Portal Web server and method for preventing off-line request forgery

Abstract

A method for preventing off-line request forgery includes: enabling a Portal Web server to store a fixed secret key, generate a random secret key for each user passing through authentication, generate a final encrypted string by means of two-time encryption according to the random secret key and the fixed secret key, and transmit the encrypted string to the user by carrying the encrypted string in a response message; and performing back-stepping decryption for the encrypted string to analyze a source IP (internet protocol) address corresponding to the encrypted string if an off-line request of the user carries encrypted string information, comparing the analyzed source IP address with a source IP address of the user in the message, allowing the user to be off-line if the comparison is consistent, and if the comparison is inconsistent, the request message is considered to be forged, and making no response. By the aid of the technical scheme, internal memory of the Portal Web server is released, and performance and operating efficiency of the Portal Web server are improved.

Description

technical field [0001] The invention relates to portal authentication, in particular to Portal authentication and a technique for preventing fake offline requests. Background technique [0002] Portal authentication is usually also called web authentication, and the portal authentication website is generally called a portal website. When an unauthenticated user surfs the Internet, the device forces the user to log in to a specific site, where the user can access services for free. When users need to access other information on the Internet, they must be authenticated on the portal website, and only after passing the authentication can they access Internet resources. [0003] A user can actively visit a known Portal authentication website and enter a user name and password for authentication. This method of starting Portal authentication is called active authentication. Conversely, if the user tries to access other external networks through HTTP, he will be forced to visit ...

AI Technical Summary

Problems solved by technology

[0006] In practical applications, the Portal Web server often has insufficient memory space and performance. Especially in an environment with a large number of user authentications, the Portal Web server needs enough memory space to store the correspondence between a large number of user IP addresses and encrypted strings. relationship, and users go online and offline, which also makes the memory space of the Portal Web server face the test of memory release and refresh.

Images