A login ticket protection method and server

Abstract

The present invention discloses a method and server for protecting a login ticket, wherein the method comprises: receiving a business request; querying the login ticket corresponding to the business request from a preset storage location according to the business request; when the login ticket exists, decrypting the login ticket using a first decryption method; encrypting the login ticket and the business request using a second encryption method, and transmitting them to an application system; when receiving the business request result fed back by the application system, displaying a corresponding page based on the business request result; the implementation process of this method is not restricted by the network, and does not require frequent login as the network changes, so the method solves the defect of being restricted by the network in the prior art, and ensures the security of the login ticket during storage and transmission through two different encryption methods, thereby providing users with a good experience.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a login ticket protection method and a server. Background Art

[0002] The login ticket is used as the basis for verifying whether the user's identity is legitimate. When the user logs in to the application system to make a corresponding business request, the login ticket is needed to determine whether the operation is legal. During the transmission of the login ticket, there are security issues. Once the login ticket is stolen by an attacker, the attacker does not even need to know the user's password, biometrics and other information to impersonate the user and perform some illegal operations in the application system.

[0003] In order to improve the security of login tickets during transmission and storage, the solution in the prior art is to bind the login ticket to the IP. If the network environment where the login ticket exists changes, the IP will change, and the system will consider the current access untrustworthy and automatically cancel the login ticket. However, this solution has a defect, that is, it is limited by network changes. Users need to log in frequently as the network changes, which brings a bad experience to users.

[0004] Therefore, how to improve the security of login tickets without being restricted by the network is a problem that needs to be solved now. Summary of the invention

[0005] Therefore, the technical problem to be solved by the present invention is to overcome the defect in the prior art that users need to log in frequently as the network changes, thereby providing a login ticket protection method and server.

[0006] In a first aspect, the present invention provides a method for protecting a login ticket, which is executed by a search engine and includes: receiving a business request; querying a login ticket corresponding to the business request from a preset storage location according to the business request; when the login ticket exists, decrypting the login ticket using a first decryption method, wherein the login ticket is encrypted according to a first encryption method and stored in a preset storage location, and the first encryption method corresponds to the first decryption method; encrypting the login ticket and the business request using a second encryption method, and transmitting them to an application system, so that the application system, based on the login ticket and the business request, feeds back a business request result corresponding to the business request; receiving the business request result fed back by the application system, and displaying a corresponding page based on the business request result.

[0007] The present invention first needs to determine whether a login ticket exists. When the login ticket exists, the login ticket is encrypted by a first encryption method, and the encrypted login ticket is stored in a preset storage location. When a service request is received, the login ticket is obtained from the preset storage location, and is decrypted by a first decryption method corresponding to the first encryption method. This method ensures that the login ticket is always in an encrypted state during the storage process, thereby ensuring the security of the login ticket during the storage process. After obtaining the login ticket and the service request, the login ticket and the service request are encrypted by a second encryption method, and the encrypted login ticket and the service request are transmitted to the application system. This method ensures that the login ticket is always in an encrypted state during the storage process, thereby ensuring the security of the login ticket during the storage process. The tickets and business requests are always in an encrypted state during the transmission process, thereby ensuring the security of the login tickets during the transmission process; finally, the application system uses the second decryption method corresponding to the second encryption method to decrypt them, and obtains the business request results fed back by the application system based on the decrypted login tickets and business requests, and then displays the corresponding pages. The implementation process of this method is not restricted by the network, and does not require re-login as the network changes. Therefore, this method solves the defects of the prior art that are restricted by the network, and ensures the security of the login tickets during storage and transmission through two different encryption methods, thereby providing users with a good experience.

[0008] In combination with the first aspect, in a first embodiment of the first aspect, before receiving a business request, it includes: receiving login information, encrypting the login information using a second method and then transmitting it to an application system; receiving a login ticket encrypted using the second encryption method and fed back by the application system, wherein the login ticket is a login ticket generated after the application system verifies that the login information is valid; decrypting the login ticket using a second decryption method, wherein the second encryption method corresponds to the second decryption method; and then encrypting the login ticket using the first encryption method, and storing the login ticket encrypted by the first encryption method to a preset storage location.

[0009] When a user logs in for the first time, the login information needs to be transmitted to the application system. When the login information is valid, the application system will receive a login ticket encrypted using the second encryption method. After receiving the encrypted login ticket, the second decryption method is used to decrypt it, and then the first encryption method is used to encrypt the login ticket, and the encrypted login ticket is stored in a preset storage location. This process illustrates that before receiving a business request, it is necessary to obtain the login ticket corresponding to the login information through valid login information, and encrypt and store the login ticket to facilitate the corresponding business request.

[0010] In combination with the first aspect, in a second embodiment of the first aspect, the first encryption / decryption method is to encrypt / decrypt using a fingerprint of a search engine, and the second encryption / decryption method is to encrypt / decrypt using a dynamic password.

[0011] In this embodiment, the first encryption or decryption method is to use the search engine's fingerprint to perform encryption or decryption operations. Since the search engine's fingerprint is unique, its encryption and decryption methods are also uniquely matched. This ensures the high security of the login ticket during the storage process; the second encryption or decryption method is to use a dynamic password to perform encryption or decryption operations. Since the dynamic password is time-sensitive and changeable, there will be a time limit for the operation during the encryption and decryption process, thereby ensuring the security of the login ticket during the transmission process.

[0012] In a second aspect, the present invention provides a method for protecting a login ticket, which is executed by an application system, and includes: receiving a first encrypted message sent by a search engine, the first encrypted message including a login ticket and a business request, wherein the first encrypted message is a message encrypted by the search engine using a first encryption method; decrypting the first encrypted message using a first decryption method corresponding to the first encryption method; when the decryption is successful, obtaining the login ticket and the business request; comparing the login ticket with at least one pre-stored historical login ticket to generate a comparison result; generating a business request result based on the comparison result and the business request, and transmitting the business request result to the search engine.

[0013] The present invention receives a first encrypted message encrypted by a search engine using a first encryption method, decrypts the message using a decryption method corresponding to the first encryption method, obtains a login ticket and a service request after successful decryption, determines the legitimacy of the login ticket by comparing the login ticket with a historical login ticket, and finally generates a service request result based on the legitimacy of the login ticket and the service request, and transmits the result to the search engine; this process eliminates some illegal operations by verifying the legitimacy of the login ticket, thereby ensuring that the service request is issued by the user end rather than an illegal operation, thereby improving the security of the request process.

[0014] In combination with the second aspect, in the first embodiment of the second aspect, before receiving the first encrypted message sent by the search engine, it includes: receiving a second encrypted message sent by the search engine, the second encrypted message including login information; decrypting the second encrypted message using the first decryption method to obtain the login information; comparing the login information with at least one pre-stored historical login information, and when there is historical login information consistent with the login information, generating a login ticket; encrypting the login ticket using the first encryption method, and transmitting it to the search engine.

[0015] By receiving login information encrypted by a first encryption method from a search engine and decrypting the encrypted login information by a first decryption method, the login information is obtained, and the validity of the login information is determined by comparing the login information with historical login information. Based on the validity of the login information, it is determined whether to generate a login ticket. This method can screen out some illegal logins, thereby improving the security of the application system.

[0016] In combination with the second aspect, in the second embodiment of the second aspect, after the first encrypted message is decrypted using the first decryption method corresponding to the first encryption method, it also includes: if the first encrypted message fails to be decrypted using the first decryption method corresponding to the first encryption method, directly generating response information corresponding to the decryption failure as a business request result and feeding it back to the search engine.

[0017] In combination with the second aspect, in a third embodiment of the second aspect, a business request result is generated based on the comparison result and the business request, including: judging the legitimacy of the login ticket based on the comparison result; when the login ticket is legal, generating a business request result corresponding to the business request, and feeding it back to the search engine; or, when the login ticket is illegal, directly generating a result identical to the response information corresponding to the decryption failure as the business request result, and feeding it back to the search engine.

[0018] The legitimacy of the login ticket is determined by comparing the results. When the login ticket is legitimate, a business request result corresponding to the business request is generated and fed back to the search engine. When the login ticket is invalid, a result identical to the corresponding information corresponding to the decryption failure is generated as the business request result and fed back to the search engine. This ensures that the search engine gives normal feedback to the business request initiated by the user terminal based on the business request result, so that the user terminal can perform the next step based on the result fed back by the search engine, thereby ensuring the security and smoothness of the application system during use.

[0019] In combination with the second aspect, in a fourth embodiment of the second aspect, the legitimacy of the login ticket is judged based on the comparison result, including: when the comparison result is that there is a historical login ticket consistent with the login ticket, the login ticket is legal; when the comparison result is that there is no historical login ticket consistent with the login ticket, the login ticket is illegal.

[0020] In a third aspect, the present invention provides a server, characterized in that it comprises: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, the processor executes a login ticket protection method as described in any one of the inventive contents executed by the search engine side.

[0021] In a fourth aspect, the present invention provides a server, characterized in that it comprises: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, the processor executes a login ticket protection method as described in any one of the inventive contents executed by the application system side. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0023] Figure 1 A flowchart of a login ticket protection method performed by a search engine provided in an embodiment of the present invention.

[0024] Figure 2 A signaling flow chart of three-terminal interactions during the login ticket protection process provided by an embodiment of the present invention.

[0025] Figure 3 A flowchart of a login ticket protection method executed by an application system provided in an embodiment of the present invention.

[0026] Figure 4 A connection diagram of a login ticket protection device corresponding to a search engine provided in an embodiment of the present invention.

[0027] Figure 5 A connection diagram of a login ticket protection device corresponding to an application system provided in an embodiment of the present invention.

[0028] Figure 6 A connection diagram of a server at the search engine end provided by an embodiment of the present invention.

[0029] Figure 7 A connection diagram of a server at the application system end provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] The present invention discloses a login ticket protection method, which is executed by a search engine, such as Figure 1As shown, the specific steps include:

[0032] Step S11: receiving a service request.

[0033] Specifically, after entering the function page, the user initiates a business request, which is then received by the search engine. The business request may be any functional request contained in the function page; for example, on the function page of a shopping platform, the corresponding functional request may be operations such as adding, deleting, modifying, and checking personal information, querying item information, and placing an order.

[0034] Step S12: According to the service request, query the login ticket corresponding to the service request from the preset storage location.

[0035] Specifically, the login ticket is a string corresponding to the user's account information generated on the basis of the application system verifying the legitimacy of the account information. When the user terminal initiates a service request, the login ticket is used to verify the legitimacy of the current user, so as to determine whether to approve the service request initiated by the user. Each time the account information logs in to the application system again, a new login ticket will be generated.

[0036] Specifically, if the current account has not been registered on a certain platform, the account information is illegal, so it is impossible for the login ticket corresponding to the account information to exist on the platform. It can be seen that the login ticket can only exist when the account information is legal; if the current account has been registered, when logging in to search engine A, a corresponding login ticket a is generated. When logging in again to search engine B, a new login ticket b will be generated. Login ticket b is different from login ticket a. It can be seen that the same account will have different corresponding login tickets when logging in to different search engines, and login ticket a is invalid when logging in to search engine B, and vice versa; if the current account has been registered, when logging in to search engine A, the login ticket generated is a, and then log out from search engine A, and then log in again to search engine A, a new login ticket c will be generated. It can be seen that the same account will generate different login tickets when logging in with the same search engine at different times. When logging in again, the login ticket corresponding to the account information generated by the search engine last time has expired; therefore, the login ticket corresponding to a legal account is only valid during the continuous login process. Once you log out or log in again to another search engine, the previously generated login ticket will be invalid.

[0037] Specifically, the preset storage location for the login ticket storage can be the local database of the search engine, the session storage space (sessionStorage), the local storage space (localStorage) or cookies, etc., wherein a cookie is a simple text file saved in the client, which is used to store data on the user's local terminal. It is text data stored in the user's local terminal in order for the website to identify the user and track the session.

[0038] Step S13: When the login ticket exists, the login ticket is decrypted using the first decryption method.

[0039] Specifically, the login ticket is encrypted according to a first encryption method and then stored in a preset storage location, and the first encryption method corresponds to the first decryption method.

[0040] Specifically, the first encryption method and the first decryption method are based on the encryption or decryption method specific to the search engine. The encrypted string may include a string related to the search engine. On this basis, it can also be combined with some parameters of the local machine to ensure the uniqueness of the encrypted string, and these strings are set according to specific logic to ultimately form an encrypted string specific to the local search engine.

[0041] Specifically, after the search engine finds the login ticket, it generates a corresponding decryption string according to a method corresponding to the encryption logic of the preset first encryption method, thereby decrypting the login ticket.

[0042] Specifically, when receiving a service request to obtain a login ticket, if the login ticket does not exist, the search engine will return a login page to the user end, so that the user end can enter corresponding login information according to the prompt of the login page and log in again.

[0043] Step S14: Encrypt the login ticket and the service request using the second encryption method and transmit them to the application system.

[0044] Specifically, after the login ticket is decrypted, it can be bound to the business request to form a data packet, and then the data packet is encrypted using the second encryption method, and the encrypted data packet is transmitted to the application system, so that the application system can verify the legitimacy of the login ticket and feedback the business request result corresponding to the business request based on the legitimacy of the login ticket; wherein the second encryption method here can be any method that can encrypt data, such as symmetric encryption, asymmetric encryption or hybrid encryption. The second encryption method is used to encrypt the login ticket and the business request. The purpose is to prevent the login ticket from being stolen during the transmission to the application system, thereby ensuring the security of the data packet during the transmission process.

[0045] Step S15: receiving the business request result fed back by the application system, and displaying the corresponding page based on the business request result.

[0046] Specifically, after receiving the result of the business request, the search engine will display a corresponding page according to the result of the business request. The corresponding page may be a login page, a function page after jumping according to the business request, or a function page when the current business request is initiated, etc. The page is used to instruct the user to perform the next operation according to the prompt; for example, when the displayed page is a login page, the user is required to re-login according to the prompt information on the login page; when the displayed page is a function page after jumping according to the business request, the user can complete the next function operation according to the prompt information on the page; when the displayed page is a function page when a business request is initiated, the user needs to refresh the page according to the prompt and re-initiate the business request, etc.

[0047] The present invention first needs to determine whether the current login information corresponds to a login ticket. When there is a login ticket corresponding to the current login information, the login ticket is encrypted by a first encryption method and stored in a preset storage location. When a service request is received, the login ticket is obtained from the preset storage location and decrypted by a first decryption method corresponding to the first encryption method. This method ensures that the login ticket is always in an encrypted state during the storage process, thereby ensuring the security of the login ticket during the storage process. After obtaining the login ticket and the service request, the login ticket and the service request are encrypted by a second encryption method, and the encrypted login ticket and the service request are transmitted to the application system. This method keeps the login ticket and the business request in an encrypted state during transmission, thereby ensuring the security of the login ticket during transmission; finally, the application system decrypts it using a second decryption method corresponding to the second encryption method, and the receiving application system generates a business request result based on the decrypted login ticket and business request, and displays the corresponding page. The implementation process of this method is not limited by the network, and does not require frequent re-login as the network changes. Therefore, this method solves the defect of being restricted by the network in the prior art, and ensures the security of the login ticket during storage and transmission through two different encryption methods, thereby providing users with a good experience.

[0048] In an optional embodiment, before receiving a business request, the process includes: receiving login information, encrypting the login information using a second method and transmitting the encrypted login information to an application system; receiving a login ticket encrypted using a second encryption method from the application system, wherein the login ticket is a login ticket generated after the application system verifies that the login information is valid; decrypting the login ticket using a second decryption method, wherein the second encryption method corresponds to the second decryption method; and then encrypting the login ticket using the first encryption method, and storing the encrypted login ticket using the first encryption method to a preset storage location.

[0049] For example, Figure 2 As shown, after the user opens the browser, the search engine receives the URL (Uniform Resource Locator) address of the application system to be accessed input by the user, and displays the front-end page of the application system. At the same time, the search engine obtains the login ticket from the preset storage location. In this embodiment, the preset storage location of the login ticket is the session storage space of the search engine. When the user logs in to the search engine for the first time, there is no login ticket in the session storage space of the search engine. At this time, the user needs to enter the login information through the prompt information on the login page. The login information may include the login account, login password, mobile phone number and verification code, etc., which are used to verify the user's identity.

[0050] Exemplarily, when the search engine receives the login information from the user end, it will encrypt the login information using the second encryption method to ensure the security of the user login information during transmission, and transmit the encrypted login information to the application system; the application system will judge the validity of the login information. When the login information is valid, the application system will generate a login ticket corresponding to the login information, and transmit the login ticket encrypted using the second encryption method to the search engine; after the search engine receives the encrypted login ticket from the application system, it will decrypt it using the second decryption method to obtain the login ticket; then it will encrypt the login ticket using the first encryption method, and then store the encrypted login ticket in the session storage space of the search engine; but when the login information is invalid, the search engine will receive a login failure result sent by the application system. At this time, the search engine will display the login page to the user end based on the result to prompt the user to re-enter the correct login information.

[0051] This process explains that before receiving a business request, it is necessary to obtain a login ticket corresponding to the login information through valid login information, and encrypt and store the login ticket to facilitate the corresponding business request.

[0052] In an optional embodiment, the first encryption / decryption method is to use the fingerprint of the search engine for encryption / decryption, and the second encryption / decryption method is to use the dynamic password for encryption / decryption.

[0053] Exemplarily, the first encryption / decryption method can be to encrypt / decrypt using the fingerprint of the search engine. In the present embodiment, the fingerprint collector Fingerprintjs2 is used to encrypt or decrypt the login ticket in the storage process, wherein Fingerprintjs2 is a browser fingerprint collector implemented by the pure front-end native scripting language Javascript, which obtains all the information that can be obtained in the browser and finally generates MD5, which is used to generate a unique identification code for the device; wherein MD5 is a message digest algorithm (Message-Digest Algorithm for short MD5), which is a widely used cryptographic hash function that can generate a 128-bit (16-byte) hash value (hash value) to ensure that information transmission is complete and consistent.

[0054] Furthermore, when the locally stored login ticket is copied to other browsers, other browsers cannot decrypt the login ticket due to the different browser fingerprints; therefore, even if the login ticket is stolen during the storage process, the thief cannot decrypt the login ticket using the corresponding decryption method, and thus cannot obtain the login ticket, thereby ensuring the security of the login ticket storage process.

[0055] Exemplarily, the second encryption / decryption method can use a dynamic password for encryption / decryption. In this embodiment, a one-time password (OTP) is used to encrypt or decrypt the login ticket during transmission. OTP, also known as "one-time password", refers to a password that can only be used once within a specified time. It is based on a specific algorithm to generate an unpredictable random number combination at fixed intervals. Once the fixed time is exceeded, it cannot be decrypted.

[0056] Further, assume that in this embodiment, the process of encryption using OTP is set to generate an unpredictable random number combination every 60 seconds, and it is valid once. For example, the search engine will add a timestamp to indicate the time when the one-time password is generated while encrypting the login ticket and the service request using the second encryption method. In this process, the login ticket and the service request are regarded as a data packet. When the application system receives the encrypted data packet, it first calculates the time difference between the current time and the password generation time, and compares the time difference with the password validity period of 60 seconds. When the time difference is greater than 60 seconds, the password generated by the OTP is no longer valid, and the data packet cannot be decrypted. When the transmission time is less than or equal to 60 seconds, the data packet can be decrypted. This method ensures the security of data during transmission.

[0057] In this embodiment, the first encryption or decryption method is to use the search engine's fingerprint to perform encryption or decryption operations. Since the search engine's fingerprint is unique, its encryption and decryption methods are also uniquely matched. This ensures the high security of the login ticket during the storage process; the second encryption or decryption method is to use a dynamic password to perform encryption or decryption operations. Since the dynamic password is time-sensitive and changeable, there will be a time limit for the operation during the encryption and decryption process, thereby ensuring the security of the login ticket during the transmission process.

[0058] The present invention discloses a login ticket protection method, which is executed by an application system end, such as Figure 3 As shown, the following steps are included:

[0059] Step S31: Receive a first encrypted message sent by a search engine, wherein the first encrypted message includes a login ticket and a service request, wherein the first encrypted message is a message encrypted by the search engine using a first encryption method, and the first encryption method here is equivalent to the second encryption method in the login ticket protection method step executed by the search engine.

[0060] Specifically, the login ticket and service request encrypted by the first encryption method are received from the search engine. In this embodiment, the first encryption method is to encrypt by OTP, and the password is set to change every 60 seconds.

[0061] Specifically, while receiving the first encrypted message, a timestamp, that is, the password generation time, is obtained, and the time interval between the current time and the password generation time is calculated.

[0062] Step S32: Decrypt the first encrypted message using a first decryption method corresponding to the first encryption method.

[0063] Specifically, when the above time interval is less than or equal to 60 seconds, the first encrypted message can be decrypted using the first decryption method.

[0064] Step S33: When the decryption is successful, the login ticket and service request are obtained.

[0065] Specifically, when the decryption is successful using the first decryption method, a login ticket and a service request are obtained.

[0066] Step S34: Compare the login ticket with at least one pre-stored historical login ticket to generate a comparison result.

[0067] Specifically, the pre-stored login ticket is the login ticket corresponding to all the login information of the application system that has passed identity authentication. The login ticket is compared with at least one pre-stored historical login ticket to determine whether the current login ticket exists in the historical login ticket.

[0068] Specifically, each time you log in, a new login ticket will be generated, and the new login ticket can overwrite the old login ticket, or each time you log out, the application system will clear the login ticket corresponding to the account so that a new login ticket can be added the next time you log in.

[0069] Step S35: Based on the comparison result and the business request, a business request result is generated, and the business request result is transmitted to the search engine.

[0070] Specifically, the application system determines the legitimacy of the login ticket based on the comparison result between the login ticket and the historical login ticket, generates a business request result corresponding to the business request based on the legitimacy of the login ticket and the business request, and feeds it back to the search engine.

[0071] The present invention receives a first encrypted message encrypted by a search engine using a first encryption method, decrypts the message using a decryption method corresponding to the first encryption method, obtains a login ticket and a service request after successful decryption, determines the legitimacy of the login ticket by comparing the login ticket with a historical login ticket, and finally generates a service request result based on the legitimacy of the login ticket and the service request, and transmits the result to the search engine; this process eliminates some illegal operations by verifying the legitimacy of the login ticket, thereby ensuring that the service request is issued by the user end rather than an illegal operation, thereby improving the security of the request process.

[0072] In an optional embodiment, before receiving a first encrypted message sent by a search engine, the method includes: receiving a second encrypted message sent by the search engine, the second encrypted message including login information; decrypting the second encrypted message using a first decryption method to obtain the login information; comparing the login information with at least one pre-stored historical login information, and generating a login ticket when there is historical login information that is consistent with the login information; encrypting the login ticket using the first encryption method, and transmitting it to the search engine.

[0073] For example, Figure 2 As shown, login information encrypted by a first encryption method is received from a search engine, and the encrypted login information is decrypted by a first decryption method. If the decryption fails, the result of the decryption failure is returned to the search engine. If the decryption succeeds, the login information is obtained, and then the validity of the login information is judged by comparing the login information with at least one pre-stored historical login information. When the login information is valid, a login ticket is generated, and the login information is encrypted by the first encryption method and then transmitted to the search engine; when the login information is invalid, a login failure result is generated and transmitted to the search engine.

[0074] By receiving login information encrypted by a first encryption method from a search engine and decrypting the encrypted login information by a first decryption method, the login information is obtained, and the validity of the login information is determined by comparing the login information with historical login information. Based on the validity of the login information, it is determined whether to generate a login ticket. This method can screen out some illegal logins, thereby improving the security of the application system.

[0075] In an optional embodiment, after decrypting the first encrypted message using the first decryption method corresponding to the first encryption method, it also includes: if the first encrypted message fails to be decrypted using the first decryption method corresponding to the first encryption method, directly generating response information corresponding to the decryption failure as a business request result and feeding it back to the search engine.

[0076] Exemplarily, the timestamp of the first encrypted package, i.e., the password generation time, is obtained, and the time difference between the password generation time and the current time is calculated. When the time difference is greater than 60 seconds, the OTP password is invalid and the decryption fails. When the decryption fails, the application system directly generates a result of the business request failure and returns it to the search engine.

[0077] In an optional embodiment, a business request result is generated based on the comparison result and the business request, including: judging the legitimacy of the login ticket based on the comparison result; when the login ticket is legitimate, generating a business request result corresponding to the business request and feeding it back to the search engine; or, when the login ticket is invalid, directly generating a result identical to the response information corresponding to the decryption failure as the business request result and feeding it back to the search engine.

[0078] For example, on a function page of a shopping platform, the business request issued by the user end is a purchase. When the login ticket is legal, the application system generates a result of a successful business request based on the purchase business request, and feeds the result back to the search engine. The search engine will display the corresponding payment page based on the result of the successful "purchase" business request. The user can perform the next operation based on the information provided on the payment page, such as entering a payment password or prompting the user to pay by face recognition. When the login ticket is illegal, the application system will generate a result of a failed business request and transmit the result to the search engine. The search engine will display the function page when the business request was issued based on the result of the "failed business request" and provide text prompts, such as: please try again after refreshing or the request has timed out.

[0079] The legitimacy of the login ticket is determined by comparing the results. When the login ticket is legitimate, a business request result corresponding to the business request is generated and fed back to the search engine. When the login ticket is invalid, a result identical to the response information corresponding to the decryption failure is generated as the business request result and fed back to the search engine. This ensures that the search engine responds normally to the business request initiated by the user terminal based on the business request result, so that the user terminal can perform the next step based on the result fed back by the search engine, thereby ensuring the security and smoothness of the application system during use.

[0080] In an optional embodiment, the legitimacy of the login ticket is judged based on the comparison result, including: when the comparison result is that there is a historical login ticket consistent with the login ticket, the login ticket is legal; when the comparison result is that there is no historical login ticket consistent with the login ticket, the login ticket is illegal.

[0081] For example, when there is a historical login ticket that is consistent with the login ticket, it means that the account has been logged in on this device continuously and the login ticket is still valid, then the system will regard it as a legitimate user, and therefore determine that the login ticket is legitimate; when there is no historical login ticket that is consistent with the login ticket, it may be that the account previously logged in on this search engine and then logged out, and when logging out, the login ticket generated after the previous login of the account was deleted, so there is no historical login ticket that is consistent with the current login ticket, so the login ticket has expired, and then the login ticket is determined to be illegal.

[0082] The present invention discloses a login ticket protection device, such as Figure 4 As shown, it includes: a first receiving module 41, a query module 42, a decryption module 43, a first transmission module 44, and a display module 45.

[0083] The first receiving module 41 is configured to receive a service request.

[0084] The query module 42 is used to query the login ticket corresponding to the business request from the preset storage location according to the business request.

[0085] The decryption module 43 is used to decrypt the login ticket using a first decryption method when the login ticket exists, wherein the login ticket is encrypted according to a first encryption method and then stored in a preset storage location, and the first encryption method corresponds to the first decryption method.

[0086] The first transmission module 44 is used to encrypt the login ticket and the service request using the second encryption method and transmit them to the application system, so that the application system feeds back the service request result corresponding to the service request based on the login ticket and the service request.

[0087] The display module 45 is used to receive the business request result fed back by the application system, and display the corresponding page based on the business request result.

[0088] The present invention discloses a login ticket protection device, which includes, before a first receiving module,:

[0089] The second transmission module is used to receive the login information, encrypt the login information using a second method, and then transmit it to the application system.

[0090] The second receiving module is used to receive the login ticket encrypted by the second encryption method fed back by the application system, wherein the login ticket is a login ticket generated after the application system verifies that the login information is valid.

[0091] The decryption module is used to decrypt the login ticket using a second decryption method, wherein the second encryption method corresponds to the second decryption method.

[0092] The storage module is used to encrypt the login ticket using the first encryption method again, and store the login ticket encrypted by the first encryption method in a preset storage location.

[0093] In an optional embodiment, the first encryption / decryption method is to use the fingerprint of the search engine for encryption / decryption, and the second encryption / decryption method is to use the dynamic password for encryption / decryption.

[0094] The present invention provides a login ticket protection device, such as Figure 5As shown, it includes: a first receiving module 51, a first decryption module 52, an acquisition module 53, a first generation module 54, and a first transmission module 55.

[0095] The first receiving module 51 is used to receive a first encrypted message sent by a search engine, wherein the first encrypted message includes a login ticket and a service request, wherein the encrypted message is a message encrypted by the search engine using a first encryption method.

[0096] The first decryption module 52 is used to decrypt the first encrypted message using a first decryption method corresponding to the first encryption method.

[0097] The acquisition module 53 is used to acquire the login ticket and the service request after the decryption is successful.

[0098] The first generating module 54 is used to compare the login ticket with at least one pre-stored historical login ticket to generate a comparison result.

[0099] The first transmission module 55 is used to generate a service request result based on the comparison result and the service request, and transmit the service request result to the search engine.

[0100] The present invention provides a login ticket protection device, which includes: a second receiving module, a second decryption module, a second generating module, and a second transmission module before a receiving module; the second receiving module is used to receive a second encrypted message sent by a search engine, the second encrypted message including login information; the second decryption module is used to decrypt the second encrypted message using a first decryption method to obtain the login information; the second generating module is used to compare the login information with at least one pre-stored historical login information, and when there is historical login information consistent with the login information, generate a login ticket; the second transmission module is used to encrypt the login ticket using the first encryption method and transmit it to the search engine.

[0101] In an optional embodiment, the first decryption module further includes: a feedback submodule, which is used to directly generate response information corresponding to the decryption failure as a service request result and feed it back to the search engine if the first encrypted message fails to be decrypted using the first decryption method corresponding to the first encryption method.

[0102] In an optional embodiment, the first generation module includes: a judgment submodule, which is used to judge the legitimacy of the login ticket based on the comparison result; a first feedback submodule, which is used to generate a business request result corresponding to the business request when the login ticket is legal, and feed it back to the search engine; a second feedback submodule, which is used to directly generate a result identical to the response information corresponding to the decryption failure as the business request result when the login ticket is illegal, and feed it back to the search engine.

[0103] In an optional embodiment, the judgment submodule includes: a first comparison unit, which is used to determine that the login ticket is legal when the comparison result is that there is a historical login ticket consistent with the login ticket; and a second comparison unit, which is used to determine that the login ticket is illegal when the comparison result is that there is no historical login ticket consistent with the login ticket.

[0104] This embodiment provides a server, such as Figure 6 As shown, the server is suitable for a search engine and may include at least one processor 61, at least one communication interface 62, at least one communication bus 63 and at least one memory 64, wherein the communication interface 62 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 62 may also include a standard wired interface and a wireless interface. The memory 64 may be a high-speed RAM memory (Random Access Memory, volatile random access memory) or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 64 may also be optionally at least one storage device located away from the aforementioned processor 61. The processor 61 may be combined with Figure 6 In the described device, the memory 64 stores an application program, and the processor 61 calls the program code stored in the memory 64 to execute the steps of the login ticket protection method of any method embodiment of the search engine end.

[0105] The communication bus 63 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 63 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0106] Among them, the memory 64 may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 64 may also include a combination of the above types of memory.

[0107] The processor 61 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0108] The processor 61 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. Optionally, the memory 64 is also used to store program instructions. The processor 61 may call program instructions to implement the login ticket protection method in any search engine end embodiment of the present invention.

[0109] This embodiment provides a server, such as Figure 7 As shown, the server is applied to the application system and may include at least one processor 71, at least one communication interface 72, at least one communication bus 73 and at least one memory 74, wherein the communication interface 72 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 72 may also include a standard wired interface and a wireless interface. The memory 74 may be a high-speed RAM memory (Random Access Memory, volatile random access memory) or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 74 may optionally be at least one storage device located away from the aforementioned processor 71. The processor 71 may be combined with Figure 7 In the described device, the memory 74 stores an application program, and the processor 71 calls the program code stored in the memory 74 to execute the steps of the login ticket protection method of any method embodiment of the above-mentioned application system end.

[0110] The communication bus 73 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 73 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0111] Among them, the memory 74 may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 74 may also include a combination of the above types of memory.

[0112] The processor 71 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0113] The processor 71 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. Optionally, the memory 74 is also used to store program instructions. The processor 71 may call program instructions to implement the login ticket protection method in any application system end embodiment of the present invention.

[0114] This embodiment provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions can execute the login ticket protection method in any method embodiment corresponding to the search engine end. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0115] This embodiment provides a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions can execute the login ticket protection method in any method embodiment corresponding to the above application system end. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memory.

[0116] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A method for protecting a login ticket, characterized in that: The method is performed by a search engine and includes: Receiving a business request; wherein the business request is any functional request included in the function page; According to the service request, querying a login ticket corresponding to the service request from a preset storage location; When the login ticket exists, decrypt the login ticket using a first decryption method, wherein the login ticket is encrypted according to a first encryption method and then stored in the preset storage location, and the first encryption method corresponds to the first decryption method; After encrypting the login ticket and the service request using a second encryption method, the encrypted data are transmitted to the application system, so that the application system feeds back a service request result corresponding to the service request based on the login ticket and the service request; Receive the business request result fed back by the application system, and display the corresponding page based on the business request result; wherein, when the same account uses the same search engine to log in at different times, different login tickets are generated, and the login ticket corresponding to the account information generated by the search engine last time has expired. The login ticket corresponding to a legitimate account is only valid during the continuous login process. Once you log out or change a search engine to log in again, the login ticket generated previously will be invalid.

2. The login ticket protection method according to claim 1, characterized in that: Before receiving the service request, the method includes: receiving login information, encrypting the login information using the second encryption method and transmitting the encrypted information to the application system; receiving the login ticket encrypted by the second encryption method fed back by the application system, wherein the login ticket is a login ticket generated by the application system after verifying that the login information is valid; decrypting the login ticket using a second decryption method, wherein the second encryption method corresponds to the second decryption method; The login ticket is then encrypted using the first encryption method, and the login ticket encrypted using the first encryption method is stored in the preset storage location.

3. The method for protecting a login ticket according to any one of claims 1 to 2, characterized in that: The first encryption / decryption method is to use the fingerprint of the search engine for encryption / decryption, and the second encryption / decryption method is to use the dynamic password for encryption / decryption.

4. A method for protecting a login ticket, characterized in that: The method is executed by the application system end, and includes: Receiving a first encrypted message sent by a search engine, wherein the first encrypted message includes a login ticket and a service request, wherein the first encrypted message is a message encrypted by the search engine using a first encryption method; Decrypting the first encrypted message using a first decryption method corresponding to the first encryption method; When the decryption is successful, the login ticket and the service request are obtained; Comparing the login ticket with at least one pre-stored historical login ticket to generate a comparison result; Based on the comparison result and the business request, a business request result is generated, and the business request result is transmitted to the search engine; wherein the business request is any functional request contained in the function page; when the same account uses the same search engine to log in at different times, different login tickets are generated, and the login ticket corresponding to the account information generated by the search engine last time has expired. The login ticket corresponding to a legitimate account is only valid during the continuous login process. Once the account is logged out or a different search engine is used to log in again, the login ticket generated previously will become invalid.

5. The login ticket protection method according to claim 4, characterized in that: Before receiving the first encrypted message sent by the search engine, the method includes: receiving a second encrypted message sent by the search engine, wherein the second encrypted message includes login information; Decrypting the second encrypted message using the first decryption method to obtain the login information; Compare the login information with at least one pre-stored historical login information, and when there is historical login information that is consistent with the login information, generate the login ticket; The login ticket is encrypted using the first encryption method and transmitted to the search engine.

6. The login ticket protection method according to claim 4, characterized in that: After decrypting the first encrypted message using the first decryption method corresponding to the first encryption method, the method further includes: If the first encrypted message fails to be decrypted using the first decryption method corresponding to the first encryption method, response information corresponding to the decryption failure is directly generated as the service request result and fed back to the search engine.

7. The login ticket protection method according to claim 6, characterized in that: The generating a service request result based on the comparison result and the service request includes: Determining the legitimacy of the login ticket based on the comparison result; When the login ticket is valid, a business request result corresponding to the business request is generated and fed back to the search engine; Alternatively, when the login ticket is illegal, a result identical to the response information corresponding to the decryption failure is directly generated as the service request result and fed back to the search engine.

8. The login ticket protection method according to claim 7, characterized in that: The determining the legitimacy of the login ticket based on the comparison result includes: When the comparison result shows that there is a historical login ticket that is consistent with the login ticket, the login ticket is legal; When the comparison result is that there is no historical login ticket consistent with the login ticket, the login ticket is illegal.

9. A server, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, the processor executes the login ticket protection method as described in any one of claims 1-3.

10. A server, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory is used to store a computer program, and when the computer program is executed by the processor, the processor executes the login ticket protection method as described in any one of claims 4-8.

Images