Secured logon method for variable secret key encryption under HTTP

Abstract

The invention relates to a secured logon method for variable secret key encryption under an HTTP. The method includes the following steps that a server terminal generates a temporary secret key K according to a login authentication request of a client terminal, and the temporary secret key is sent back to the client terminal and cached at the client terminal; the client terminal generates user information abstract data Hp1 according to a clear-text password and the temporary secret key in an encryption mode; whether the temporary secret key K with the IP being a key value exists or not is inquired by the server terminal according to the login authentication request, and if not, it is judged that the login authentication fails; if yes, a user password of the server terminal is inquired, server terminal information abstract data Hp2 are generated according to the user password of the server terminal and the temporary secret key, the Hp2 is compared with the Hp1, and whether the login authentication fails or succeeds is judged. According to the secured logon method, the secret key and the data are both dynamic, an illegal third party cannot calculate the password data used by current login, and therefore the technical problem that the security is low due to the fact that the passwords are likely to be leaked or forged during login authentication in the prior art can be solved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a secure login method for variable key encryption under the HTTP protocol. Background technique [0002] The HTTP protocol transmits data in plain text. Usually, when processing user login, the client encrypts passwords and other high-level security information through some Hash algorithms and then transmits them to the server. The server receives the encrypted data and saves it in the database. The data encrypted by the same Hash algorithm is compared to complete a login verification. Although this method also encrypts the password, the encryption algorithm on the client side and the server side are the same, and the transmission process is also in plain text, just like wearing a dress for the password, and this dress is used every time you log in. They are not changed. In this way, the security of login is compromised. Contents of the invention [0003] In ord...

AI Technical Summary

Problems solved by technology

[0003] In order to achieve a more secure and reliable login verification and solve the technical problems of low security such as passwords are easily leaked or forged during login verification in the prior art, the present invention provides a secure login method with variable key encryption under the HTTP protocol. In the way of variable key encryption, the key and data are dynamically changed, and the illegal third party cannot calculate the password data used for the current login, which greatly improves the security

Images