A single-system multi-platform authentication method

Abstract

The invention discloses a single-system multi-platform identity verification method, comprising the following steps: S1, the server obtains the user name and user password used by the client to log in; S2, the server receives the access request and cipher text sent by the client; S3, the server Verify the ciphertext, enter step S4 after the verification is successful, and execute the first adjustment scheme if the verification is unsuccessful; S4, the server parses the ciphertext, and determines whether there is an error in the current operation according to the protocol content of each client, if there is no error, then enter step S5, Otherwise, execute the second adjustment scheme; S5, the server returns a receipt allowing the client to access the restricted resource, and re-encrypts the message. The identity verification method of the present invention does not leave customer information on the server, adopts encryption method to circulate, modify characters, use crawler engine to hit the library or use expired ciphertext to generate attack warning, which can effectively reduce the risk of using cache and using session session. Induced session fixation attack risk.

Description

technical field [0001] The invention belongs to the technical field of identity verification, in particular to a single-system multi-platform identity verification method. Background technique [0002] There are four authentication methods in the Web: Basic, Form, Digest, SSL: [0003] 1. Basic (proposed by HTTP 1.0) [0004] After the client requests a certain resource, the server will send a 401 (unauthorized) response with Realm information in the response indicating that Basic authentication is used. [0005] After the browser receives this response, a box will pop up to enter the user name and password. Click Cancel to cancel the authentication, and click OK to submit the user name and password to the server. The way to submit is to add in the HTTP header: [0006] WWW-Authorization: Basic XXXXXXXX [0007] Basic is followed by the BASE64 encoding of the username and password. In client programming, this content is constructed as: [0008] String cre=userName+":"...

AI Technical Summary

Problems solved by technology

[0034] The biggest problem among the above four basic authentication methods is that identity authentication can only be maintained from the level of data encryption and sessions, but the system content between different platforms cannot be synchronized

Secondly, it is impossible to identify whether the user's login failure behavior and session failure process are caused by wrong operations or attacks

Images