CN112685718A

CN112685718A - Method for invalidating original access token during multi-terminal login of same account based on OAuth protocol

Info

Publication number: CN112685718A
Application number: CN202110141479.0A
Authority: CN
Inventors: 曹帙云; 孔繁祥; 岑斌
Original assignee: KaVo Kerr Dental Suzhou Co Ltd
Current assignee: KaVo Kerr Dental Suzhou Co Ltd
Priority date: 2021-02-02
Filing date: 2021-02-02
Publication date: 2021-04-20

Abstract

The invention provides a method for invalidating an original access token when logging in a same account at multiple ends based on an OAuth protocol, which comprises the following steps: an access token generation step of marking the existing access token as a foreign login and generating a new access token when the user logs in through a user name and a password; and when the client carries the access token to request the resource service, judging whether the access token carried by the client is legal and valid, and preventing the client from accessing the resource when the access token is invalid. The method can effectively prevent the unsafe condition that the user is utilized by other people when the user logs in by another terminal under the condition of not logging out of the system when using the platform system based on the OAuth protocol, and can ensure that the same user only has one effective access token at the same time.

Description

Method for invalidating original access token during multi-terminal login of same account based on OAuth protocol

Technical Field

The invention belongs to the field of electronic information network security, and particularly relates to a method for invalidating an original access token when logging in at multiple ends of the same account based on an OAuth protocol.

Background

In the existing platform based on OAuth2.0 protocol standard, the problems of authentication and authorization of users are solved, but the following problems often exist in the current platform: if a user logs in at one terminal but does not log off in time and logs in at another terminal, the original terminal can still be used before the access token expires. In this case, there is a risk that the original login is used by another person.

In order to solve the problem that the same account can only log in on one terminal, a method for immediately disabling the access token of another terminal when a user logs in on one terminal is needed.

Disclosure of Invention

The problems to be solved by the invention are as follows:

in order to solve the above problems, an object of the present invention is to provide a method for invalidating an original access token when logging in a plurality of terminals of a same account based on an OAuth protocol, which can prevent an insecure situation of the original login used by others.

The technical means for solving the problems are as follows:

the invention provides a method for invalidating an original access token when logging in a same account at multiple ends based on an OAuth protocol, which comprises the following steps: an access token generation step of marking the existing access token as a foreign login and generating a new access token when the user logs in through a user name and a password; and when the client carries the access token to request the resource service, judging whether the access token carried by the client is legal and valid, and preventing the client from accessing the resource when the access token is invalid.

According to the invention, the existing access token can be invalidated when the user logs in, and the resource request of the client with the invalid token is refused.

In the present invention, the access token generation step may include: 1) when the current valid access token of the user exists in a Redis cache database, marking the access token as allopatric login; 2) generating the new access token; 3) storing the new access token and the identity data of the user in a Redis cache database; 4) and sending the new access token to the client. Thus, an existing access token can be invalidated by marking it as a foreign login.

In the present invention, the access token verifying step may include: 1) the authentication server verifies whether the access token exists; 2) retrieving in a Redis cache database whether the access token is a token marked as a foreign login; 3) and when the access token is judged to be the token marked as allopatric login, judging that the access token is illegal, and preventing the client from accessing the resource. Thus, each time the client requests a resource from the resource server, it can be verified whether the current access token is the newly generated and still valid access token, and it can be ensured that the current access is from a unique terminal.

The invention has the following effects:

the invention can effectively prevent the unsafe condition that the user is utilized by other people when the user logs in by another terminal under the condition of not logging out of the system when using the platform system based on the OAuth protocol, and can ensure that the same user only has one effective access token at the same time.

Drawings

FIG. 1 is a system architecture diagram of an OAuth protocol platform according to one embodiment of the present invention;

FIG. 2 is a functional block diagram of an authentication server in the OAuth protocol platform of FIG. 1;

FIG. 3 is a functional block diagram of a resource server in the OAuth protocol platform of FIG. 1;

FIG. 4 is a flowchart of the access token generation steps of a method for invalidating an original access token when logging in to multiple terminals of the same account based on an OAuth protocol;

fig. 5 is a flowchart of the access token verification step of the method for invalidating the original access token when logging in with multiple terminals of the account based on OAuth protocol.

Detailed Description

The present invention will be further described with reference to the accompanying drawings and the following embodiments, which are to be understood as merely illustrative and not restrictive.

Disclosed herein is a method for invalidating an original access token (hereinafter, referred to as an access token invalidation method) when logging in to a same account at multiple ends based on an OAuth protocol, which can prevent an unsafe condition that an original login is utilized by another person. The invention is based on an OAuth certified software system and a Redis cache database.

Fig. 1 is a system configuration diagram of an OAuth protocol platform according to an embodiment of the present invention, fig. 2 is a functional block diagram of an authentication server in the OAuth protocol platform, and fig. 3 is a functional block diagram of a resource server in the OAuth protocol platform.

As shown in fig. 1, the OAuth protocol platform mainly includes a Client (Client), an authentication Server (authentication Server), a Resource Server (Resource Server), and a Resource Owner (Resource Owner), which are not shown.

The resource owner is the owner, the so-called user, of the protected resource residing at the server provider. The client is a program corresponding to the server and providing local service for the client, and needs to be operated in cooperation with the server. The user is used as the owner of the resource, the login operation is initiated when the user wants to access the resource, and the client prompts the user to input a user name and a password after receiving the identity authentication requirement. The client then requests an access token from the authentication server described later.

As shown in fig. 1 and 2, the authentication server is mainly responsible for verifying the identity of the user and providing the authorization token, and includes a user identity verification module, an access token generation module, and an access token verification module. The user identity authentication module is mainly used for authenticating the validity of the user identity and accessing the token generation module. The access token generation module is mainly used for returning the access token to the client after the user identity authentication is passed. The access token verifying module is mainly used for verifying the validity of the access token when the client carries the access token to access a resource server which is described later.

As shown in fig. 1 and 3, the resource server is mainly used for storing user data and http service, and may return the user data to the authenticated client, which includes a module for verifying the access token verification request and a module for providing protected resources to the client. When the client carries the access token issued by the authentication server to request protected resources from the resource server, the module for verifying the access token verification request is used for verifying the validity of the access token, and if the verification is passed, the resource request is responded. Specifically, after receiving a resource request from a client, the resource server sends an access token carried by the resource request to an authentication server, receives verification at an access token verification module of the authentication server, and returns user information to the resource server after verification is successful. And the module for providing the protected resource to the client provides the protected resource to the user after verifying that the access token is valid.

The access token invalidation method in the embodiment includes an access token generation step and an access token verification step. The access token generation step is mainly used for calling an authorization endpoint (authorization endpoint) of the authentication server to mark the existing access token of the user in the Redis cache database as allopatric login and simultaneously generating a new access token after the user passes the user name and password verification. The access token verifying step is mainly used for judging whether the access token carried by the client is legal and valid or not and whether the access token is logged in different places or not through an authorization endpoint of the authentication server.

Fig. 4 is a flowchart of access token generation steps of a method for invalidating an original access token when logging in with multiple terminals of an account based on an OAuth protocol according to an embodiment of the present invention. As shown in fig. 4, the token generation step mainly includes the following steps.

After a user logs in the authentication server through a user name and a password at the same terminal (client), step S11 is started, and the user enters a Redis cache database of the authentication server to search whether the current user has an existing valid access token. The existing valid access token refers to a still valid access token (i.e., an access token that has not yet been invalidated) generated when the user logs in to the client on another terminal before. The access token is generated by an authorized endpoint of the authentication server and stored in a Redis cache database.

If it is determined that there is a valid access token for the user (i.e., a valid access token that the user already has is found), the process proceeds to step S15. In step S15, all existing access tokens are regarded as old address tokens, and the authorization endpoint marks the existing access tokens as a foreign login, i.e., invalidates the existing access tokens. After the marking is completed, the process proceeds to step S12.

On the other hand, if it is determined in step S11 that such an access token does not exist, the process proceeds directly to step S12.

In step S12, the authentication server generates a new access token for the current user. After the new access token is generated, the process proceeds to step S13.

Next, in step S13, the system stores the new access token along with the identity information of the current user in the Redis cache database. After the storage is completed, the process proceeds to step S14, where the newly generated access token is sent to the client.

In this way, whether and when the current user logs in another terminal can be judged by entering the Redis cache database to check whether a valid access token existing in the current access user exists. When the user is judged to have the valid access token, the existing access token can be marked to be logged in different places to be invalid.

Fig. 5 is a flowchart of the access token verifying step of the method for invalidating the original access token when logging in with multiple terminals of an account based on the OAuth protocol according to an embodiment of the present invention. And when the client carries the access token to request resources from the resource server, the resource server sends the access token to the authentication server, and an access token verification process for verifying the access token is performed in the authentication server. As shown in fig. 5, the access token authentication flow mainly includes the following steps.

An authorization endpoint at the authentication server determines whether the access token received from the resource server is valid. Specifically, in step S21, the authentication server retrieves the access token from the Redis cache database. If the access token is found to have been marked as a foreign login (e.g., step S15 above), it is determined that the access token is not legitimate, and an error message indicating that the token is invalid is returned, i.e., the process proceeds to step S23, and the client is prevented from accessing the resource. Otherwise, if the access token is found not to be logged in different places after retrieval, the access token is a new access token generated after the user logs in the client by inputting a user name and a password on the current terminal, step S21 determines that the access token is valid, and step S22 is proceeded.

In step S22, the authentication server determines that the access token is verified and returns the resource to which the client lock requested access.

This makes it possible to verify, each time a client requests a resource from the resource server, whether the current access token is the most recently generated and still valid access token, i.e. to ensure that the current access comes from a unique terminal.

In addition, in the event that the access token authentication fails in step S23, the system may require the user to re-enter the username and password. And after the user inputs the user name and the password to log in the authentication system again, starting a new round of access token generation steps.

In addition, the present invention may also include the step of determining whether an access token is present in the Redis cache database, thereby determining whether the access token is expired and automatically cleared. For example, in step 12, the authentication server may record the login occurrence time while generating a new access token for the current user. When a new access token is stored in the Redis cache database, a pre-defined cache expiration time may be set as the valid time. The self-defined cache expiration time is an operation parameter set when the server is deployed. And a caching mechanism of the Redis cache database is utilized, so that the new access token is automatically expired and automatically cleared after the valid time is exceeded.

According to the invention, when the platform system based on the OAuth protocol is used, even if a user forgets to log out of the system from the previous terminal, the access token on the original terminal can be invalidated by logging in the verification system on the new terminal, so that the same user only has one valid access token at the same time, the unsafe condition of being utilized by other people can be avoided, and the safety of the platform is improved.

The above embodiments are intended to illustrate and not to limit the scope of the invention, which is defined by the claims, but rather by the claims, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. a method for invalidating the original access token when the same account number is multi-terminal logged in based on the OAuth protocol, is characterized in that,

Include the following steps:

An access token generation step that marks an existing access token for offsite login and generates a new access token when the user logs in by username and password; and

When the client carries the access token to request the resource service, it is determined whether the access token carried by the client is legal and valid, and the access token verification step of preventing the client from accessing the resource when the access token is invalid.

2. the method for making the original access token invalid when the same account number is multi-terminal logged in based on the OAuth protocol according to claim 1, is characterized in that,

The step of generating the access token includes:

1) When the current valid access token of the user exists in the Redis cache database, mark the access token as remote login;

2) Invoke the authentication server to generate the new access token;

3) Store the new access token and the user's identity data in the Redis cache database;

4) Send the new access token to the client.

3. the method for making the original access token invalid when the same account number multi-terminal login based on the OAuth protocol according to claim 1, is characterized in that,

The access token verification steps include:

1) The authentication server verifies whether the access token exists;

2) Retrieve in the Redis cache database whether the access token is a token marked as a remote login;

3) When it is determined that the access token is a token marked as a remote login, it is determined that the access token is invalid, and the client is prevented from accessing the resource.