An Authorized Access Method for Browser Clients and Servers

Abstract

The invention relates to an authorized access method for a browser client and a server. The method comprises following steps of (1), login verification; generating a dynamic password secret key, server time and dynamic password secret key expiration time by a server if the login verification is successful; storing in client cache; executing a step (2); otherwise, finishing; (2) judging whether the dynamic password secret key expiration time in the client cache arrives or not, if the expiration time arrives, executing a step (3); otherwise, executing a step (4); (3), switching the dynamic password secret key; obtaining new dynamic password secret key, server time and dynamic password secret key expiration time if the dynamic password secret key is switched successfully; correspondingly updating the client cache; executing the step (4); otherwise, finishing; (4), generating a dynamic password through adoption of the dynamic password secret key and the server time in the client cache of a browser; carrying out authorized access to the server; and returning to the step (2). Compared with the prior art, the method has the advantages that the authorized access process is safe and reliable and is not liable to be cracked.

Description

technical field [0001] The invention relates to an authorized access method, in particular to an authorized access method for browser clients and servers. Background technique [0002] With the continuous development of information technology, account information security has received more and more attention. When the user accesses the server on the browser client, in order to obtain more personalized services, it is usually necessary to register an account corresponding to the server. In order to ensure the security of the account, the user is required to edit a password corresponding to the account. During the period when the browser client accesses the server, it needs to continuously verify the authority, usually by storing the token after the login verification is passed, and upload the saved token to the server every time the authority verification is required to achieve the purpose of verifying the user's identity. In this way, if the token is intercepted, others can...

AI Technical Summary

Problems solved by technology

In this way, if the token is intercepted, others can pretend to be users, causing information leakage, and it is impossible to distinguish which is the real logged-in user

Images