A login authentication method and system for web applications

Abstract

The invention discloses a log-in authentication method on web application. The method includes the following steps that after a log-in request of a user is received, a browser obtains authentication information by means of two random numbers provided by a web server and sends the authentication information to the web server; the web server carries out log-in authentication according to the stored user information and the received authentication information. The invention further provides a log-in authentication system on the web application. According to the technical scheme, data tampering, intercepting attract, decimal attract, dictionary attack, replay attract and denial of service attack can be prevented.

Description

technical field [0001] The invention relates to Internet technology, in particular to a login authentication method and system for web applications. Background technique [0002] With the rapid development of Internet technology and the continuous popularization of web applications, the security of user information becomes more and more important when implementing login authentication based on web applications. The login authentication of traditional web applications is to transmit the identity information and password entered by the user to the web server, and confirm the legitimacy of the user's identity by comparing it with the data stored in the web server. [0003] At present, there is a fatal flaw in this web application login authentication method, and identity information and passwords are easily stolen, thereby incurring replay attacks by attackers. For this defect, in the prior art, there are the following solutions: [0004] The first one uses certificate-based ...

AI Technical Summary

Problems solved by technology

However, the existing one-time password mechanism is increasingly exposed to vulnerabilities such as guessing, tampering and analysis.

For example, in the challenge / response mechanism, the password is statically stored on the server in some form, which is easy to be analyzed; additional protection measures such as Secure Sockets Layer (SSL, Secure Sockets Layer) need to be used for user login authentication, and SSL requires a relatively high cost. Fees are used to purchase, which brings economic burden to users and affects system authentication processing performance

[0006] The third is to use the password sequence mechanism, which is vulnerable to decimal attacks

In addition, the browser side of this mechanism needs to calculate the hash value multiple times, and the calculation amount is relatively large.

Images