Server login authentication methods, devices, computer equipment, and storage media

Abstract

This application relates to a server login verification method, apparatus, computer device, and storage medium. The method includes: in response to a user login request corresponding to at least one application, obtaining user authentication information corresponding to each user login request; if the user authentication information matches user registration information stored on the server, generating encrypted login credentials corresponding to each user login request based on the user authentication information; encrypting each encrypted login credential according to a homomorphic encryption key corresponding to each user login request to obtain encrypted user data; hashing each encrypted user data according to a preset storage rule to obtain hashed encrypted user data; the hashed encrypted user data is used to store server login verification information corresponding to the user login request. This method can reduce the risk of information leakage and improve the operational complexity caused by continuous login from multiple applications.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a server login verification method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] With the development of computer technology, network technology emerged. As the number of network users surged, the application of public service platforms for various transaction scenarios also increased accordingly. To meet user needs, public service platforms developed multiple different applications. Furthermore, to handle a large number of users, each application utilizes multiple servers to provide services simultaneously. User requests are distributed to different servers for processing through load balancing, thereby increasing the overall number of users that can be supported. After a user logs in, the public service platform caches the user's login status in the memory of the server whose request arrives, allowing the user to perform multiple operation requests after logging in without needing to log in again.

[0003] However, in traditional technology, because the content in the server's memory cannot be shared between servers in the same business cluster, it is required that user login and subsequent operations be on the same server. If user login and subsequent operations cannot be kept on the same server, the user will be popped up and asked to log in again, resulting in the problem of complicated operations caused by the constant login of multiple applications. Summary of the Invention

[0004] Therefore, it is necessary to provide a server login verification method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can reduce the risk of information leakage and improve the operational complexity caused by continuous login to multiple applications for users, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a server login verification method. Applied to a server storage end, the method includes: in response to a user login request corresponding to at least one application, obtaining user authentication information corresponding to each user login request; if the user authentication information matches user identity registration information in the server storage end, generating encrypted login credentials corresponding to each user login request based on the user authentication information; encrypting each encrypted login credential according to a homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and hashing each user ciphertext data according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store the server login verification information corresponding to the user login request.

[0006] Secondly, this application provides a server login verification method. Applied to a server application, the method includes: responding to a user login request corresponding to at least one application, and if user credentials are identified in server storage, obtaining hashed user ciphertext data corresponding to the server storage; decrypting each hashed user ciphertext data according to a homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential; and determining that the application is logged in if a normal login authorization response is obtained from the server storage and the decrypted login credential is the same as the identity information calculation result; wherein the identity information calculation result is the result obtained by calculating user authentication information in plaintext.

[0007] Thirdly, this application also provides a server login verification device. Applied to a server storage terminal, the device includes: an information acquisition module, used to acquire user authentication information corresponding to each user login request in response to at least one user login request corresponding to an application; a credential generation module, used to generate encrypted login credentials corresponding to each user login request based on the user authentication information when it matches user identity registration information in the server storage terminal; and a data encryption module, used to encrypt the corresponding encrypted login credentials according to the homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and to hash each user ciphertext data according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store the server login verification information corresponding to the user login request.

[0008] Fourthly, this application also provides a server login verification device. Applied to a server application, the device includes: a data acquisition module, configured to, in response to a user login request corresponding to at least one application, acquire hashed user ciphertext data corresponding to each hashed user ciphertext data stored on the server, provided that user credentials are identified in the server storage; a data decryption module, configured to decrypt each hashed user ciphertext data according to a homomorphic decryption key corresponding to each user login request, to obtain each decrypted login credential; and an application login module, configured to, upon receiving a normal login authorization response from the server storage and finding that the decrypted login credential matches the identity information calculation result, determine that the application is logged in; the identity information calculation result is the result obtained by calculating user authentication information in plaintext.

[0009] Fifthly, this application also provides a computer device. The computer device includes a memory and a processor. The memory stores a computer program, and the processor, when executing the computer program, performs the following steps: in response to a user login request corresponding to at least one application, obtains user authentication information corresponding to each user login request; if the user authentication information matches user identity registration information stored in the server, generates encrypted login credentials corresponding to each user login request based on the user authentication information; encrypts each encrypted login credential according to a homomorphic encryption key corresponding to each user login request to obtain encrypted user data, and hashes and stores each encrypted user data according to a preset storage rule to obtain hashed encrypted user data; the hashed encrypted user data is used to store server login verification information corresponding to the user login request.

[0010] In response to a user login request corresponding to at least one application, if user credentials are identified in the server storage, the hashed user ciphertext data corresponding to the server storage is obtained; based on the homomorphic decryption key corresponding to each user login request, each hashed user ciphertext data is decrypted to obtain each decrypted login credential; if a normal login authorization response is obtained from the server storage, and the decrypted login credential is the same as the identity information calculation result, the application is determined to be in a logged-in state; the identity information calculation result is the result obtained by calculating user authentication information in plaintext.

[0011] Sixthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps: in response to a user login request corresponding to at least one application, obtains user authentication information corresponding to each user login request; if the user authentication information matches user identity registration information stored in the server, generates encrypted login credentials corresponding to each user login request based on the user authentication information; encrypts each encrypted login credential according to a homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and hashes each user ciphertext data according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store server login verification information corresponding to the user login request.

[0012] In response to a user login request corresponding to at least one application, if user credentials are identified in the server storage, the hashed user ciphertext data corresponding to the server storage is obtained; based on the homomorphic decryption key corresponding to each user login request, each hashed user ciphertext data is decrypted to obtain each decrypted login credential; if a normal login authorization response is obtained from the server storage, and the decrypted login credential is the same as the identity information calculation result, the application is determined to be in a logged-in state; the identity information calculation result is the result obtained by calculating user authentication information in plaintext.

[0013] Seventhly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps: in response to a user login request corresponding to at least one application, obtains user authentication information corresponding to each user login request; if the user authentication information matches user identity registration information stored in the server, generates encrypted login credentials corresponding to each user login request based on the user authentication information; encrypts each encrypted login credential according to a homomorphic encryption key corresponding to each user login request to obtain encrypted user data, and hashes and stores each encrypted user data according to a preset storage rule to obtain hashed encrypted user data; the hashed encrypted user data is used to store server login verification information corresponding to the user login request.

[0014] In response to a user login request corresponding to at least one application, if user credentials are identified in the server storage, the hashed user ciphertext data corresponding to the server storage is obtained; based on the homomorphic decryption key corresponding to each user login request, each hashed user ciphertext data is decrypted to obtain each decrypted login credential; if a normal login authorization response is obtained from the server storage, and the decrypted login credential is the same as the identity information calculation result, the application is determined to be in a logged-in state; the identity information calculation result is the result obtained by calculating user authentication information in plaintext.

[0015] The aforementioned server login verification method, apparatus, computer device, storage medium, and computer program product, through a server storage terminal, obtains user authentication information corresponding to each user login request in response to user login requests corresponding to at least one application; when the user authentication information matches the user identity registration information in the server storage terminal, an encrypted login credential corresponding to each user login request is generated based on the user authentication information; each encrypted login credential is encrypted according to the homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and each user ciphertext data is hashed and stored according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store the server login verification information corresponding to the user login request.

[0016] In response to a user login request from at least one application, the server-side system identifies user credentials in the server storage and retrieves the hashed ciphertext data corresponding to each user's login request. Based on the homomorphic decryption key corresponding to each user login request, the hashed ciphertext data is decrypted to obtain decrypted login credentials. If a normal login authorization response is received from the server storage, and the decrypted login credentials match the calculated identity information, the application is confirmed to be logged in. The calculated identity information is the result obtained by calculating the user's authentication information in plaintext.

[0017] By using a server-side storage system, user login authentication is centrally managed. Login credentials are generated after user authentication, and homomorphic encryption ensures these credentials are computeable but not visible, providing them to various applications. Different nodes within each application verify the user's login status. By using a server-side application, application nodes no longer need to authenticate or cache user login information. During transaction requests, homomorphic encryption is used to synchronize credential information with the server-side storage to determine the user's login status. This solves the problem of all application server nodes needing to verify user login information, increasing the risk of information leakage. It also addresses the risks of abnormal user logins associated with session persistence technologies and the operational complexity caused by continuous logins from multiple applications. Attached Figure Description

[0018] Figure 1 This is a diagram illustrating the application environment of a server login verification method in one embodiment.

[0019] Figure 2 This is a flowchart illustrating a server login verification method in one embodiment;

[0020] Figure 3 This is a flowchart illustrating a method for determining the matching results of verification information in one embodiment;

[0021] Figure 4 This is a flowchart illustrating a method for obtaining verification information matching results in one embodiment;

[0022] Figure 5 This is a flowchart illustrating a homomorphic key generation method in one embodiment;

[0023] Figure 6 This is a flowchart illustrating a method for sending hashed user-encrypted data in one embodiment.

[0024] Figure 7 This is a flowchart illustrating a server login verification method in another embodiment;

[0025] Figure 8 This is a flowchart illustrating a login status response generation method in one embodiment;

[0026] Figure 9 This is a flowchart illustrating a method for obtaining information comparison results in one embodiment;

[0027] Figure 10 This is a flowchart illustrating a method for sending a re-login command in one embodiment;

[0028] Figure 11 This is a schematic diagram of the data flow of a server login verification method in one embodiment;

[0029] Figure 12 This is a structural block diagram of a server login verification device in one embodiment;

[0030] Figure 13 This is a structural block diagram of a server login verification device in another embodiment;

[0031] Figure 14 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0033] The server login verification method provided in this application embodiment can be applied to, for example... Figure 1In the application environment shown, the server storage, in response to user login requests corresponding to at least one application, obtains user authentication information corresponding to each user login request. If the user authentication information matches the user registration information in the server storage, it generates encrypted login credentials corresponding to each user login request based on the user authentication information. It then encrypts each encrypted login credential using the homomorphic encryption key corresponding to each user login request, obtaining encrypted user data. This encrypted user data is then hashed and stored according to a preset storage rule, resulting in hashed encrypted user data. The hashed encrypted user data is used to store the server login verification information corresponding to the user login request. The server application, in response to a user login request corresponding to at least one application, identifies user credentials in the server storage and retrieves the corresponding hashed user ciphertext data from the server storage. Based on the homomorphic decryption key corresponding to each user login request, it decrypts each hashed user ciphertext data to obtain a decrypted login credential. If a normal login authorization response is received from the server storage, and the decrypted login credential matches the calculated identity information, the application is confirmed to be logged in. The identity information calculation result is obtained by calculating the user's authentication information in plaintext. The terminals transmitting data to the server storage and server application can be, but are not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. The server storage and server application terminals can be implemented using independent servers or server clusters composed of multiple servers.

[0034] In one embodiment, such as Figure 2 As shown, a server login verification method is provided, which is applied to... Figure 1 Taking the server storage side as an example, the explanation includes the following steps:

[0035] Step 202: In response to a user login request corresponding to at least one application, obtain the user authentication information corresponding to each user login request.

[0036] In this context, a user login request can be a request sent by an application user from a terminal to a server to log in to the target application. At the same time as the application user sends the request, the terminal transmits the login information corresponding to the user login request to the server.

[0037] User authentication information can be used to verify whether the user's identity matches the target application for login, such as password, certificate, biometric information, SMS verification code, etc.

[0038] Specifically, the server storage receives at least one user login request corresponding to an application from the terminal, and in response to each user login request, obtains the user authentication information corresponding to each user login request from the terminal. This user authentication information can be account password, application certificate, user biometric information, account SMS, etc. Further, the obtained user authentication information is retrieved to volatile storage resources for computation by the central processing unit (CPU). The user authentication information can be a single data input to the CPU, or multiple data inputs can be input to the CPU simultaneously.

[0039] After obtaining the application user's account password, application certificate, user biometric information, and account SMS messages from the server storage, the obtained account passwords are matched against all account passwords stored in the server's password database. Similarly, the obtained application certificates are matched against all application certificates stored in the server's certificate database, and the obtained user biometric information is matched against all user biometric information stored in the server's biometric database. The account passwords in the password database, the application certificates in the certificate database, and the user biometric information in the biometric database are user-defined information registered in the user identity registration information and recorded when requesting access to the target application. The obtained account SMS messages are compared with a random number sequence sent from the server storage to the application user's terminal. Verification is successful only when all numbers in the account SMS message match the random number sequence exactly. The results of matching the account passwords, application certificates, user biometric information, and account SMS messages are packaged together and called the verification information matching result.

[0040] If any one of the verification results for a user login request for any application fails—namely, if the account password, application certificate, user biometric information, or account SMS verification fails to match the corresponding database, or if the numbers in the account SMS do not completely match the random number sequence—the process returns to the step of "responding to the user login requests for each application and obtaining the user authentication information corresponding to each user login request from the terminal," and sends a "re-enter user authentication information" instruction to the corresponding terminal. If all verification results for a user login request for any application pass—namely, the account password, application certificate, user biometric information, or account SMS verification—then the next step is executed.

[0041] Step 204: If the user authentication information matches the user identity registration information stored on the server, generate encrypted login credentials corresponding to each user login request based on the user authentication information.

[0042] Among them, user identity registration information can be information entered by application users on the server storage side, that is, information registered by application users when applying for access to the target application.

[0043] The encrypted login credentials can be credentials used for homomorphic encryption, such as: authorized device, authorized time, and authorized operation.

[0044] Specifically, after matching the user authentication information with the user registration information stored on the server, if the account password verification result, application certificate verification result, user biometric information verification result, and account SMS verification result in the verification information matching result of the user login request corresponding to the target application are all successful, then an encrypted login credential corresponding to homomorphic encryption is generated based on the account password, application certificate, user biometric information, and account SMS in the user authentication information. That is, based on the account password, application certificate, user biometric information, and account SMS in the user authentication information, information such as authorized device, authorized time, and authorized operation corresponding to the user authentication information is generated.

[0045] Step 206: Based on the homomorphic encryption key corresponding to each user login request, encrypt the corresponding encrypted login credentials to obtain the ciphertext data of each user, and hash the ciphertext data of each user according to the preset storage rules to obtain the hashed ciphertext data of each user.

[0046] The homomorphic encryption key can be the tool used to perform homomorphic encryption on the encrypted data. Homomorphic encryption is a cryptography based on the mathematical theory of computational complexity. Processing homomorphically encrypted data yields an output, and decrypting this output results in the same output as processing the unencrypted original data using the same method. The key can be a symmetric key or an asymmetric key.

[0047] The user's encrypted data can be the data obtained by encrypting the encrypted login credentials with a homomorphic encryption key.

[0048] Hash storage is a storage technology that attempts to establish a definite correspondence between the storage location of data elements and their keys. In hash storage, the storage address of a node is determined by the key value of the node. Hash storage is also known as hash storage.

[0049] Among them, the hashed user ciphertext data can be the data obtained by storing the already encrypted user ciphertext data through hash storage.

[0050] Specifically, based on the user login request corresponding to each application, the corresponding homomorphic encryption key is retrieved. Before encrypting the encrypted login credential with the homomorphic encryption key, the homomorphic encryption key, the user login request, and the encrypted login credential are matched again. If the three match, the encrypted login credential is encrypted using the homomorphic encryption key to obtain the encrypted data of each user. For example, if the certificate content is xy and the encryption algorithm is E, there exists an encryption / decryption algorithm and its corresponding calculation algorithm such that E(xy). The server storage uses hash storage for each user's encrypted data. Each user's encrypted data is processed according to a preset storage rule, and a hash storage algorithm is run. The storage address of the node is determined by the node's key value. The user's encrypted data is then decomposed and stored to obtain hashed user encrypted data. This hashed user encrypted data is used to store the server login verification information corresponding to the user login request. In response to the server application sending a command to the server storage to allow login for any application, when the server storage receives the command, it sends the hashed user ciphertext data stored on the server storage to the corresponding computing location on the server application.

[0051] In one embodiment, based on each application on the server application side, a pair of asymmetric keys is first issued to each application through the server storage side. These keys are a homomorphic encryption key and a homomorphic decryption key. The homomorphic encryption key is applied on the server storage side, while the homomorphic decryption key is sent to the server application side and distributed to each application node.

[0052] In the aforementioned server login verification method, in response to user login requests corresponding to at least one application, user authentication information corresponding to each user login request is obtained; if the user authentication information matches the user identity registration information stored on the server, encrypted login credentials corresponding to each user login request are generated based on the user authentication information; each encrypted login credential is encrypted according to the homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and each user ciphertext data is hashed and stored according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store the server login verification information corresponding to the user login request.

[0053] By using server-side storage, user login authentication is centrally managed. Login credentials are generated after user authentication, and homomorphic encryption algorithms are used to ensure these credentials are computationally achievable but not visible, providing them to various applications. Different nodes within each application verify the user's login status. This solves the problem of all application server nodes needing to verify user login information, increasing the risk of information leakage. It also addresses the risks of abnormal user logins associated with session persistence technologies and the cumbersome operations caused by continuous logins from multiple applications.

[0054] In one embodiment, such as Figure 3 As shown, after obtaining the user authentication information corresponding to each user login request, the process also includes:

[0055] Step 302: Match the account password, application certificate, user biometric information, and account SMS with the user identity registration information stored on the server to obtain the verification information matching result.

[0056] The account password can be the application account and application password used to log in to the server application.

[0057] The application certificate can be the security certificate corresponding to the application used to log in to the server application.

[0058] Among them, user biometric information can be the biometric information corresponding to the application used to log in to the server application, such as fingerprints, facial contours, and pupil information.

[0059] Among them, the account SMS can be the verification code SMS corresponding to the application used to log in to the server application.

[0060] Among them, user identity registration information can be the identity information uploaded by the user when applying to use the target application.

[0061] The verification information matching result can be a comparison of the account password, application certificate, user biometric information, account SMS and user identity registration information stored on the server. The verification information matching result can be completely the same, partially the same or completely different.

[0062] Specifically, the obtained account passwords are matched against all account passwords stored in the server's password database. Similarly, the obtained application certificates are matched against all application certificates stored in the server's certificate database, and the obtained user biometric information is matched against all user biometric information stored in the server's biometric database. The account passwords in the password database, the application certificates in the certificate database, and the user biometric information in the biometric database are user-defined information in the user registration information, registered when applying for access to the target application. The obtained account SMS messages are compared with a random number sequence sent from the server to the application user's terminal. Verification is successful only when all numbers in the account SMS message match the random number sequence exactly. The result of matching the account passwords, application certificates, user biometric information, and account SMS messages is called the verification information matching result.

[0063] Step 304: If the verification information matching result indicates that one of the following is not passed—account password, application certificate, user biometric information, or account SMS—then return to the step of obtaining the user authentication information corresponding to each user login request.

[0064] Specifically, if any of the verification results for a user login request corresponding to any application fail in the following steps—account password verification, application certificate verification, user biometric information verification, and account SMS verification—that is, if the account password, application certificate, or user biometric information fails to match the corresponding database, or if the numbers in the account SMS do not completely match the random number sequence, then the process returns to the step of "responding to the user login request corresponding to each application and obtaining the user authentication information corresponding to each user login request from the terminal," and sends an instruction to the corresponding terminal to "re-enter the user authentication information."

[0065] In this embodiment, by matching the account password, application certificate, user biometric information, and account SMS with the user identity registration information reserved in the server storage, the user login is refused if the match fails, which can ensure the data security of the server and avoid data leakage.

[0066] In one embodiment, such as Figure 4 As shown, the account password, application certificate, user biometric information, and account SMS messages are matched with the user's identity registration information stored on the server to obtain the verification information matching results, including:

[0067] Step 402: Match the account password, application certificate, and user biometric information with the user's settings to obtain the settings matching results.

[0068] Among them, user settings information can be personal information set by the user when applying to use the target application, such as user biometric information, account password, etc.

[0069] The matching result can be the result of comparing the account password, application certificate, and user biometric information with the user's set information. The result can be completely identical, partially identical, or completely different.

[0070] Specifically, the obtained account passwords are matched with all account passwords in the account password database stored on the server. Similarly, the obtained application certificates are matched with all application certificates in the application certificate database stored on the server. The obtained user biometric information is matched with all user biometric information in the user biometric information database stored on the server. The account passwords in the account password database, the application certificates in the application certificate database, and the user biometric information in the user biometric information database are user-defined information in the user identity registration information, which is registered when applying for access to the target application.

[0071] Step 404: Compare the account SMS with the user's random number sequence to obtain the SMS comparison result.

[0072] The user-generated random number sequence can be a sequence randomly generated on the server storage side.

[0073] The SMS comparison result can be the result of comparing the account's SMS with the user's random number sequence. The result can be completely the same, partially the same, or completely different.

[0074] Specifically, the obtained SMS messages for each account are compared with a random number sequence sent from the server storage to the user's terminal to obtain the SMS comparison result. Verification is successful only when every number in the account SMS message matches the random number sequence exactly.

[0075] Step 406: Integrate the set information matching results with the SMS comparison results to obtain the verification information matching results.

[0076] Specifically, the results obtained by matching various account passwords, application certificates, user biometric information, and account SMS messages are packaged together and called the verification information matching results.

[0077] In this embodiment, by matching account passwords, application certificates, user biometric information, and account SMS messages, verification can only be passed when multiple data conditions are met. This avoids data errors caused by a single match and improves server security.

[0078] In one embodiment, such as Figure 5 As shown, before the step of obtaining the user authentication information corresponding to each user login request, the following steps are also included:

[0079] Step 502: In response to a user login request corresponding to at least one application, generate a homomorphic encryption key and a homomorphic decryption key corresponding to each user login request.

[0080] Specifically, in response to a user login request corresponding to at least one application, a pair of asymmetric keys is first issued to each application through the server storage, which are a homomorphic encryption key and a homomorphic decryption key, according to each application on the server application side.

[0081] Step 504: Send each homomorphic decryption key to the server application.

[0082] Specifically, the homomorphic encryption key is used on the server storage side, while the homomorphic decryption key is sent to the server application side and distributed to each application node.

[0083] In this embodiment, by generating a homomorphic encryption key and a homomorphic decryption key after responding to a user login request corresponding to at least one application, and without performing any calculations, it is possible to determine that the homomorphic encryption and homomorphic decryption corresponding to the user login request have corresponding keys. This avoids the waste of computer resources by encrypting the user login request and then being unable to decrypt it, thereby improving the utilization rate of computer resources.

[0084] In one embodiment, such as Figure 6 As shown, the method also includes:

[0085] Step 602: In response to an instruction sent by the server application to the server storage terminal for at least one application that allows login, each hashed user encrypted data is sent to the server application.

[0086] Specifically, in response to the server application sending a command to the server storage to allow login for any application, when the server storage receives the command to allow login, it sends the hashed user ciphertext data stored on the server storage to the corresponding computing location of the server application.

[0087] In this embodiment, the hashed user encrypted data is sent to the server application only in response to the login permission command from the server application. This eliminates the need for each application to use session persistence technology, reducing issues such as server failures, IP address changes, and cookie problems that could prevent normal transactions from occurring.

[0088] In one embodiment, such as Figure 7 As shown, a server login verification method is provided, which is applied to... Figure 1Taking the server application as an example, the explanation includes the following steps:

[0089] Step 702: In response to a user login request corresponding to at least one application, if a user credential is identified in the server storage, the hashed user ciphertext data corresponding to each user in the server storage is obtained.

[0090] Among them, user credentials can be credentials stored on the server side to indicate whether the application user has logged in.

[0091] Specifically, the server application sends a user identification instruction to the server storage. Upon successful identification of the application user and receipt of the user's login command, the server storage sends a user credential confirmation instruction and user account information to the server storage. The server storage then retrieves the user credential based on the user account information. If the server application receives a message from the server storage indicating that no user credential has been identified, it sends an instruction to the server storage prompting the application user to re-enter the user authentication information corresponding to the login request, and returns to the previous step of "the server application sending a user credential confirmation instruction and user account information to the server storage."

[0092] When the server application receives a message from the server storage that identifies the user's credentials, the server application receives at least one user login request corresponding to an application from the server storage. In response to each user login request, the server application retrieves the hashed user ciphertext data from the terminal's storage. Further, the retrieved hashed user ciphertext data is stored in volatile storage resources for computation by the central processing unit (CPU). The hashed user ciphertext data can be input to the CPU as a single data entry or as multiple data entries simultaneously.

[0093] Step 704: Decrypt the hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential.

[0094] The homomorphic decryption key can be used as a tool to decrypt data using homomorphic decryption. Homomorphic decryption is a cryptography based on the mathematical theory of computational complexity. It processes homomorphically encrypted data to obtain an output, and decrypting this output yields the same result as processing the unencrypted original data using the same method.

[0095] Among them, the decrypted login credentials can be credentials obtained after homomorphic decryption, such as: authorized device, authorized time, and authorized operation, etc.

[0096] Specifically, based on the user login request corresponding to each application, the corresponding homomorphic decryption key is retrieved. Before the homomorphic decryption key decrypts the hashed user ciphertext data, the homomorphic decryption key and the hashed user ciphertext data are matched again. If the two match, the homomorphic decryption key is used to decrypt the hashed user ciphertext data to obtain the decrypted login credentials. For example: if the certificate content is xy, the encryption algorithm is E, the decryption algorithm is D, and the calculation algorithm is C, then there exists an encryption, decryption, and corresponding calculation algorithm such that E(xy) = 0, and simultaneously there exists D(C(E(xy))) = C(xy). This results in an asymmetric pair, a homomorphic encryption key and a homomorphic encryption / decryption key, which are used to encrypt the original login credential data using the homomorphic key and then decrypt the calculated ciphertext.

[0097] Step 706: If a normal login authorization response is obtained from the server storage and the decrypted login credentials and identity information calculation result are the same, then the application is determined to be in a logged-in state.

[0098] Normal login authorization means that the application stored on the server can log in normally and obtain authorization.

[0099] The result of identity information calculation can be obtained by calculating user authentication information in plaintext.

[0100] The logged-in status can be the status information returned by someone who has logged into the application on the server application side, indicating that a transmission channel has been established between the server storage side and the server application side.

[0101] Specifically, after obtaining the decrypted login credentials, the server application responds to each user's login request by pairing the user account information and account transaction operations corresponding to each login request. Then, it sends the paired user account information and account transaction operations as data pairs to the server storage. When the server storage receives the user account information and account transaction operations, it compares them with the existing user account information and account transaction operations stored on the server, generating comparison result data for each user account and account transaction operation, and sends this data to the server application. Furthermore, based on the comparison result data, the server application determines the login status response from the server storage, which may indicate normal login authorization or abnormal login.

[0102] If the server application determines that the server storage has confirmed a normal login authorization, it sends a command to the server storage to retrieve user authentication information. Upon receiving the command, the server storage sends the corresponding data back to the server application to obtain the user authentication information for each user login request. Further, plaintext calculations are performed on the user authentication information to obtain the user authentication result for each user. For example, if the certificate content is xy and the plaintext calculation algorithm is C, then the user authentication result is C(xy). The server application compares each data point of the user authentication result (i.e., the original data calculation result) with each data point of the decrypted login credential (i.e., the decrypted result of the hashed user ciphertext data) to obtain the information comparison result, expressed as: D(C(E(xy))) = C(xy), where the certificate content is xy, the encryption algorithm is E, the decryption algorithm is D, and the calculation algorithm is C.

[0103] If the information comparison result indicates that the decrypted login credential and the calculated identity information are the same, the server application sends a login command to the server storage and establishes a connection channel between the server storage and the server application. Once the connection channel is established, the application corresponding to the user's login request is determined to be in a logged-in state. Figure 11 This is a schematic diagram of the data flow of a server login verification method in one embodiment.

[0104] In the aforementioned server login verification method, in response to a user login request corresponding to at least one application, if a user credential is identified in the server storage, the hashed user ciphertext data corresponding to each user login request is obtained from the server storage. Based on the homomorphic decryption key corresponding to each user login request, the hashed user ciphertext data is decrypted to obtain decrypted login credentials. If a normal login authorization response is obtained from the server storage, and the decrypted login credentials are the same as the calculated identity information, the application is determined to be logged in. The calculated identity information is the result obtained by calculating the user authentication information in plaintext.

[0105] By using a server-side application, application nodes no longer need to authenticate and cache user login information. Instead, transaction requests are synchronized with the server's storage using homomorphic encryption to calculate credential information and determine the user's login status. This solves the problem of all application server nodes needing to verify user login information, increasing the risk of information leakage. It also addresses the risks of abnormal user logins associated with session persistence technologies and the cumbersome operations caused by continuous logins from multiple applications.

[0106] In one embodiment, such as Figure 8As shown, after the step of decrypting each hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential, the following steps are also included:

[0107] Step 802: Send the user account information corresponding to each user login request to the server storage.

[0108] User account information can be information about the user and the application account left behind by the user when interacting with the application.

[0109] Account transaction operations can be the interaction data left by application users when interacting with the application.

[0110] Specifically, after obtaining the decrypted login credentials, the server application responds to the login requests of each user, pairs the user account information and account transaction operations corresponding to each user login request, and then sends the paired user account information and account transaction operations to the server storage in the form of data pairs.

[0111] Step 804: Obtain the user account information and account transaction operation comparison data corresponding to each user login request from the server storage, and generate the login status response from the server storage.

[0112] The login status response can be based on a data comparison using user account information and account transaction operations to determine whether the login was authorized normally or abnormally.

[0113] Specifically, when the server storage receives user account information and transaction data for each account, it compares this information with the existing user account information and transaction data stored on the server storage, generating comparison result data for each user account and transaction, and then sends this data to the server application. Further, the server application determines the login status response from the server storage based on the comparison result data, which may indicate normal login authorization or abnormal login.

[0114] In this embodiment, by comparing the user account information and account transaction data corresponding to the user login requests between the server storage and the server application, the login status of the server storage can be obtained. This allows for further checks for abnormal logins before establishing a channel between the server storage and the server application, thereby improving system security.

[0115] In one embodiment, such as Figure 9 As shown, after the step of decrypting each hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential, the following steps are also included:

[0116] Step 902: Obtain the user authentication information corresponding to each user login request, and perform plaintext calculation on the user authentication information to obtain the user identity calculation result.

[0117] The user identity calculation result can be the result obtained by calculating the user authentication information in plaintext.

[0118] Specifically, once the server application determines that the server storage has confirmed a normal login authorization, it sends a command to the server storage to retrieve user authentication information. Upon receiving the command, the server storage sends the corresponding data back to the server application to fulfill the server application's requirement of obtaining user authentication information for each user's login request. Furthermore, the user authentication information is processed in plaintext to obtain the authentication result for each user.

[0119] Step 904: Compare each decrypted login credential with the calculation results of each user's identity to obtain the information comparison results.

[0120] The information comparison result can be the result of comparing the decrypted login credentials with the calculation results of each user's identity. This result can be completely identical, partially identical, or completely different.

[0121] Specifically, the server application compares each piece of data in the user identity calculation result (i.e., the original data calculation result) with each piece of data in the decrypted login credential (i.e., the decryption result of the hashed user ciphertext data) one by one to obtain the information comparison result.

[0122] In this embodiment, by comparing the differences between the decrypted login credentials and the calculation results of each user's identity, the system further verifies whether the decrypted data is the same as the original data, thereby avoiding the erroneous establishment of a channel between the server storage and the server application, and ensuring data security.

[0123] In one embodiment, such as Figure 10 As shown, the method also includes:

[0124] Step 1002: If no user credentials are recognized in the server storage, a re-login command is sent to the server storage.

[0125] Specifically, when the application user is successfully identified and the user's command reaches the server storage, the server application sends a user credential confirmation instruction and user account information to the server storage. The server storage retrieves the user credential based on the user account information according to the user credential confirmation instruction. If the server application receives a message from the server storage that it cannot identify a user credential, it sends an instruction to the server storage to ask the application user to re-enter the user authentication information corresponding to the user login request, and then returns to the step of "the server application sending a user credential confirmation instruction and user account information to the server storage".

[0126] In this embodiment, by identifying user credentials in the server storage and rejecting login requests from users whose credentials cannot be identified, it is possible to determine whether the application user has already logged in, thus avoiding the server application from performing decryption operations, which would lead to invalid calculations on the server and improve the server's resource utilization.

[0127] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0128] Based on the same inventive concept, this application also provides a server login verification device for implementing the server login verification method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in the one or more server login verification device embodiments provided below can be found in the limitations of the server login verification method described above, and will not be repeated here.

[0129] In one embodiment, such as Figure 12 As shown, a server login verification device is provided, applied to the server storage end, including: an information acquisition module 1202, a credential generation module 1204, and a data encryption module 1206, wherein:

[0130] The information acquisition module 1202 is used to acquire user authentication information corresponding to each user login request in response to user login requests corresponding to at least one application.

[0131] The credential generation module 1204 is used to generate encrypted login credentials corresponding to each user's login request based on the user authentication information when the user authentication information matches the user identity registration information stored on the server.

[0132] The data encryption module 1206 is used to encrypt the corresponding encrypted login credentials according to the homomorphic encryption key corresponding to each user login request, to obtain the encrypted data of each user, and to hash the encrypted data of each user according to the preset storage rules to obtain the hashed encrypted data of each user; the hashed encrypted data of each user is used to save the server login verification information corresponding to the user login request.

[0133] In one embodiment, the credential generation module 1204 is further configured to match the account password, application certificate, user biometric information, and account SMS with the user identity registration information stored on the server to obtain the verification information matching result; if the verification information matching result indicates that one of the account password, application certificate, user biometric information, and account SMS fails, the module returns to the step of obtaining the user authentication information corresponding to each user login request.

[0134] In one embodiment, the credential generation module 1204 is further configured to match the account password, application certificate, and user biometric information with user-defined information to obtain a defined information matching result; compare the account SMS with the user random number sequence to obtain an SMS comparison result; and integrate the defined information matching result with the SMS comparison result to obtain a verification information matching result.

[0135] In one embodiment, the information acquisition module 1202 is further configured to, in response to a user login request corresponding to at least one application, generate a homomorphic encryption key and a homomorphic decryption key corresponding to each user login request; and send each homomorphic decryption key to the server application.

[0136] In one embodiment, the data encryption module 1206 is further configured to send each hashed user encrypted data to the server application in response to an instruction sent from the server application to the server storage for at least one application that allows login.

[0137] In one embodiment, such as Figure 13 As shown, a server login verification device is provided, including: a data acquisition module 1302, a data decryption module 1304, and an application login module 1306, wherein:

[0138] Data acquisition module 1302 is used to, in response to a user login request corresponding to at least one application, acquire each hashed user encrypted data corresponding to the server storage if a user credential is identified in the server storage.

[0139] The data decryption module 1304 is used to decrypt the hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request, and obtain each decrypted login credential.

[0140] The application login module 1306 is used to determine that the application is logged in when it receives a normal login authorization response from the server storage and the decrypted login credential and the identity information calculation result are the same; the identity information calculation result is the result obtained by calculating the user's identity verification information in plaintext.

[0141] In one embodiment, the application login module 1306 is further configured to send user account information and account transaction operations corresponding to each user login request to the server storage; obtain comparison data of user account information and account transaction operations corresponding to each user login request from the server storage, and generate a login status response from the server storage; the login status response indicates whether the application performs normal login authorization or abnormal login on the server storage.

[0142] In one embodiment, the application login module 1306 is further configured to obtain user authentication information corresponding to each user login request, and perform plaintext calculation on the user authentication information to obtain the user identity calculation result; compare each decrypted login credential with the user identity calculation result to obtain an information comparison result; the information comparison result characterizes the similarity between the decrypted login credential and the identity information calculation result.

[0143] In one embodiment, the data acquisition module 1302 is further configured to send a re-login instruction to the server storage if the server storage fails to identify a user credential; the re-login instruction is used to obtain user authentication information corresponding to each user login request.

[0144] The modules in the aforementioned server login verification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0145] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 14As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores server data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a server login authentication method.

[0146] Those skilled in the art will understand that Figure 14 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0147] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0148] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0149] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0150] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0151] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0152] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0153] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A server login verification method, characterized in that, Applied to server storage, the method includes: In response to a user login request corresponding to at least one application, obtain the user authentication information corresponding to each user login request; If the user authentication information matches the user identity registration information stored on the server, an encrypted login credential is generated for each user login request based on the user authentication information. Based on the homomorphic encryption key corresponding to each user login request, the corresponding encrypted login credentials are encrypted to obtain each user ciphertext data. The ciphertext data is then hashed and stored according to a preset storage rule to obtain each hashed user ciphertext data. The hashed user ciphertext data is used to store the server login verification information corresponding to the user login request. Before the step of obtaining the user authentication information corresponding to each user login request, the method further includes: In response to a user login request corresponding to at least one of the applications, a homomorphic encryption key and a homomorphic decryption key are generated for each user login request; Each of the aforementioned homomorphic decryption keys is sent to the server application.

2. The method according to claim 1, characterized in that, The user authentication information includes account password, application certificate, user biometric information, and account SMS messages; After the step of obtaining the user authentication information corresponding to each user login request, the method further includes: The account password, application certificate, user biometric information, and account SMS are matched with the user identity registration information stored on the server to obtain the verification information matching result; If the verification information matching result indicates that one of the account password, the application certificate, the user biometric information, and the account SMS is unsuccessful, the process returns to the step of obtaining the user authentication information corresponding to each user login request.

3. The method according to claim 2, characterized in that, The user identity registration information includes user settings and a user random number sequence; the process of matching the account password, application certificate, user biometric information, and account SMS with the user identity registration information stored on the server to obtain verification information matching results includes: The account password, the application certificate, and the user's biometric information are matched with the user's settings to obtain the settings matching result; The account SMS messages are compared with the user's random number sequence to obtain the SMS comparison results; The matching result of the set information is integrated with the comparison result of the SMS message to obtain the matching result of the verification information.

4. The method according to claim 1, characterized in that, The method further includes: In response to at least one instruction sent from the server application to the server storage allowing login to the application, each of the hashed user encrypted data is sent to the server application.

5. A server login verification method, characterized in that, Applied to the server application side, the method includes: In response to a user login request corresponding to at least one application, if a user credential is identified in the server storage, the hashed user ciphertext data corresponding to the server storage is obtained. Based on the homomorphic decryption key corresponding to each user login request, the hashed user ciphertext data is decrypted to obtain each decrypted login credential. If a normal login authorization response is received from the server storage, and the decrypted login credential matches the calculated identity information, the application is determined to be logged in; the calculated identity information is the result obtained by calculating the user's identity verification information in plaintext.

6. The method according to claim 5, characterized in that, After the step of decrypting each hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential, the method further includes: Send the user account information corresponding to each user login request to the server storage; and perform account transaction operations to the server storage. The server storage acquires user account information and account transaction data corresponding to each user login request, and generates a login status response from the server storage. The login status response indicates whether the application performs normal login authorization or abnormal login from the server storage.

7. The method according to claim 6, characterized in that, After the step of decrypting each hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request to obtain each decrypted login credential, the method further includes: Obtain the user authentication information corresponding to each user login request, and perform plaintext calculation on the user authentication information to obtain the user identity calculation result; Each decrypted login credential is compared with the calculated user identity information to obtain an information comparison result; the information comparison result represents the similarity between the decrypted login credential and the calculated identity information.

8. The method according to claim 5, characterized in that, The method further includes: If no user credentials are identified in the server storage, a re-login instruction is sent to the server storage; the re-login instruction is used to obtain user authentication information corresponding to each user login request.

9. A server login verification device, characterized in that, The device, applied to server storage, includes: The information acquisition module is used to respond to user login requests corresponding to at least one application and acquire user authentication information corresponding to each user login request. The credential generation module is used to generate encrypted login credentials corresponding to each user login request based on the user authentication information when the user authentication information matches the user identity registration information stored in the server. The data encryption module is used to encrypt the corresponding encrypted login credentials according to the homomorphic encryption key corresponding to each user login request to obtain each user ciphertext data, and to hash each user ciphertext data according to a preset storage rule to obtain each hashed user ciphertext data; the hashed user ciphertext data is used to store the server login verification information corresponding to the user login request. Before acquiring the user authentication information corresponding to each user login request, the information acquisition module is further configured to: In response to a user login request corresponding to at least one of the applications, a homomorphic encryption key and a homomorphic decryption key are generated for each user login request; Each of the aforementioned homomorphic decryption keys is sent to the server application.

10. A server login verification device, characterized in that, The device, used in server applications, includes: The data acquisition module is used to respond to a user login request corresponding to at least one application, and, if a user credential is identified in the server storage, acquire each hashed user encrypted data corresponding to the server storage. The data decryption module is used to decrypt the hashed user ciphertext data according to the homomorphic decryption key corresponding to each user login request, so as to obtain each decrypted login credential. The application login module is used to determine that the application is logged in when a normal login authorization response is obtained from the server storage and the decrypted login credential is the same as the calculated result of the identity information; the calculated result of the identity information is the result obtained by calculating the user's identity verification information in plaintext.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images