Single-system multi-platform authentication method

Abstract

The invention discloses a single-system multi-platform authentication method. The single-system multi-platform authentication method comprises the following steps: S1, acquiring a user name and a user cipher by a server, wherein the user name and the user cipher are used when a client computer is registered; S2, receiving an access request and cryptograph sent from the client computer by the server; S3, verifying the cryptograph by the server, and if verification is successful, entering the step S4, and if not, executing a first adjusting scheme; S4, analyzing the cryptograph the server, and according to the protocol content of each client computer, deciding whether errors exist in the current operation, and if no error exists, entering the step S5, and if not, executing a second adjusting scheme; and S5, returning a receipt about allowing the client computer to access the restricted resource by the server, and re-encrypting the message. The single-system multi-platform authentication method does not leave the client information on the server, and is circulated in the encryption mode, and as attack alarm can be produced because of modifying characters and using a crawler engine to hit the database or using overdue cryptograph, the risk of using buffer can be reduced and a session fixation attack risk caused by using of the session can be effectively reduced.

Description

technical field [0001] The invention belongs to the technical field of identity verification, in particular to a single-system multi-platform identity verification method. Background technique [0002] There are four authentication methods in the Web: Basic, Form, Digest, SSL: [0003] 1. Basic (proposed by HTTP 1.0) [0004] After the client requests a certain resource, the server will send a 401 (unauthorized) response with Realm information in the response indicating that Basic authentication is used. [0005] After the browser receives this response, a box will pop up to enter the user name and password. Click Cancel to cancel the authentication, and click OK to submit the user name and password to the server. The way to submit is to add in the HTTP header: [0006] WWW-Authorization: Basic XXXXXXXX [0007] Basic is followed by the BASE64 encoding of the username and password. In client programming, this content is constructed as: [0008] String cre=userName+":"...

AI Technical Summary

Problems solved by technology

[0034] The biggest problem among the above four basic authentication methods is that identity authentication can only be maintained from the level of data encryption and sessions, but the system content between different platforms cannot be synchronized

Secondly, it is impossible to identify whether the user's login failure behavior and session failure process are caused by wrong operations or attacks

Images