Authentication method and system

Abstract

The embodiment of the invention discloses an authentication method and system, and the method comprises the steps that a client application transmits first information to a target server, wherein thefirst information at least comprises first data obtained through the processing of an obtained first random number and / or a first graphic code; the client application receives a processing result forthe first information returned by the target server; under the condition that the processing result meets a first condition, the client application at least outputs a first authentication result, wherein the mode of processing the first random number and / or the first graphic code by the client application is at least related to the attribute of the target server, and the first authentication result represents that the target server obtains a trust certificate. According to the authentication method and system provided by the embodiment of the invention, identity authentication is carried out by sending the encrypted random number and / or graphic code to the server, so that the problem that the enterprise client cannot be normally used after the certificate is modified by software is avoided, and the connection security and stability of the client and the server are improved.

Description

technical field [0001] The present application relates to the technical field of information processing, in particular to an authentication method and system. Background technique [0002] At present, many client software needs to access online resources to provide functions. Before accessing online resources, it is necessary to confirm that the server being accessed is the server the client wants to access, that is, identity verification must be done before accessing to ensure access security and stability. [0003] Related technologies generally implement identity confirmation by means of verifying certificates, that is, to determine whether the preview file of the server certificate is in the trust list of the client. However, this verification method still has the risk of being attacked by middleware, such as routers, corporate firewalls, and local hijacking software. If the certificate is maliciously hijacked, and the client does not check whether the certificate has ...

AI Technical Summary

Problems solved by technology

However, this verification method still has the risk of being attacked by middleware, such as routers, corporate firewalls, and local hijacking software.

If the certificate is maliciously hijacked, and the client does not check whether the certificate has been tampered with, it will bring the threat of being maliciously attacked

On the other hand, if the certificate is hijacked without risk, such as a corporate firewall, and the client verifies whether the certificate is trusted by obtaining the certificate information carried by the HTTPS (Hyper Text Transfer Protocol over Secure Socket Layer) connection , the client software will think that the network is not safe, so that enterprise users cannot use the client software

In short, when the client initiates access to the server, the security and stability of the access connection is low, which affects the user experience.

Images