Method and apparatus for maintaining a secure login state, computing device, and storage medium

Abstract

A method for maintaining a secure login state is described, including: receiving a target account login state renewal request from a first client, the login state renewal request including a renewal credential; determining validity of the renewal credential based on reference credential information of the target account; updating the reference credential information in response to the renewal credential being determined as valid; and sending at least part of the updated reference credential information to the first client to update the renewal credential in response to the reference credential information being updated. The method for maintaining a secure login state according to the embodiments of the present disclosure can effectively identify multi-opening and abnormal login behaviors for a target account, and protect the security of the target account login state.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and in particular to methods and apparatuses, computing devices, storage media and program products for maintaining a secure login state. Background Technology

[0002] With the development of computer and internet technology, computer networks have become an indispensable tool in people's daily lives. In order to use network resources more safely and conveniently, various websites or network applications (such as computer applications or mobile apps) usually require users to register an account and log in to the website or application through the account. This allows users to fully access the corresponding network resources and perform various operations.

[0003] However, in related technologies, because the login credentials or login information of registered users can be easily obtained by some unregistered users through abnormal means such as exploiting system vulnerabilities, such unregistered users may impersonate registered users to log in illegally, thereby causing information leakage and property loss to registered users who log in normally. Summary of the Invention

[0004] In view of this, the present disclosure provides methods and apparatus for maintaining a secure login state, which are intended to overcome some or all of the defects mentioned above, as well as other possible defects.

[0005] According to a first aspect of this disclosure, a method for maintaining a secure login state is disclosed, characterized by comprising: receiving a login state renewal request for a target account from a first client, the login state renewal request including a renewal credential; determining the validity of the renewal credential based on baseline credential information of the target account; updating the baseline credential information in response to the renewal credential being determined to be valid; and sending at least a portion of the updated baseline credential information to the first client in response to the updated baseline credential information to update the renewal credential.

[0006] In a method for maintaining a secure login state according to some embodiments of this disclosure, the baseline credential information includes a first baseline credential, and wherein determining the validity of the renewal credential based on the baseline credential information includes: in response to the renewal credential matching the first baseline credential, the renewal credential is determined to be valid; wherein updating the baseline credential information in response to the renewal credential being determined to be valid includes: updating the first baseline credential in response to the renewal credential being determined to be valid; and wherein sending at least a portion of the updated baseline credential information to a first client to update the renewal credential in response to the updated baseline credential information includes: sending the updated first baseline credential to the first client to update the renewal credential in response to the first baseline credential being updated.

[0007] In a method for maintaining a secure login state according to some embodiments of this disclosure, the baseline credential information further includes a second baseline credential, which is a supplementary baseline credential to the first baseline credential and matches the most recently received valid renewal credential before receiving a target account login state renewal request from the first client. The determination of the validity of the renewal credential based on the baseline credential information further includes: in response to the renewal credential not matching the first baseline credential but matching the second baseline credential, the renewal credential is determined to be valid; in response to the renewal credential not matching either the first or the second baseline credential, the renewal credential is determined to be invalid.

[0008] In a method for maintaining a secure login state according to some embodiments of the present disclosure, updating the base credential information in response to the renewal credential being determined to be valid further includes: updating a second base credential to the renewal credential in response to the renewal credential matching a first base credential.

[0009] In a method for maintaining a secure login state according to some embodiments of the present disclosure, the baseline credential information further includes a renewal request encryption key.

[0010] In a method for maintaining a secure login state according to some embodiments of the present disclosure, in response to a renewal credential being determined to be valid, updating baseline credential information includes: updating a first baseline credential and a renewal request encryption key in response to a renewal credential being determined to be valid, and wherein, in response to the updated baseline credential information, sending at least a portion of the updated baseline credential information to a first client to update the renewal credential includes: in response to the updated first baseline credential and the updated renewal request encryption key, sending the updated first baseline credential and the updated renewal request encryption key to the first client for use respectively in updating the renewal credential and encrypting subsequent target account login state renewal requests.

[0011] In a method for maintaining a secure login state according to some embodiments of the present disclosure, determining the validity of the renewal certificate based on baseline credential information further includes: in response to a mismatch between the renewal certificate and a first baseline credential, the renewal certificate is determined to be invalid.

[0012] In a method for maintaining a secure login state according to some embodiments of the present disclosure, the method further includes: terminating the target account login state of the first client in response to the renewal credential being determined to be invalid.

[0013] In a method for maintaining a secure login state according to some embodiments of the present disclosure, the method further includes: receiving a login request for a target account from a second client, the login request including login credentials; determining the validity of the login credentials; and terminating the target account login state of the first client in response to the login credentials being determined to be valid.

[0014] In a method for maintaining a secure login state according to some embodiments of the present disclosure, the method further includes: in response to the termination of the target account login state of the first client, enabling the target account login state of the second client.

[0015] In a method for maintaining a secure login state according to some embodiments of the present disclosure, before receiving a target account login state renewal request from a first client, the method further includes: monitoring the target account login state of the first client in real time; sending a login state renewal prompt to the first client in response to detecting that the target account login state of the first client has reached or exceeded a predetermined renewal time; and terminating the target account login state of the first client in response to not receiving a login state renewal request from the first client within a predetermined time period starting from the predetermined renewal time.

[0016] According to a second aspect of this disclosure, an apparatus for maintaining a secure login state is disclosed, characterized in that it comprises: a receiving module configured to receive a login state renewal request for a target account from a first client, the login state renewal request including a renewal credential; a determining module configured to determine the validity of the renewal credential based on baseline credential information of the target account; an updating module configured to update the baseline credential information in response to the renewal credential being determined to be valid; and a sending module configured to send at least a portion of the updated baseline credential information to the first client to update the renewal credential in response to the updated baseline credential information.

[0017] According to a third aspect of this disclosure, a computing device is disclosed, comprising: a memory configured to store computer-executable instructions; and a processor configured to perform any of the methods described above when the computer-executable instructions are executed by the processor.

[0018] According to a fourth aspect of this disclosure, a computer-readable storage medium is disclosed that stores computer-executable instructions, which, when executed, perform any of the methods described above.

[0019] According to a fifth aspect of this disclosure, a computer program product is disclosed, comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, perform any of the methods described above.

[0020] In the method and apparatus for maintaining a secure login state according to some embodiments of the present disclosure, the login status of the target account is monitored in real time by receiving a renewal request from the client to maintain the login state of the target account, and the login state of the target account is renewed based on dynamically updated base credential information and renewal credential. This makes it impossible for abnormal users (or unregistered users) who log in to the target account by exploiting system vulnerabilities or other abnormal means to obtain dynamically updated renewal credentials on the client they use, based solely on static login information. As a result, they cannot complete the renewal in the dynamic renewal process and will eventually terminate their login state. This approach enables the rapid detection of abnormal user login behavior on the target account and allows for the implementation of necessary measures such as terminating the login state. This prevents information leakage and financial losses caused by abnormal users using their clients to remain logged in for extended periods, effectively ensuring the security of the target account for normal users (or registered users) and achieving a secure login state for normal users and their clients. On the other hand, in the methods and apparatus for maintaining a secure login state according to some embodiments of this disclosure, the use of dynamically updated base credential information and renewal credential to implement a dynamic renewal process allows for the rapid detection and termination of multiple instances of the target account (simultaneously logged in) by abnormal users on their clients while normal users are in the target account login state. This optimizes network resource scheduling, reduces network resource overhead during the target account login state, and improves the work efficiency of normal users and their clients during the target account login state.

[0021] These and other advantages of this disclosure will become clear from the embodiments described below, and will be illustrated with reference to the embodiments described below. Attached Figure Description

[0022] Embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings, in which: Figure 1 The illustrations depict exemplary application scenarios in which technical solutions according to some embodiments of the present disclosure can be implemented; Figure 2 The illustration shows a schematic flowchart of a method for maintaining a secure login state according to some embodiments of the present disclosure; Figure 3 The illustration shows a schematic flowchart of a method for maintaining a secure login state according to some embodiments of the present disclosure; Figure 4 The illustration shows a schematic flowchart of a method for maintaining a secure login state according to some embodiments of the present disclosure; Figure 5 The illustration shows a schematic flowchart of a method for maintaining a secure login state according to some embodiments of the present disclosure; Figure 6 The illustration shows a schematic diagram of a method for maintaining a secure login state according to some embodiments of the present disclosure; Figure 7 An exemplary structural block diagram of an apparatus for maintaining a secure login state according to some embodiments of the present disclosure is shown; Figure 8 An example system is illustrated, which includes an example computing device representing one or more systems and / or devices that can implement the various technologies described herein. Detailed Implementation

[0023] The following description provides specific details of various embodiments of this disclosure to enable those skilled in the art to fully understand and implement the various embodiments of this disclosure. It should be understood that the technical solutions of this disclosure can be implemented without some of these details. In some cases, this disclosure does not show or describe in detail some well-known structures or functions to avoid such unnecessary descriptions that would obscure the description of the embodiments of this disclosure. The terminology used in this disclosure should be understood in its broadest and most reasonable manner, even when used in conjunction with specific embodiments of this disclosure.

[0024] In related technologies, when a registered user logs into a target account through a client, the interaction process between the client and server typically includes: the client receiving the login credentials (e.g., login username or mobile phone number and corresponding password) for the target account and transmitting them to the server; the server, after confirming the accuracy of the username and password received from the client, returning login information (e.g., TGT) identifying the account to the client. In subsequent communications with the server, the client can usually authenticate with the server using only this login information without needing to re-enter the login credentials. However, in related technologies, the login information received by the client while logged in may be obtained by an unregistered user through illegitimate means (e.g., because login information is often stored on the local disk). After obtaining the login information for the target account, the unregistered user can use technical means (e.g., system vulnerabilities) to send an authentication request for the target account to the server using only this login information through another client, thereby achieving login—that is, using the same account with a registered user who is logged in to create a dual account. It is evident that such unregistered users can bypass the login credentials of the target account by obtaining its login information (the unregistered user may not even know the target account's login credentials), thus logging in or renewing the target account without being detected by legitimate users or registered users' clients and servers. This allows the unregistered user's client to communicate with the server using the target account, putting the target account's login state at risk, especially posing a risk of unauthorized use of registered users' information and assets.

[0025] In view of the above-mentioned problems or defects in related technologies, in the method for maintaining a secure login state according to some embodiments of this application, the idea of ​​dynamically updating the renewal certificate and the base certificate is adopted for the client's target account login state renewal request, and the multi-account behavior of the target account is automatically identified, so as to realize the identification and response to the abnormal login behavior of non-registered users and improve the security of the target account's login state.

[0026] First, some terms or expressions used in the embodiments of this application will be explained to facilitate understanding by those skilled in the art.

[0027] Login: By entering the login credentials of the target account, the user establishes a connection with the computer network, enters the corresponding computer system, and gains access to pages and resources related to the target account on the Internet.

[0028] Login credentials: These are the credentials a user uses to log in to a target account, enabling the computer system to recognize the account. Common login credentials include, for example, username and password, mobile phone number and verification code.

[0029] Login information refers to the information a computer system uses to identify a client's login status. After verifying that the login credentials sent by the client for the target account are correct, the server returns login information to the client to identify the client's login status. In existing technology, the client can use the login information to authenticate with the server in subsequent communications. Common login information includes TGT (Trusted Tokens).

[0030] Login state: This refers to the state of the target account after it has been logged in. For example, after the target account has logged in, issues such as information leakage may occur due to multiple instances of the same account being logged in. In this case, the account is in an insecure login state.

[0031] Renewal: A behavior on the client side to maintain the login state of a target account. Typically, the client periodically sends a renewal request to the server, and the server decides whether to renew after receiving the request. If the server decides not to renew, the login state of the target account on the client will terminate. If the server decides to renew, the login state of the target account on the client will be maintained.

[0032] Renewal credential: This refers to the credential used by a client to prove its identity when initiating a renewal request. By verifying this renewal credential, the server can determine whether the user making the renewal request is a legitimate user of the target account, and thus decide whether to renew. Typically, renewal credentials may include information such as TGT (Time To Register).

[0033] TGT (Ticket Grangting Ticket): A ticket used in client login and renewal processes, also known as a large ticket. Typically, after a client logs in using the target account's login credentials, it receives a TGT from the server. In subsequent communications, the client can use this TGT information to communicate with the server (e.g., for renewal requests) without needing to re-enter the login credentials. Normally, if login credentials are re-entered, the server will generate a new TGT, rendering the existing TGT invalid. Therefore, if a client maintains its current login state for a long time without logging in again, its TGT information will not be updated, which could provide an opportunity for malicious users.

[0034] Multiple instances: The same account maintains a logged-in state on multiple clients / software / platforms. For example, a legitimate user logs into the target account on their own client, receives the target account's TGT (Transaction Granting Title), and maintains the login state. An illegitimate user, after obtaining the target account's TGT stored on a legitimate user's client, can also maintain the target account's login state on the illegitimate user's client. This results in multiple instances of the target account.

[0035] Figure 1 The illustration shows an exemplary application scenario 100 in which the technical solutions according to embodiments of this disclosure can be implemented. For example... Figure 1 As shown, application scenario 100 includes server 110, terminals 120 and 130, and network 140. Terminals 120 and 130 are communicatively coupled to server 110 via network 140. As an example, data streams containing information such as login requests, renewal requests, and renewal credentials can be transmitted between applications or clients of server 110, terminals 120, and 130 via network 140. These data streams can be encrypted. Only two terminals are shown here; in reality, three or more terminals can exist.

[0036] As an example, server 110 receives a login state renewal request for a target account from a client in terminal 120. This login state renewal request includes renewal credentials. Server 110 then determines the validity of the renewal credentials based on the target account's baseline credential information. In response to the renewal credentials being determined to be valid, server 110 updates the baseline credential information. In response to the updated baseline credential information, server 110 sends at least a portion of the updated baseline credential information to the client in terminal 120 to update the renewal credentials.

[0037] As an example, server 110 can also receive a target account login state renewal request from a client in terminal 130 or other terminals and perform subsequent operations to maintain the target account's secure login state. Furthermore, the program used to execute the method for maintaining the secure login state can be stored locally on server 110 or on a cloud server, and transmitted and invoked via network 140.

[0038] Optionally, server 110 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The aforementioned terminals 120 and 130 can include, but are not limited to, at least one of the following: mobile phones, tablets, laptops, desktop PCs, digital televisions, and other terminals capable of displaying content. Network 140 can be, for example, a wide area network (WAN), a local area network (LAN), a wireless network, a public telephone network, an intranet, and any other type of network well known to those skilled in the art. It should also be noted that the scenarios described above are merely one example in which embodiments of this disclosure can be implemented and are not restrictive.

[0039] It should be noted that the scenario described above is merely one example in which the embodiments of this disclosure can be implemented, and is not restrictive. For example, in some exemplary scenarios, it may also be possible to maintain a secure login state on a specific terminal.

[0040] Figure 2 The illustration shows a schematic flowchart of a method for maintaining a secure login state according to an embodiment of the present disclosure. Method 200 can be implemented, for example, in applications such as... Figure 1 On server 110, this is not a limitation. Figure 2 As shown, method 200 includes steps 210, 220, 230, 240 and 250.

[0041] In step 210, a login status renewal request for the target account is received from the first client. This login status renewal request includes renewal credentials. In some embodiments, the renewal credentials can be dynamically changed, for example, they can be continuously updated along with the renewal. For example, when the first client renews for the first time after logging into the target account, the renewal credentials in its renewal request can be those received from the server when logging into the target account. When the first client renews for the second time, the renewal credentials in its renewal request can be those received from the server during its previous renewal. As an example, the renewal request can be initiated by the client periodically to the server to maintain the login status of the target account on the client. Alternatively, the server can send a renewal prompt to the client to urge the client to initiate a renewal request. Optionally, the renewal request can be sent through common communication interfaces or protocols. As an example, the renewal request containing the renewal credentials can also be encrypted before being sent to better protect the account's information security.

[0042] In step 220, the validity of the renewal credential is determined based on the baseline credential information of the target account. In some embodiments, the baseline credential information is generated and updated by the server. As an example, the baseline credential information of the target account may include a renewal credential previously sent to the client. For example, after the client completes login to the target account, the server generates a renewal credential for the client and sends it to the client for use when the client initiates a renewal request. This renewal credential may be included in the baseline credential information of the target account so that it can be matched with it when the client initiates a renewal request. For example, after the client completes a renewal, the baseline credential information of the target account may also include a renewal credential that the client can use for the next renewal request. As an example, the validity of the renewal credential can be determined by comparing the baseline credential information with the renewal credential. For example, if the baseline credential information contains the same information as the renewal credential, the renewal credential is determined to be valid.

[0043] In step 230, in response to the renewal certificate being determined to be valid, the base certificate information is updated. As an example, updating the base certificate information may include generating new base certificate information and replacing the original base certificate information with it, or supplementing the original base certificate information. For instance, in response to the renewal certificate being determined to be valid, new base certificate information is generated, and the original base certificate information is replaced with this new base certificate information. In some embodiments, the base certificate information includes a base certificate, and updating the base certificate information may include updating the base certificate in the base certificate information and replacing the base certificate in the original base certificate information with the new base certificate.

[0044] In step 240, in response to the updated baseline credential information, at least a portion of the updated baseline credential information is sent to the first client to update the renewal credential. For example, a portion of the updated baseline credential information can be sent to the first client as a new renewal credential for use by the first client when initiating a renewal request next time. In some embodiments, the baseline credential information includes a baseline credential, and updating the baseline credential information includes updating the baseline credential; in this case, the updated baseline credential can be sent to the first client to update the renewal credential. For example, after receiving a target account login state renewal request containing a renewal credential from the first client, the validity of the received renewal credential is determined by comparing whether the received renewal credential is the same as the baseline credential in the baseline credential information. If the received renewal credential is valid, a new baseline credential is generated to replace the baseline credential in the original baseline credential information to update the baseline credential information, and the generated new baseline credential is sent to the first client as the renewal credential for the first client's next renewal application.

[0045] In step 250, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client is terminated. As an example, terminating the login state of the target account on the first client may include kicking the logged-in target account offline on the first client. In some embodiments, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client may be terminated, and the interface of the first client may be switched to the page when the account is not logged in.

[0046] exist Figure 2 In the method 200 for maintaining a secure login state according to some embodiments of this disclosure, after receiving a renewal request from a client, the validity of the renewal credential in the renewal request is determined based on the base credential information of the target account, preventing abnormal users from renewing their accounts solely with the obtained login information. Then, in response to the renewal credential being determined to be valid, the base credential information is updated, and at least a portion of the updated base credential information is sent to the client to update the renewal credential. Because method 200 updates the renewal credential in real time, even if an abnormal user obtains the renewal credential before the update, they cannot renew their account subsequently, thus dynamically maintaining the secure login state of the target account. Figure 3 The illustration shows a schematic flowchart of a method 300 for maintaining a secure login state according to an embodiment of the present disclosure. Method 300 can be implemented, for example, in applications such as... Figure 1 On server 110, this is not a limitation. Figure 2 As shown, method 300 includes steps 310, 320, 330, 340 and 350.

[0047] In step 310, a login status renewal request for the target account is received from the first client. This login status renewal request includes a renewal credential. In some embodiments, the renewal credential may be dynamically changing, for example, it may be continuously updated along with the renewal. In some embodiments, step 310 may be the same as step 210 of method 200.

[0048] In step 320, the validity of the renewal certificate is determined based on the baseline credential information of the target account, wherein the baseline credential information includes a first baseline credential. In some embodiments, the first baseline credential is generated and updated by the server. As an example, the first baseline credential of the target account may be a renewal credential previously sent to the client. For example, after the client completes login to the target account, the server generates a first baseline credential and sends it to the client as the renewal credential for the client's next renewal request. For example, after the client completes a renewal, a new first baseline credential for the target account is generated and sent to the client as the renewal credential for the client's next renewal request. As an example, the validity of the renewal certificate can be determined by comparing the first baseline credential with the renewal certificate. For example, if the first baseline credential and the renewal certificate are the same, the renewal certificate is determined to be valid.

[0049] In step 330, in response to the renewal certificate matching the first base certificate, the first base certificate is updated. As an example, updating the first base certificate may include generating a new first base certificate and replacing the original first base certificate with it, or using it as a supplement to the first base certificate. For example, in response to the renewal certificate being determined to be valid, a new first base certificate is generated and replaces the original first base certificate with this new first base certificate. In some embodiments, in response to the renewal certificate not matching the first base certificate, the renewal certificate is determined to be invalid. As an example, if the renewal certificate is different from the first base certificate, the renewal certificate is determined to be invalid.

[0050] In step 340, in response to the update of the first base credential, the updated first base credential is sent to the first client to update the renewal credential. In some embodiments, after receiving a target account login state renewal request containing a renewal credential from the first client, the validity of the received renewal credential is determined by comparing whether the received renewal credential is the same as the first base credential. If the received renewal credential is valid, a new first base credential is generated to replace the original first base credential to update the first base credential, and the generated new first base credential is sent to the first client as the renewal credential for the first client's next renewal application.

[0051] In step 350, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client is terminated. As an example, terminating the login state of the target account on the first client may include kicking the logged-in target account off the first client. In some embodiments, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client may be terminated, and the interface of the first client may be switched to the page when the account is not logged in. In some embodiments, step 350 may be the same as step 250 of method 200.

[0052] In method 300, after receiving the renewal request from the client, the validity of the target account's base credential information is determined based on whether the renewal credential in the renewal request is compared with the first base credential. Then, in response to the renewal credential being determined to be valid, the first base credential is updated and sent to the first client to update the renewal credential. Thus, method 300, by updating the first base credential and sending it to the client with each renewal as the basis for updating the renewal credential, prevents abnormal users from maintaining the target account's login state solely based on previously obtained login information, thereby dynamically maintaining the target account's secure login state.

[0053] Figure 4 The illustration shows a schematic flowchart of a method 400 for maintaining a secure login state according to an embodiment of the present disclosure. Method 400 can be implemented, for example, in applications such as... Figure 1 On server 110, this is not a limitation. Figure 4 As shown, method 400 includes steps 410, 420, 430, 440 and 450.

[0054] In step 410, a login status renewal request for the target account is received from the first client. This login status renewal request includes a renewal credential. In some embodiments, the renewal credential may be dynamically changing, for example, it may be continuously updated along with the renewal. In some embodiments, step 410 may be the same as step 210 of method 200.

[0055] In step 420, the validity of the renewal certificate is determined based on the baseline credential information of the target account. The baseline credential information includes a first baseline credential and a second baseline credential. The second baseline credential is a supplementary baseline credential to the first baseline credential and matches the most recently received valid renewal credential before receiving the target account login status renewal request from the first client. In some embodiments, the first baseline credential is generated and updated by the server, and the second baseline credential is determined based on a renewal credential previously received by the server. For example, the second baseline credential of the target account may be a valid renewal credential regarding the target account login status received from the current client (e.g., the first client) or another client before the current renewal request (e.g., during the previous renewal process). For instance, after the first client completes the current renewal, the server generates a new first baseline credential for the target account and sends it to the first client as the renewal credential for the next renewal request. At this time, the renewal credential received by the server from the first client's current renewal request (i.e., the renewal credential successfully sent by the server last time) can be used as the new second baseline credential to replace the current second baseline credential. For example, the validity of the renewal credential can be determined based on whether the renewal credential matches at least one of the first and second baseline credentials. For example, if the renewal document is the same as the first base document, the renewal document is deemed valid. If the renewal document is different from the first base document but the same as the second base document, the renewal document is deemed valid. If the renewal document is different from both the first and second base documents, the renewal document is deemed invalid.

[0056] In step 430, in response to the renewal certificate matching the first base certificate, the first base certificate and the second base certificate are updated. As an example, updating the first base certificate may include generating a new first base certificate and replacing the original first base certificate with it. For example, in response to the renewal certificate being determined to be valid, a new first base certificate is generated and used to replace the original first base certificate. Updating the second base certificate may include updating the second base certificate to the received renewal certificate. For example, in response to the renewal certificate being determined to be valid, the received renewal certificate is used as the new second base certificate to replace the original second base certificate.

[0057] In step 440, in response to updating the first base credential, the updated first base credential is sent to the first client to update the renewal credential. In some embodiments, after receiving a target account login state renewal request containing a renewal credential from the first client, the validity of the received renewal credential is determined by comparing whether it is the same as the first base credential or the second base credential. If the received renewal credential is valid, a new first base credential is generated to replace the original first base credential to update the first base credential, and the received renewal credential is used as the new second base credential. The generated new first base credential is then sent to the first client as the renewal credential for the first client's next renewal application.

[0058] In step 450, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client is terminated. As an example, terminating the login state of the target account on the first client may include kicking the logged-in target account offline on the first client. In some embodiments, in response to the renewal certificate being determined to be invalid, the login state of the target account on the first client may be terminated, and the interface of the first client may be switched to the page when the account is not logged in. In some embodiments, step 450 may be the same as step 250 of method 200.

[0059] In method 400, since the base credential information contains two base credentials—the most recently generated base credential (i.e., the first base credential) and the most recently received valid renewal credential before the first base credential was generated (i.e., the second base credential)—it effectively avoids the erroneous identification of a normal user's client as an abnormal user due to network latency / interruption causing renewal credential update failures, thus incorrectly terminating the login state of a normal user's client. For example, in step 440, the server sends the updated first base credential to the client, but the client does not receive it due to network interruption or other issues, resulting in the client retaining outdated credential information (e.g., the same as the second base credential). In the next renewal, the client can only request renewal using the outdated renewal credential (e.g., the same as the second base credential). Although the received renewal credential does not match the first base credential, it matches the second base credential, ensuring the renewal request is still considered valid. This avoids the client being judged as an abnormal user (e.g., mistakenly believing there is dual-clienting) because it did not receive the updated base credential information.

[0060] Optionally, the baseline credential information in method 300 may further include a renewal request encryption key. In some embodiments, Figure 1Data transmission between server 110, client 120, client 130, etc., can be conducted via encrypted communication. Optionally, communication within server 110 can also be conducted via encrypted communication. In this case, the base credential information can be transmitted via encrypted communication, and a key can be added to encrypt or decrypt the base credential information, thereby better protecting the information security of the target account.

[0061] In some embodiments, step 330, in response to the renewal certificate being determined to be valid, updating the base certificate information may include: updating the first base certificate and the renewal request encryption key in response to the renewal certificate being determined to be valid. As an example, the encryption method of the encrypted communication can be continuously updated, and therefore the corresponding key will also be updated accordingly. In step 240, in response to the base certificate information being updated, sending at least a portion of the updated base certificate information to the first client to update the renewal certificate may include: in response to the first base certificate and the renewal request encryption key being updated, sending the updated first base certificate and the updated renewal request encryption key to the first client for use in updating the renewal certificate and encrypting subsequent target account login state renewal requests, respectively. By continuously updating the encryption method and corresponding key of the encrypted communication, even if an abnormal user obtains the encrypted data packet, they cannot obtain the information contained therein, which further protects the information security of the account.

[0062] Figure 5 A schematic flowchart of a method 500 for maintaining a secure login state according to an embodiment of the present disclosure is shown. Optionally, method 500 may be part of method 200 to better maintain the secure login state of a target account. Method 500 includes steps 510, 520, 530, and 540.

[0063] In step 510, a login request for the target account is received from the second client. The login request includes login credentials. In some embodiments, the login credentials may include the target account's login username and password, or a login mobile phone number and SMS verification code, etc.

[0064] In step 520, the validity of the login credentials is determined. In some embodiments, the server has a database containing login credentials for multiple accounts. Upon receiving login credentials for a target account, the validity of the login credentials can be determined, for example, by matching them with login credentials in the database.

[0065] In step 530, in response to the login credentials being determined to be valid, the target account login state of the first client is terminated. For example, since the received login credentials from the second client are valid, it can be seen that the currently logged-in user (i.e., the second client) is highly likely to be a normal user. Therefore, it is determined that the first client is very likely being used by an abnormal user, and thus the target account login state of the first client is terminated.

[0066] In step 540, in response to the login credentials being determined to be invalid, the login state of the target account on the first client is not terminated. As an example, since the received login credentials from the second client are invalid, it can be seen that the currently logged-in user (i.e., the second client) is highly likely to be an abnormal user. Therefore, it cannot be determined that the first client is being used by an abnormal user, and thus the login state of the target account on the first client is not terminated. Optionally, in response to the login credentials being determined to be invalid, the second client's page can be switched back to the login page.

[0067] In some embodiments, method 500 may further include: in response to the termination of the target account login state of the first client, enabling the target account login state of the second client. As an example, since the received login credentials of the second client are valid, it can be seen that the currently logged-in user (i.e., the second client) is highly likely to be a normal user; therefore, the target account login state of the second client is enabled.

[0068] As can be seen from the above embodiments, method 500 determines whether a client is being used by a legitimate user based on login credentials. Since login credentials (such as the target account and corresponding password) are typically only known to legitimate users, a client logging in with login credentials is highly likely to be used by a legitimate user. Therefore, when a login request for the target account is received from the second client, if the login credentials included in the login request are determined to be valid, it indicates that the second client is highly likely to be a legitimate user attempting to log in, while the first client already logged into the target account is highly likely to be an illegitimate user logging in. The login state of the first client for the target account will be terminated to protect the secure login state of the target account.

[0069] Furthermore, as part of method 200, method 500 can remedy situations where an abnormal user is mistakenly identified as a normal user. For example, due to differences in client versions or the client's failure to send a renewal request in a timely manner, the server might mistake a renewal request from a normal user's client as being from an abnormal user, and vice versa. This would result in the normal user's client being terminated during renewal, while the abnormal user's client remains logged in. After being terminated, the normal user will re-login by entering login information (such as username and password), triggering method 500. After verifying the validity of the normal user's login information, method 500 terminates the abnormal user's client, which is currently logged in, and enables the normal user's login.

[0070] In some embodiments, the client may be unable to effectively maintain a secure login state for the target account due to version differences (e.g., incomplete functionality due to outdated version). This is particularly problematic when the client versions used by normal users and abnormal users differ, making it difficult to effectively maintain a secure login state for the target account. In such cases, methods for maintaining a secure login state according to some embodiments of this disclosure (e.g.) Figure 5 The method 500 shown enables the secure login state of the target account to be maintained across different client versions. For example, it can remedy situations where normal users and abnormal users are incorrectly distinguished due to different client versions. Table 1 illustrates the principle of the method for maintaining a secure login state according to some embodiments of this disclosure, which maintains the secure login state of the target account across different client versions.

[0071] Table 1 Compatibility Table between New and Old Client Versions .

[0072] As shown in Table 1, the client may be unable to effectively maintain the secure login state of the target account due to version limitations (e.g., incomplete functionality due to outdated version). However, in cases where... Figure 5In the method 500 for maintaining a secure login state according to some embodiments of this disclosure, the compatibility problem caused by different client versions is basically solved. Even when the client of a normal user is an older version and the client of an abnormal user is a newer version, method 500 can ultimately maintain a secure target account login state. As shown in the table, in this case, the client of an abnormal user is considered to be in normal use and maintains the target account login state, while the client of a normal user is considered to be in use by an abnormal user and terminates the target account login state. At this time, the normal user will log in using login credentials (such as username and password) to trigger method 500. After receiving the login request from the client of a normal user and verifying the validity of its login credentials, method 500 will terminate the target account login state of the client of the abnormal user and enable the target account login state of the client of the normal user, thus remedying the situation where the normal user and the abnormal user are mistakenly distinguished due to different client versions.

[0073] As an example, a normal user's client might not send a renewal request for an extended period due to network connectivity issues or other reasons. This could lead to an abnormal user's client being identified as a normal user and kept logged in, while a normal user's client being identified as an abnormal user and its login status terminated. In this case, a normal user can log in using login credentials (such as username and password) after their client's login status is terminated. Method 500, upon receiving a login request from a normal user's client and verifying the validity of its login credentials, terminates the login status of the abnormal user's client and enables the login status of the normal user's client, thus remedying the situation where the client fails to send a renewal request in a timely manner, resulting in the incorrect differentiation between normal and abnormal users.

[0074] In some embodiments, during execution Figure 2 Before step 210 of method 200, i.e., before receiving the target account login status renewal request from the first client, the first client can be monitored in real time, including: real-time monitoring of the target account login status of the first client; in response to detecting that the target account login status of the first client has reached or exceeded a predetermined renewal time, sending a login status renewal prompt to the first client; and in response to not receiving a login status renewal request from the first client within a predetermined time period starting from the predetermined renewal time, terminating the target account login status of the first client. As an example, one or more clients can be monitored in real time, and if the target account login status of a client is detected to have reached or exceeded a predetermined renewal time, a login status renewal prompt is sent to that client. If no login status renewal request is received from the client within a predetermined time period starting from the predetermined renewal time, for example, if the client does not respond for a long time, the target account login status of that client is terminated.

[0075] Figure 6The illustration shows a schematic diagram of a method for maintaining a secure login state according to an embodiment of the present disclosure. Figure 6 Client A can act as the first client, and client B can act as the second client. Optionally, clients A and B can be deployed in... Figure 1 On terminal 120 or 130. The backend can be deployed on... Figure 1 On server 110.

[0076] like Figure 6 As shown, the background credentials include a key Skey, a first background credential TicketNewest, and a second background credential TicketAck. Clients A and B each possess a renewal credential Ticket and the corresponding key Skey. Using two background credentials (i.e., the first background credential TicketNewest and the second background credential TicketAck) effectively prevents the background from mistakenly using a legitimate user's client as an abnormal user due to network anomalies or other reasons.

[0077] All communication between the backend and the client is encrypted. This means that encrypted data packets are sent or received, and the data packets are decrypted using the key Skey to obtain information such as renewal credentials. This provides better protection for user information security. Communication between the backend and the client can use common communication protocols and interfaces; no restrictions are placed here.

[0078] Initially, the backend, client A, and client B are all in state one. In this state, client A's ticket is T1, client B's ticket is also T1, and the backend's TicketNewest is T1 and TicketAck is T0. It is evident that client A and client B have the same renewal credentials and keys. This is likely because one of client A and client B is a legitimate user, while the other is an abnormal user. That is, the abnormal user obtained the legitimate user's key and renewal credentials.

[0079] First, client A initiates a renewal request for the target account to the backend. After verifying that client A's Ticket (T1) is the same as its own TicketNewest (T1), the backend determines that client A's renewal credential is valid. In response to the validity of the renewal credential, the backend generates a new T2 to update TicketNewest, updates TicketAck with the newly received renewal credential T1, and generates a new key S1 to update Skey. At this point, the backend enters the second state and sends TicketNewest (T2) to client A, which issued the renewal request, to update client A's Ticket.

[0080] Then, the backend, in its second state, receives a renewal request from client B. After verifying that client B's Ticket (T1) is the same as its own TicketAck (T1), the backend determines that client B's renewal credential is valid. In response to the validity of the renewal credential, the backend generates a new T3 to update TicketNewest, updates TicketAck with the newly received renewal credential T1, and generates a new key S3 to update Skey. At this point, the backend enters the third state and sends TicketNewest (T3) to client B, which issued the renewal request, to update client B's Ticket.

[0081] Then, the backend, in its third state, receives a renewal request from client A. Upon verification, the backend finds that client A's Ticket (T2) is different from its own TicketNewest (T3) and TicketAck (T1), determining that client B's renewal credentials are invalid. In response to the invalid renewal credentials, the backend terminates client A's login state, and client A's interface is redirected to the login page. At this point, if client A is an abnormal user, it cannot log in on the login page because it lacks login credentials such as an account and password. If client A is a normal user, it can log in on the login page using login credentials such as an account and password. In response to the valid login credentials, the backend terminates client B's login state and enables client A's login state, effectively kicking out the abnormal user. Therefore, Figure 6 The method shown can effectively identify whether there are users other than normal users currently logged into the target account, and can effectively kick out users other than normal users (such as abnormal users), thus protecting the information security of the target account.

[0082] In practical applications, Figure 6 The method described can monitor the dual-account activity of a target account in real time to counter malicious activities. This technical solution has been successfully applied to the login process of the developed software. Currently, monitoring shows that approximately 6,000 to 10,000 malicious users (such as abnormal users) are blocked daily, and dual-account activity has also been confirmed through user request behavior analysis. This method has been in use for several months, and during this time, the false positive rate for legitimate users has been virtually zero, achieving efficient and accurate protection of the target account's secure login state.

[0083] Figure 7 An exemplary structural block diagram 700 of a device for maintaining a secure login state according to an embodiment of the present disclosure is shown. Figure 7 As shown, the device 700 for maintaining a secure login state includes a receiving module 710, a determining module 720, an updating module 730, and a sending module 740.

[0084] The receiving module 710 is configured to receive a login status renewal request for a target account from a first client. The login status renewal request includes renewal credentials. As an example, the renewal request can be initiated periodically by the client to the server to maintain the login status of the target account on the client. Alternatively, the server can send a renewal prompt to the client to urge the client to initiate a renewal request. Optionally, the renewal request can be sent via a common communication interface or protocol. In some embodiments, the receiving module 710 may include a common communication interface or protocol to receive the login status renewal request for the target account. Optionally, the renewal request containing renewal credentials received by the receiving module can be encrypted before being sent to better protect account information security.

[0085] The determination module 720 is configured to determine the validity of a renewal certificate based on baseline certificate information for the target account. In some embodiments, the determination module 720 can determine the validity of the renewal certificate by comparing the baseline certificate information with the renewal certificate. For example, if the baseline certificate information contains the same information as the renewal certificate, the determination module 720 can determine that the renewal certificate is valid. In some embodiments, the baseline certificate information may include a first baseline certificate and a second baseline certificate, the second baseline certificate being a supplementary baseline certificate to the first baseline certificate and matching the most recently received valid renewal certificate before the first baseline certificate was generated. As an example, the determination module 720 can determine the validity of the renewal certificate based on whether the renewal certificate matches at least one of the first and second baseline certificates. For example, if the renewal certificate is the same as the first baseline certificate, the determination module 720 determines that the renewal certificate is valid. If the renewal certificate is different from the first baseline certificate but the same as the second baseline certificate, the determination module determines that the renewal certificate is valid. If the renewal certificate is different from both the first and second baseline certificates, the determination module determines that the renewal certificate is invalid.

[0086] The update module 730 is configured to update the base certificate information in response to a renewal certificate being determined to be valid. As an example, the update module 730 may generate new base certificate information and replace the original base certificate information with it, or use it as a supplement to the original base certificate information. In some embodiments, the base certificate information may include a first base certificate and a second base certificate, the second base certificate being a supplementary base certificate to the first base certificate and matching the most recently received valid renewal certificate before the generation of the first base certificate. As an example, the update module 730 will generate a new first base certificate and replace the original first base certificate with it. For example, in response to a renewal certificate being determined to be valid, the update module 730 will generate a new first base certificate and replace the original first base certificate with this new first base certificate. Also, in response to a renewal certificate being determined to be valid, the update module 730 will use the received renewal certificate as a new second base certificate to replace the original second base certificate.

[0087] The sending module 740 is configured to send at least a portion of the updated base credential information to the first client to update the renewal credential in response to an update of the base credential information. As an example, the sending module 740 may send a portion of the updated base credential information to the first client as a new renewal credential for use by the first client when it initiates a renewal request next time. In some embodiments, after the receiving module 710 receives a target account login-state renewal request containing the renewal credential from the first client, the determining module 720 determines whether the received renewal credential is valid by comparing whether it is the same as the first base credential or the second base credential. If the received renewal credential is valid, the updating module 730 generates a new first base credential to replace the original first base credential to update the first base credential, and uses the received renewal credential as the new second base credential. The sending module 740 sends the generated new first base credential to the first client as the renewal credential for the first client's next renewal application.

[0088] In some embodiments, the baseline credential information in the device 700 includes a first baseline credential and a second baseline credential. The first baseline credential is the most recently generated baseline credential, and the second baseline credential matches the most recently received valid renewal credential before receiving the target account login status renewal request from the first client.

[0089] For example, the determining module 720 may determine that the renewal document is valid in response to at least one of the first and second base documents matching the renewal document. The determining module 720 may also determine that the renewal document is invalid in response to neither the first nor the second base document matching the renewal document. As an example, if the first base document is the same as the renewal document, the determining module 720 may determine that the renewal document is valid. If neither the first nor the second base document is the same as the renewal document, the determining module 720 may determine that the renewal document is invalid.

[0090] In some embodiments, the update module 730 may update the first base document and update the second base document to a renewal document in response to a match between the first base document and the renewal document. Also, the update module 730 may update the first base document in response to a match between the second base document and the renewal document. As an example, if the first base document and the renewal document are the same, the update module 730 may update the first base document and update the second base document to a renewal document. If the second base document and the renewal document are the same, the update module 730 may update the first base document.

[0091] In some embodiments, the sending module 740 may send the updated first base certificate to the first client to update the renewal certificate in response to the first base certificate being updated.

[0092] In some embodiments, the base credential information in device 700 may further include a renewal request encryption key. For example, device 700 may communicate with clients, servers, etc., via encrypted communication. Furthermore, data transmission between the receiving module 710, determining module 720, updating module 730, sending module 740, etc., may also be performed via encrypted communication.

[0093] In some embodiments, the update module 730 may update the first base credential and the renewal request encryption key in response to the renewal credential being determined to be valid. As an example, the encryption method of the encrypted communication can be continuously updated, and therefore the corresponding encryption key will also be updated accordingly. The sending module 740 may send the updated first base credential and the updated renewal request encryption key to the first client in response to the update of the first base credential and the renewal request encryption key, for use in updating the renewal credential and subsequent target account login state renewal request encryption. By continuously updating the encryption method and corresponding key of the encrypted communication, even if an abnormal user obtains the encrypted data packet, they will not be able to access the information contained within it, which further protects the account's information security.

[0094] Figure 8 The illustration depicts an example system 800, which includes an example computing device 810 representing one or more systems and / or devices that can implement the various technologies described herein. The computing device 810 may be, for example, a server of a service provider, a device associated with a server, a system-on-a-chip, and / or any other suitable computing device or computing system. (Refer to above) Figure 5 The described device 700 for maintaining a secure login state can take the form of a computing device 810. Alternatively, the device 700 for maintaining a secure login state can be implemented as a computer program in the form of an application 816.

[0095] The example computing device 810 shown includes a processing system 811, one or more computer-readable media 812, and one or more I / O interfaces 813, all communicatively coupled to each other. Although not shown, the computing device 810 may also include a system bus or other data and command transfer system that couples the various components to each other. The system bus may include any or a combination of different bus architectures, such as a memory bus or memory controller, a peripheral bus, a universal serial bus, and / or a processor or local bus utilizing any of these various bus architectures. Various other examples, such as control and data lines, are also conceived.

[0096] Processing system 811 represents the functionality of performing one or more operations using hardware. Therefore, processing system 811 is illustrated as including hardware elements 814 that can be configured as processors, function blocks, etc. This may include application-specific integrated circuits (ASICs) or other logic devices formed using one or more semiconductors in the hardware. Hardware element 814 is not limited by the materials in which it is formed or the processing mechanism employed therein. For example, a processor may consist of semiconductors and / or transistors (e.g., integrated circuits (ICs)). In such a context, processor-executable instructions may be electronically executable instructions.

[0097] Computer-readable medium 812 is illustrated as including memory / storage device 815. Memory / storage device 815 represents a memory / storage capacity associated with one or more computer-readable media. Memory / storage device 815 may include volatile media (such as random access memory (RAM)) and / or non-volatile media (such as read-only memory (ROM), flash memory, optical disk, magnetic disk, etc.). Memory / storage device 815 may include fixed media (e.g., RAM, ROM, fixed hard disk drive, etc.) and removable media (e.g., flash memory, removable hard disk drive, optical disk, etc.). Computer-readable medium 812 may be configured in various other ways as further described below.

[0098] One or more I / O interfaces 813 represent functions that allow users to input commands and information to the computing device 810 using various input devices and optionally also allow information to be presented to the user and / or other components or devices using various output devices. Examples of input devices include keyboards, cursor control devices (e.g., mice), microphones (e.g., for voice input), scanners, touch functionality (e.g., capacitive or other sensors configured to detect physical touch), cameras (e.g., capable of detecting non-touch-related motion as gestures using visible or invisible wavelengths (such as infrared frequencies), etc. Examples of output devices include display devices, speakers, printers, network interface cards, haptic-responsive devices, etc. Therefore, the computing device 810 can be configured to support user interaction in various ways as further described below.

[0099] The computing device 810 also includes an application 816. The application 816 may be, for example, a software instance of the means 700 for maintaining a secure login state, and may be used in combination with other elements in the computing device 810 to implement the techniques described herein.

[0100] This document describes various technologies within the general context of software and hardware components or program modules. Generally, these modules include routines, programs, objects, elements, components, data structures, etc., that perform specific tasks or implement specific abstract data types. As used herein, the terms "module," "function," and "component" generally refer to software, firmware, hardware, or a combination thereof. The technologies described herein are characterized as platform-independent, meaning that these technologies can be implemented on a variety of computing platforms with various processors.

[0101] Implementations of the described modules and technologies may be stored on or transmitted across some form of computer-readable medium. The computer-readable medium may include a variety of media accessible by the computing device 810. By way of example and not limitation, the computer-readable medium may include "computer-readable storage media" and "computer-readable signal media".

[0102] In contrast to simple signal transmission, carrier waves, or signals themselves, a "computer-readable storage medium" refers to a medium and / or device capable of persistently storing information, and / or a tangible storage device. Therefore, a computer-readable storage medium refers to a non-signal-bearing medium. Computer-readable storage media include hardware such as volatile and non-volatile, removable and non-removable media and / or storage devices implemented using methods or techniques suitable for storing information (such as computer-readable instructions, data structures, program modules, logic elements / circuits, or other data). Examples of computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage devices, hard disks, cassette tapes, magnetic tapes, disk storage devices or other magnetic storage devices, or other storage devices, tangible media, or articles of art suitable for storing desired information and accessible by a computer.

[0103] "Computer-readable signal medium" refers to a signal-bearing medium configured to transmit instructions, such as via a network, to computing device 810. A signal medium typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave, data signal, or other transmission mechanism. Signal media also include any information transmission medium. The term "modulated data signal" refers to a signal in which one or more of its characteristics are set or altered to encode information. By way of example and not limitation, communication media include wired media such as wired networks or direct connections, and wireless media such as acoustic, RF, infrared, and other wireless media.

[0104] As previously described, hardware element 814 and computer-readable medium 812 represent instructions, modules, programmable device logic, and / or fixed device logic implemented in hardware, which in some embodiments can be used to implement at least some aspects of the techniques described herein. Hardware elements may include components of integrated circuits or systems-on-a-chip, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations or other hardware devices in silicon. In this context, hardware elements can serve as processing devices for executing program tasks defined by instructions, modules, and / or logic embodied by the hardware element, and as hardware devices for storing instructions for execution, such as the previously described computer-readable storage medium.

[0105] The foregoing combinations can also be used to implement the various techniques and modules described herein. Therefore, software, hardware, or program modules and other program modules can be implemented as one or more instructions and / or logic embodied on some form of computer-readable storage medium and / or by one or more hardware elements 814. The computing device 810 can be configured to implement specific instructions and / or functions corresponding to the software and / or hardware modules. Thus, for example, by using the computer-readable storage medium and / or hardware elements 814 of a processing system, modules can be implemented at least partially in hardware as modules executable as software by the computing device 810. Instructions and / or functions can be executable / operable by one or more articles of art (e.g., one or more computing devices 810 and / or processing systems 811) to implement the techniques, modules, and examples described herein.

[0106] In various embodiments, the computing device 810 can be configured in various ways. For example, the computing device 810 can be implemented as a computer-type device, including personal computers, desktop computers, multi-screen computers, laptop computers, netbooks, etc. The computing device 810 can also be implemented as a mobile device-type device, including mobile devices such as mobile phones, portable music players, portable gaming devices, tablet computers, multi-screen computers, etc. The computing device 810 can also be implemented as a television-type device, including devices with or connected to a generally large screen in a leisure viewing environment. These devices include televisions, set-top boxes, game consoles, etc.

[0107] The techniques described herein can be supported by these various configurations of computing device 810, and are not limited to specific examples of the techniques described herein. Functionality can also be implemented, wholly or partially, on the “cloud” 820 using distributed systems, such as through platform 822 as described below.

[0108] Cloud 820 includes and / or represents platform 822 for resource 824. Platform 822 abstracts the underlying functionality of the hardware (e.g., server) and software resources of cloud 820. Resource 824 may include applications and / or data that can be used when performing computer processing on a server located remotely from computing device 810. Resource 824 may also include services provided via the Internet and / or via subscriber networks such as cellular or Wi-Fi networks.

[0109] Platform 822 can abstract resources and functions to connect computing device 810 to other computing devices. Platform 822 can also be used to abstract resource hierarchy to provide a tiered hierarchy of the appropriate level of demand for resource 824 implemented via platform 822. Therefore, in interconnect device embodiments, the implementation of the functions described herein can be distributed throughout system 800. For example, functions can be implemented partly on computing device 810 and partly through platform 822, which abstracts the functions of cloud 820.

[0110] This disclosure provides a computer-readable storage medium having computer-readable instructions stored thereon, which, when executed, implement the above-described method for maintaining a secure login state of a target account.

[0111] This disclosure provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computing device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computing device to perform the methods provided in the various optional implementations above for maintaining a secure login state of a target account.

[0112] It should be understood that, for clarity, embodiments of this disclosure have been described with reference to different functional units. However, it will be apparent that, without departing from this disclosure, the functionality of each functional unit may be implemented in a single unit, in multiple units, or as part of other functional units. For example, functionality described as being performed by a single unit may be performed by multiple different units. Therefore, references to a particular functional unit are considered merely as references to the appropriate unit used to provide the described functionality, and not as indicating a strict logical or physical structure or organization. Thus, this disclosure may be implemented in a single unit, or may be physically and functionally distributed among different units and circuits.

[0113] It will be understood that although the terms first, second, third, etc., may be used herein to describe various devices, elements, components, or parts, these devices, elements, components, or parts should not be limited by these terms. These terms are used only to distinguish one device, element, component, or part from another device, element, component, or part.

[0114] Although this disclosure has been described in conjunction with some embodiments, it is not intended to be limited to the specific forms set forth herein. Rather, the scope of this disclosure is limited only by the appended claims. Additionally, although individual features may be included in different claims, these may be advantageously combined, and inclusion in different claims does not imply that such a combination of features is not feasible and / or advantageous. The order of features in the claims does not imply that the features must be in any particular order of their operation. Furthermore, in the claims, the word "comprising" does not exclude other elements, and the terms "a" or "an" do not exclude a plurality. Reference numerals in the claims are provided only by way of explicit example and should not be construed as limiting the scope of the claims in any way.

[0115] It is understood that the specific embodiments of this application involve user login data such as usernames and passwords. When the embodiments of this application involving such data are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

Claims

1. A method for maintaining a secure login state, characterized in that, include: Receive a target account login status renewal request from the first client, the target account login status renewal request including renewal credentials; The validity of the renewal certificate is determined based on the baseline credential information of the target account. In response to the renewal certificate being determined to be valid, the base certificate information is updated; In response to the updating of the baseline certificate information, at least a portion of the updated baseline certificate information is sent to the first client to update the renewal certificate; The benchmark credential information includes a first benchmark credential and a second benchmark credential. The second benchmark credential is a supplementary benchmark credential to the first benchmark credential and matches the latest valid renewal credential received before receiving the target account login status renewal request from the first client. The step of determining the validity of the renewal certificate based on the baseline certificate information of the target account includes: in response to the renewal certificate matching the first baseline certificate, the renewal certificate is determined to be valid; in response to the renewal certificate not matching the first baseline certificate but matching the second baseline certificate, the renewal certificate is determined to be valid; in response to the renewal certificate not matching either the first baseline certificate or the second baseline certificate, the renewal certificate is determined to be invalid. The step of updating the base certificate information in response to the renewal certificate being determined to be valid includes: updating the first base certificate in response to the renewal certificate being determined to be valid; The step of sending at least a portion of the updated base certificate information to the first client to update the renewal certificate in response to the updated base certificate information includes: sending the updated first base certificate to the first client to update the renewal certificate in response to the updated first base certificate information.

2. The method according to claim 1, wherein, The response to the renewal certificate being determined to be valid, updating the base certificate information, further includes: In response to the renewal certificate matching the first base certificate, the second base certificate is updated to the renewal certificate.

3. The method according to claim 2, wherein, The baseline credential information further includes a renewal request encryption key.

4. The method according to claim 3, wherein, The response to the renewal certificate being determined to be valid, updating the base certificate information, includes: In response to the renewal certificate being determined to be valid, the first base certificate and the renewal request encryption key are updated, and The step of responding to the update of the baseline certificate information by sending at least a portion of the updated baseline certificate information to the first client to update the renewal certificate includes: In response to the update of the first base credential and the renewal request encryption key, the updated first base credential and the updated renewal request encryption key are sent to the first client for use in updating the renewal credential and encrypting subsequent target account login state renewal requests, respectively.

5. The method according to any one of claims 1-4, further comprising: In response to the renewal certificate being determined to be invalid, the login state of the target account on the first client is terminated.

6. The method according to any one of claims 1-4, further comprising: Receive a login request for the target account from the second client, the login request including login credentials; Determine the validity of the login credentials; In response to the login credentials being determined to be valid, the login state of the target account on the first client is terminated.

7. The method of claim 6, further comprising: In response to the termination of the target account login state of the first client, the target account login state of the second client is enabled.

8. The method according to claim 1, wherein, Before receiving the target account login status renewal request from the first client, the method further includes: Real-time monitoring of the target account login status of the first client; In response to detecting that the login status of the target account on the first client has reached or exceeded the predetermined renewal time, a login status renewal prompt is sent to the first client; If no login status renewal request is received from the first client within a predetermined time period starting from the predetermined renewal time, the login status of the target account on the first client is terminated.

9. A device for maintaining a secure login state, characterized in that, include: A receiving module is configured to receive a target account login status renewal request from a first client, the target account login status renewal request including renewal credentials; A determination module is configured to determine the validity of the renewal certificate based on the baseline credential information of the target account; The update module is configured to update the base certificate information in response to the renewal certificate being determined to be valid; A sending module is configured to send at least a portion of the updated base credential information to the first client in response to the base credential information being updated, so as to update the renewal credential. The benchmark credential information includes a first benchmark credential and a second benchmark credential. The second benchmark credential is a supplementary benchmark credential to the first benchmark credential and matches the latest valid renewal credential received before receiving the target account login status renewal request from the first client. Furthermore, the determining module is configured to determine that the renewal certificate is valid if it is the same as the first base certificate; determine that the renewal certificate is valid if it is different from the first base certificate but the same as the second base certificate; and determine that the renewal certificate is invalid if it is different from both the first base certificate and the second base certificate. The update module is configured to generate a new first base certificate in response to the renewal certificate being determined to be valid, and replace the original first base certificate with the new first base certificate. The sending module is configured to send a new first base certificate to the first client as a renewal certificate for the first client's next renewal application if the first base certificate is replaced.

10. The apparatus according to claim 9, characterized in that, The baseline credential information further includes a renewal request encryption key.

11. The apparatus according to claim 10, characterized in that, The update module is configured to update the first base certificate and the renewal request encryption key in response to the renewal certificate being determined to be valid. The sending module is configured to send the updated first base credential and the updated renewal request encryption key to the first client in response to the update of the first base credential and the renewal request encryption key, so as to update the renewal credential and subsequent target account login state renewal request encryption.

12. A computing device, comprising: Memory configured to store computer-executable instructions; A processor configured to perform the method according to any one of claims 1-8 when the computer-executable instructions are executed by the processor.

13. A computer-readable storage medium storing computer-executable instructions that, when executed, perform the method according to any one of claims 1-8.

14. A computer program product comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, perform the method according to any one of claims 1-8.

Images