Authority revoking method and device
An authorizing party determines an authorization record set that needs to be revoked, where an authorization record included in the authorization record set corresponds to a token that is issued to an authorized party after the authorizing party grants access to the authorized party, and where each authorization record includes an authorization validation moment for a corresponding token. A time validity attribute of the authorization record set is configured. For a specific point-in-time, a value associated with the time validity attribute is set. A determination is performed as to whether the authorization record is revoked based on the authorization validation moment and the value associated with the time validity attribute.
1. A computer-implemented method, comprising:
receiving, by an authorizing party and from an application, a plurality of first access requests to a service provided by the authorizing party, wherein the plurality of first access requests correspond to a plurality of users;
determining, by the authorizing party, that the plurality of first access requests are granted;
issuing, by the authorizing party and to the application, a plurality of tokens;
storing, by the authorizing party, a plurality of authorization records that correspond to the plurality of tokens, wherein each authorization record includes a validation date of the authorization record;
determining, by the authorizing party, an authorization record set that needs to be revoked, wherein the authorization record set comprises the plurality of authorization records;
modifying a time validity attribute value of the authorization record set to revoke authorization records in the authorization record set in batches, comprising:
determining a latest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked;
determining a next earliest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked; and
setting the time validity attribute value to a future date, wherein the future date is set to a range between the latest authorization validation date and the next earliest authorization validation date;
receiving a second access request from the application for accessing the service provided by the authorizing party, wherein the second access request corresponds to a particular user among the plurality of users;
determining, by the authorizing party, a particular authorization record to be verified that corresponds to the particular user;
obtaining, the validation date of the authorization record to be verified;
obtaining, the time validity attribute value of the authorization record set that includes the particular authorization record to be verified;
determining that the particular authorization record to be verified is revoked if the validation date of the authorization record is earlier than the time validity attribute value of the authorization record set; and
in response, rejecting the second access request from the application for accessing the service.
2. The computer-implemented method of claim 1 , wherein modifying the time validity attribute value of the authorization record set further comprises setting the time validity attribute value to a current moment.
3. The computer-implemented method of claim 1 , wherein the authorization record set is configured with another time validity attribute value, and wherein the time validity attribute value is set to a first value and the other time validity attribute value is set to a second value, and the authorization record is revoked:
whenever the validation date is earlier than the first value; or
whenever the validation date is later than the second value.
4. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
receiving, by an authorizing party and from an application, a plurality of first access requests to a service provided by the authorizing party, wherein the plurality of first access requests correspond to a plurality of users;
determining, by the authorizing party, that the plurality of first access requests are granted;
issuing, by the authorizing party and to the application, a plurality of tokens;
storing, by the authorizing party, a plurality of authorization records that correspond to the plurality of tokens, wherein each authorization record includes a validation date of the authorization record;
determining, by the authorizing party, an authorization record set that needs to be revoked, wherein the authorization record set comprises the plurality of authorization records;
modifying a time validity attribute value of the authorization record set to revoke authorization records in the authorization record set in batches, comprising:
determining a latest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked;
determining a next earliest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked; and
setting the time validity attribute value to a future date, wherein the future date is set to a range between the latest authorization validation date and the next earliest authorization validation date;
receiving a second access request from the application for accessing the service provided by the authorizing party, wherein the second access request corresponds to a particular user among the plurality of users;
determining, by the authorizing party, a particular authorization record to be verified that corresponds to the particular user;
obtaining, the validation date of the authorization record to be verified;
obtaining, the time validity attribute value of the authorization record set that includes the particular authorization record to be verified;
determining that the particular authorization record to be verified is revoked if the validation date of the authorization record is earlier than the time validity attribute value of the authorization record set; and
in response, rejecting the second access request from the application for accessing the service.
5. The non-transitory, computer-readable medium of claim 4 , wherein modifying the time validity attribute value of the authorization record set further comprises setting the time validity attribute value to a current moment.
6. The non-transitory, computer-readable medium of claim 4 , wherein the authorization record set is configured with another time validity attribute value, and wherein the time validity attribute value is set to a first value and the other time validity attribute value is set to a second value, and the authorization record is revoked:
whenever the validation date is earlier than the first value; or
whenever the validation date is later than the second value.
7. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
receiving, by an authorizing party and from an application, a plurality of first access requests to a service provided by the authorizing party, wherein the plurality of first access requests correspond to a plurality of users;
determining, by the authorizing party, that the plurality of first access requests are granted;
issuing, by the authorizing party and to the application, a plurality of tokens;
storing, by the authorizing party, a plurality of authorization records that correspond to the plurality of tokens, wherein each authorization record includes a validation date of the authorization record;
determining, by the authorizing party, an authorization record set that needs to be revoked, wherein the authorization record set comprises the plurality of authorization records;
modifying a time validity attribute value of the authorization record set to revoke authorization records in the authorization record set in batches, comprising:
determining a latest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked;
determining a next earliest authorization validation date associated with the authorization records in the authorization record set that needs to be revoked; and
setting the time validity attribute value to a future date, wherein the future date is set to a range between the latest authorization validation date and the next earliest authorization validation date;
receiving a second access request from the application for accessing the service provided by the authorizing party, wherein the second access request corresponds to a particular user among the plurality of users;
determining, by the authorizing party, a particular authorization record to be verified that corresponds to the particular user;
obtaining, the validation date of the authorization record to be verified;
obtaining, the time validity attribute value of the authorization record set that includes the particular authorization record to be verified;
determining that the particular authorization record to be verified is revoked if the validation date of the authorization record is earlier than the time validity attribute value of the authorization record set; and
in response, rejecting the second access request from the application for accessing the service.
8. The computer-implemented system of claim 7 , wherein modifying the time validity attribute value of the authorization record set further comprises setting the time validity attribute value to a current moment.
9. The computer-implemented system of claim 7 , wherein the authorization record set is configured with another time validity attribute value, and wherein the time validity attribute value is set to a first value and the other time validity attribute value is set to a second value, and the authorization record is revoked:
whenever the validation date is earlier than the first value; or
whenever the validation date is later than the second value.