed key to generate second verification data;

And if the second signature matches the second verification data, the server allocates a temporary key to the access control device, and stores and sends the temporary key to the access control device.

In a possible embodiment, the resource access request includes a user identifier, a target access resource, and a target operation mode for accessing the resource to the target.

In a possible embodiment, the processor 1001 performs an authentication on the resource access request, and specifically executes:

Obtaining an accessible resource corresponding to the user identifier and an operable manner of the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If the target access resource exists, determining whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists, determining that the authentication result of the resource access request is an authentication pass.

It should be noted that the steps performed by the processor 1001 in the embodiment of the present application may be specifically implemented according to the method in the foregoing method embodiment shown in FIG. 2a, 2b, FIG. 3, and FIG. 4, and details are not described herein again.

FIG. 8 is a schematic structural diagram of another access control apparatus according to an embodiment of the present application. As shown in FIG. 8, the access control device 2000 may include at least one processor 2001, such as a CPU, at least one network interface 2004, a user interface 2003, a memory 2005, and at least one communication bus 2002. Among them, the communication bus 2002 is used to implement connection communication between these components. The user interface 2003 may include a display and a keyboard. Network interface 2004 may include a standard wired interface, a wireless interface (such as a WI-FI interface). The memory 2005 may be a high speed RAM memory or a non-volatile memory such as at least one disk memory. The memory 2005 can also be at least one storage device located remotely from the aforementioned processor 2001. As shown in FIG. 8, an operating system, a network communication module, a user interface module, and an authentication application may be included in the memory 2005 as a computer storage medium.

In the access control device 2000 shown in FIG. 8, the user interface 2003 is mainly used to provide an input interface for the user, and obtains a resource operation request sent by the user. The network interface 2004 is mainly used to exchange data with the access control device, for example, resource access. The request, the first signature, the temporary key acquisition request, and the like; and the processor 2001 can be used to invoke the authentication application stored in the memory 2005, and specifically perform the following operations:

Receiving a resource access request initiated by a user;

In a possible embodiment, the processor 2001 performs encryption on the resource access request by using the stored temporary key, and before executing the first signature, performing:

Encrypting the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device;

Sending a temporary key acquisition request to the server, the temporary key acquisition request carrying the resource access request and the second signature, so that the server passes the second signature after verifying the access control The device allocates a temporary key;

Receiving the temporary key allocated by the server, and storing the temporary key.

In a possible embodiment, the processor 2001 performs an access control device to encrypt the resource access request by using a fixed key. Before generating the second signature, the method further includes:

Receiving an inherent key assigned by the server to the access control device, and storing the unique key.

It should be noted that the steps performed by the processor 2001 described in the embodiment of the present application may be specifically implemented according to the method in the foregoing method embodiment shown in FIG. 2a, 2b, FIG. 3, and FIG. 4, and details are not described herein again.

The module or unit in the embodiment of the present application may be implemented by a general-purpose integrated circuit, such as a CPU (Central Processing Unit), or an ASIC (Application Specific Integrated Circuit).

The steps in the method of the embodiment of the present application may be sequentially adjusted, merged, and deleted according to actual needs.

The modules or units in the terminal in this embodiment of the present application may be combined, divided, and deleted according to actual needs.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above is only the preferred embodiment of the present application, and the scope of the application is not limited thereto, and the equivalent changes made in the claims of the present application are still within the scope of the present application. The above is only the preferred embodiment of the present application, and the scope of the application is not limited thereto, and the equivalent changes made in the claims of the present application are still within the scope of the present application.

Claims

An authentication method includes:

Receiving, by the server, a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Obtaining, by the server, the temporary key allocated for the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

If the first signature matches the first verification data, the server authenticates the resource access request;

If the authentication result of the resource access request is authentication, the server processes the resource access request.
The method according to claim 1, wherein before the server receives the resource access request and the first signature sent by the access control device, the method further includes:

Receiving, by the server, a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries the resource access request and the second signature;

Obtaining, by the server, a fixed key allocated by the access control device, and encrypting the resource access request by using the fixed key to generate second verification data;

And if the second signature matches the second verification data, the server allocates a temporary key to the access control device, and stores and sends the temporary key to the access control device.
The method of claim 1 or 2, wherein the resource access request comprises a user identification, a target access resource, and a target mode of operation for the target access resource.
The method of claim 3, wherein the server authenticating the resource access request comprises:

Obtaining, by the server, an accessible resource corresponding to the user identifier and an operable manner for the accessible resource;

Determining, by the server, whether the target access resource exists in the accessible resource;

If the target access resource exists, the server determines whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists, the server determines that the authentication result of the resource access request is an authentication pass.
An authentication method includes:

The access control device receives the resource access request initiated by the user;

The access control device encrypts the resource access request by using a stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control device;

The access control device sends the resource access request and the first signature to the server to enable the server to authenticate the resource access request.
The method according to claim 5, wherein the access control device encrypts the resource access request by using the stored temporary key, and before generating the first signature, the method further includes:

The access control device encrypts the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device;

The access control device sends a temporary key acquisition request to the server, the temporary key acquisition request carrying the resource access request and the second signature, so that after the server verifies the second signature Assigning a temporary key to the access control device;

The access control device receives the temporary key allocated by the server and stores the temporary key.
The method according to claim 6, wherein the access control device encrypts the resource access request by using a fixed key, and before generating the second signature, the method further includes:

The access control device receives an inherent key assigned by the server to the access control device and stores the unique key.
The method of any of claims 5-7, wherein the resource access request comprises a user identification, a target access resource, and a target mode of operation for the target access resource.
A server comprising: a processor and a memory, the computer having stored thereon computer readable instructions, the computer readable instructions being executed by the processor to:

Receiving a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Acquiring the stored temporary key allocated to the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

And if the first signature matches the first verification data, the resource access request is authenticated;

And if the authentication result of the resource access request is an authentication pass, the resource access request is processed.
The server of claim 9 wherein said computer readable instructions are executed by said processor to further perform the following operations:

Receiving a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries a resource access request and a second signature;

Obtaining a fixed key allocated to the access control device, and encrypting the resource access request by using the fixed key to generate second verification data;

And if the second signature matches the second verification data, the server allocates a temporary key to the access control device, and stores and sends the temporary key to the access control device.
The server according to claim 9 or 10, wherein the resource access request comprises a user identification, a target access resource, and a target operation mode for accessing the resource to the target.
The server according to claim 11, wherein said authenticating said resource access request comprises:

Obtaining an accessible resource corresponding to the user identifier and an operable manner of the accessible resource;

Determining whether the target access resource exists in the accessible resource;

If the first determining subunit determines that the target access resource exists in the accessible resource, determining whether the target operating mode exists in an operable manner of the target accessing resource;

If the second determining subunit determines that the target operating mode exists in the operable mode of the target access resource, determining that the authentication result of the resource access request is the authentication pass.
An access control apparatus comprising: a processor and a memory, the memory storing computer readable instructions, the computer readable instructions being executed by the processor to:

Receiving a resource access request initiated by a user;

Encrypting the resource access request by using the stored temporary key to generate a first signature, the temporary key being previously allocated by the server for the access control device;

Sending the resource access request and the first signature to the server to enable the server to authenticate the resource access request.
The access control device of claim 13, wherein the computer readable instructions are executed by the processor to further complete the encrypting the resource access request with a stored temporary key to generate a first signature The following operations:

Encrypting the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device;

Sending a temporary key acquisition request to the server, the temporary key acquisition request carrying the resource access request and the second signature, so that the server passes the second signature after verifying the access control The device allocates a temporary key;

Receiving the temporary key allocated by the server, and storing the temporary key.
The access control device according to claim 14, wherein said computer readable instructions are executed by said processor to further perform the following operations before encrypting said resource access request with a fixed key to generate a second signature :

Receiving an inherent key assigned by the server to the access control device, and storing the unique key.
The access control apparatus according to any one of claims 13 to 15, wherein the resource access request includes a user identification, a target access resource, and a target operation mode for accessing the resource to the target.
An authentication method for a server, the server comprising a processor and a memory, the method comprising the steps of:

Receiving, by the server, a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Obtaining, by the server, the temporary key allocated for the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

If the first signature matches the first verification data, the server authenticates the resource access request;

If the authentication result of the resource access request is authentication, the server processes the resource access request.
The method according to claim 17, wherein before the server receives the resource access request and the first signature sent by the access control device, the method further includes:

Receiving, by the server, a temporary key acquisition request sent by the access control device, where the temporary key acquisition request carries the resource access request and the second signature;

Obtaining, by the server, a fixed key allocated by the access control device, and encrypting the resource access request by using the fixed key to generate second verification data;

And if the second signature matches the second verification data, the server allocates a temporary key to the access control device, and stores and sends the temporary key to the access control device.
The method of claim 17 or 18, wherein the resource access request comprises a user identification, a target access resource, and a target mode of operation for accessing the resource to the target.
The method of claim 19, wherein the server authenticating the resource access request comprises:

Obtaining, by the server, an accessible resource corresponding to the user identifier and an operable manner for the accessible resource;

Determining, by the server, whether the target access resource exists in the accessible resource;

If the target access resource exists, the server determines whether the target operation mode exists in an operable manner of accessing the resource to the target;

If the target operation mode exists, the server determines that the authentication result of the resource access request is an authentication pass.
An authentication method for accessing a control device, the access control device comprising a processor and a memory, wherein the method comprises:

The access control device receives the resource access request initiated by the user;

The access control device encrypts the resource access request by using a stored temporary key to generate a first signature, where the temporary key is previously allocated by the server for the access control device;

The access control device sends the resource access request and the first signature to the server to enable the server to authenticate the resource access request.
The method according to claim 21, wherein the access control device encrypts the resource access request by using the stored temporary key, and before generating the first signature, the method further includes:

The access control device encrypts the resource access request by using a fixed key to generate a second signature, where the fixed key is allocated by the server for the access control device;

The access control device sends a temporary key acquisition request to the server, the temporary key acquisition request carrying the resource access request and the second signature, so that after the server verifies the second signature Assigning a temporary key to the access control device;

The access control device receives the temporary key allocated by the server and stores the temporary key.
The method according to claim 22, wherein the access control device encrypts the resource access request by using a fixed key, and before generating the second signature, the method further includes:

The access control device receives an inherent key assigned by the server to the access control device and stores the unique key.
The method of any of claims 21-23, wherein the resource access request comprises a user identification, a target access resource, and a target mode of operation for the target access resource.
A non-volatile storage medium having stored therein computer readable instructions executable by a processor to perform the following operations:

Receiving a resource access request and a first signature sent by the access control device, where the first signature is generated by the access control device by using the stored temporary key to encrypt the resource access request;

Acquiring the stored temporary key allocated to the access control device, and encrypting the resource access request by using the temporary key to generate first verification data;

And if the first signature matches the first verification data, the resource access request is authenticated;

And if the authentication result of the resource access request is an authentication pass, the resource access request is processed.
A non-volatile storage medium having stored therein computer readable instructions executable by a processor to perform the following operations:

Receiving a resource access request initiated by a user;

Encrypting the resource access request by using the stored temporary key to generate a first signature, the temporary key being previously allocated by the server for the access control device;

Sending the resource access request and the first signature to the server to enable the server to authenticate the resource access request.