User account login security protection method and system

Abstract

This invention discloses a user account login security protection method. The server can authenticate login requests and prevent the client from logging in using account and password information remembered by the browser or illegally obtained. This can effectively eliminate the harm caused by account and password leakage and improve the security of application systems.

Description

Technical Field

[0001] The present invention relates to the field of network information technology, and in particular to a user account login security protection method and system. Background Art

[0002] With the continuous development of information technology, the use of computer systems for business management and data management has become the norm. A large amount of important data and information are stored in computers and become the most valuable information assets. In the field of network and information security, passwords play an increasingly important role in ensuring information security. To ensure that data security in information systems reaches a certain level of security protection, information systems must have effective identity authentication methods and access control mechanisms. Identity authentication is the basic content in the field of information system security, the first line of defense for information systems, and the basis for other security services such as access control. The most commonly used method of identity authentication is the combination of identity identification (account) + password (static password or dynamic password). With the continuous development of information technology and Web (World Wide Web) technology, more and more application systems have adopted the B / S (Browser / Server) architecture. In information systems with high security requirements, there are strict requirements on the length and complexity of static passwords. Static passwords are usually required to be a combination of uppercase and lowercase letters, numbers, and special characters of more than 8 characters, which increases the difficulty of relying on the human brain to remember passwords. Browsers all provide a memory function, and users will use this function to remember account numbers and passwords to avoid entering complex passwords every time. By letting the browser remember the account and password, users do not need to enter the user name and complex password every time they use the system. This brings convenience to users, but also brings serious security risks: 1. Once the computer is controlled by someone, the account and password information remembered by the browser can be viewed, resulting in the leakage of account and password information. 2. Anyone can use illegally obtained account and password information to log in to the information system, resulting in the leakage of sensitive data and information, and even the damage of sensitive data. How to prevent the use of account and password information remembered by the browser or illegally obtained to log in is an urgent problem to be solved in the IT and software development related technical fields. Summary of the invention

[0003] The present invention provides a user account login security protection method, in which a server can authenticate login requests and does not allow a client to log in using account and password information memorized by a browser or obtained illegally, thereby effectively eliminating the hazards caused by account and password leakage and improving the security of the application system.

[0004] The present invention is achieved through the following technical solutions:

[0005] A user account login security protection method comprises the steps of:

[0006] Monitor the user's keyboard key operations and store each user's keystroke event as a key-value combination sequence; the keystroke event includes the keystroke operation performed by the user and the time, wherein each key on the keyboard has a preset value, and each keystroke by the user will assign a value to the key-value combination sequence;

[0007] Verify whether the key-value combination sequence conforms to the preset interval, mark the key-value combination sequence that does not conform to the preset interval as a first exception, and provide feedback to the client;

[0008] Each key-value combination sequence that meets the preset interval is read cyclically. When the last typing event ends, all its sequences are converted into visible characters, and the time interval between each typing event is recorded from time to time to generate the temporary behavior characteristics of the user;

[0009] Compare the key-value combination sequence with the preset sequence to determine the consistency of user behavior; if the behavior consistency is not met, a second exception mark is made and feedback is given to the client; if it is met, a consistency mark is generated and the temporary behavior characteristics of the user in the database are updated;

[0010] Compare the string with the preset password to determine the consistency of the user password; if the password consistency is not met, generate a third abnormal mark and feedback on the client; if it is met, generate a password consistency mark;

[0011] Perform identity legitimacy detection on case operations with password consistency marks, including: after reading the user account password, extracting the user's historical behavior characteristics from the database, and comparing the differences between temporary behavior characteristics and historical behavior characteristics.

[0012] As an optional method, the value of the key-value combination sequence includes the value of the auxiliary key, key value and time. The end mark of the monitoring event of any key-value combination sequence is the completion of the key value input; the start mark of the monitoring event of any key-value combination sequence is the program initialization start and / or the end of the previous key-value combination sequence event monitoring.

[0013] As an optional method, in the key value combination sequence, the preset value of pressing the auxiliary key is 1, and the initial value is 0; the key value is cached through ASCII code, and the value range of time is 0-59.

[0014] As an optional method, in the step of verifying the key value combination sequence, the preset interval includes:

[0015] Whether the key value of any key-value combination sequence is empty and / or is in the ASCII code table;

[0016] Whether the time of any key-value combination sequence is empty and / or greater than 59.

[0017] As an optional method, the recording of temporary behavior characteristics includes: recording the key-value combination sequence of each operation typed by the user in the current login operation, cyclically reading each key-value combination sequence in the login operation before the user clicks the login option, extracting the time value in each sequence, and arranging and recording them in sequence according to the input order.

[0018] As an optional method, a string comparison is performed between the key-value combination sequence and a preset sequence to determine whether there is a logical anomaly in the user's typing feature, and the logical anomaly includes whether the value of the auxiliary key is positively correlated with the ASCII code of the key value.

[0019] As an optional method, before performing password consistency check, the key values ​​in the key value combination sequence are converted into visible characters, and the visible characters are compared with the preset password; wherein, during the conversion process, if the visible characters are non-preset keyboard characters, they are discarded.

[0020] As an optional method, when performing password consistency detection, the client identifier corresponding to the user keyboard sequence is also detected.

[0021] As an optional method, identity legitimacy is used to detect whether the difference between the number of occurrences of the third abnormal mark in the user's temporary behavior characteristics, the value of the time in each key-value combination sequence, and the number of occurrences of the third abnormal mark in the historical behavior characteristics, the value of the time in each key-value combination sequence meets the preset range.

[0022] In another aspect, the present invention provides a user account login security protection system, comprising:

[0023] The client keyboard event processing module is used to collect and record the user's login operations and typing events;

[0024] A key event recording module, wherein the key event detection module is used to verify whether the key value combination sequence conforms to a preset interval and generate a first abnormality mark;

[0025] Exception handling module, which is used to perform exception judgment when performing string comparison;

[0026] A data conversion module, the data conversion module is used to convert the visible characters;

[0027] Data comparison module, the data comparison module is used to determine the consistency of user behavior;

[0028] A consistency check module, which is used to determine the text consistency between visible characters and a preset password;

[0029] The identity legitimacy detection module is used to make a differentiated comparison between the user's temporary behavior characteristics and the user's historical behavior characteristics.

[0030] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0031] 1. Use the client's key event related information as a prerequisite for identity authentication to prevent non-personal login using browser memory data or illegally obtained account passwords.

[0032] 2. The server sets corresponding key event parsing rules, infers the client's behavior characteristics based on the key interval duration feature information, screens possible machine or script login behaviors, and improves system security. DETAILED DESCRIPTION

[0033] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0034] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0035] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0036] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0037] A person of ordinary skill in the art can understand that all or part of the steps in realizing the above-mentioned facts and methods can be completed by instructing the relevant hardware through a program, and the program involved or the program described can be stored in a computer-readable storage medium. When the program is executed, it includes the following steps: At this time, the corresponding method steps are derived, and the storage medium can be ROM / RAM, a disk, an optical disk, etc.

[0038] Example 1

[0039] This embodiment provides a user account login security protection method, including two parts: a user terminal (client) and a server. The user terminal may include a Client of a C / S (Client / Server) architecture and a Browser of a B / S (Browser / Server) architecture. This embodiment requires that the client monitor and record the keyboard event information that occurs in the password input box (any content is displayed as an asterisk * or other specified special characters), and transmit the keyboard event information to the server. The server parses the keyboard event information and determines the validity of the keyboard event information. Identity authentication can be performed only after verification. In a specific implementation, the keyboard event information can be sent all at once or in batches. This embodiment is implemented as follows:

[0040] The client monitors the user's keyboard key operations and stores each user's keystroke event as a key-value combination sequence; the keystroke event includes the keystroke operation performed by the user and the time, wherein each key on the keyboard has a preset value, and each keystroke operation by the user will assign a value to the key-value combination sequence;

[0041] Verify whether the key-value combination sequence conforms to the preset interval, mark the key-value combination sequence that does not conform to the preset interval as a first exception, and provide feedback to the client;

[0042] Each key-value combination sequence that meets the preset interval is read cyclically. When the last typing event ends, all its sequences are converted into visible characters, and the time interval between each typing event is recorded from time to time to generate the temporary behavior characteristics of the user;

[0043] Compare the key-value combination sequence with the preset sequence to determine the consistency of user behavior; if the behavior consistency is not met, a second exception mark is made and feedback is given to the client; if it is met, a consistency mark is generated and the temporary behavior characteristics of the user in the database are updated;

[0044] Compare the string with the preset password to determine the consistency of the user password; if the password consistency is not met, generate a third abnormal mark and feedback on the client; if it is met, generate a password consistency mark;

[0045] Perform identity legitimacy detection on case operations with password consistency marks, including: after reading the user account password, extracting the user's historical behavior characteristics from the database, and comparing the differences between temporary behavior characteristics and historical behavior characteristics.

[0046] In this embodiment, the value of the key value combination sequence includes the value of the auxiliary key, the key value and the time. The end mark of the monitoring event of any key value combination sequence is the completion of the key value input; the start mark of the monitoring event of any key value combination sequence is the program initialization start and / or the end of the monitoring of the previous key value combination sequence event. Optionally, the auxiliary keys are "Alt", "CapsLock", "Ctrl", "Shift" (can also be set according to the actual usage scenario, this embodiment is not limited). The state value of the auxiliary key is defined as 0 for not pressed and 1 for pressed. Moreover, the key value of this embodiment is cached via ASCII code. Therefore, for any key value combination sequence, this embodiment uses special visible characters such as curly braces or quotation marks to mark the start and end, including the state value of the auxiliary key, the combination of the key value and the time. For example, in a complete keyboard event, the user enters the character "A", then the key value combination sequence is expressed as {0,1,0,0,65,00}. The first four items correspond to the state values ​​of the auxiliary keys, the fifth item is the ASCII code of the key value typed, and the sixth item is the interval time (unit: seconds). The time value range is 0-59 (unit: seconds).

[0047] After the front-end page is loaded, the historical data will be cleared first, and then the keyboard event information from the client will be received. After receiving, first determine whether the sequence meets the preset interval, which refers to the length of the key value combination sequence, the character ASCII value range corresponding to the sequence value, etc. For example, generally, only keyboard sequences that can be parsed into visible characters are valid. In this way, when the user enters Chinese, garbled characters, non-standard characters and letters, they will not be involved in the verification. And as a conventional password input scenario, the input interval between any characters should not exceed 1 minute, or the time interval between non-first and last characters and the previous character is 0, which does not conform to the normal user's input habits, and can be judged as a copy input, which affects the user's login security. In this embodiment, the first abnormal mark is used to prompt the user to enter the correct value, which can be expressed in the client pop-up window as: "Please enter letters, numbers or special symbols" to prompt the user.

[0048] Considering the security of another user's input habits, this embodiment uses a method of recording user behavior characteristics to judge manual input and machine and script input. The behavior characteristic record includes: recording the key value combination sequence of each key-typed operation in the user's current login operation, cyclically reading each key value combination sequence in the login operation before the user clicks the login option, extracting the value of the time in each sequence, and arranging and recording it in sequence according to the input order. That is, the user's input habits are obtained. After that, a consistency test is performed, and the consistency test is performed by comparing the user's current input habits, that is, the temporary behavior characteristics with the historical behavior characteristics in the database. The comparison includes two aspects. First, whether the value of the auxiliary key is positively correlated with the ASCII code of the key value. For example, when entering any capital letter, the value of the auxiliary key CapsLock should be 1, otherwise it cannot enter the capital letter without using the auxiliary key, and it will be judged as a copy input. For another example, when entering the underscore "_", the key value of the auxiliary key shift should be 1, that is, the state that the user has pressed, and it is the previous position of the underscore. In this way, it can be judged as manual input. After completing the ASCII value verification, for registered users, it is also necessary to verify whether the user's key value input interval matches the key value input interval in the historical input, that is, to compare the last time element in the key value combination sequence to determine whether the difference in the matching degree exceeds the average difference of the comprehensive users or their personal historical difference. The second abnormal mark is used to prompt the user that the input does not conform to the manual input habits, and a pop-up window prompt can be displayed on the client: "Please do not copy the password for input."

[0049] When the consistency check is completed, a consistency flag is generated and saved in the buffer, and the user's current temporary behavior characteristics are updated to the database and added to the user's historical behavior feature set. Begin character conversion. Convert the ASCII value in each key value sequence into a machine-visible character, match it with the password in the database, and determine the accuracy of the user's password input. During the conversion process, if a visible character is not a preset keyboard character, it should be discarded. At the same time, when performing the detection of this step, it is also necessary to determine the client identifier corresponding to the user's keyboard sequence to distinguish whether the character input comes from different user terminals. The third exception mark is to remind the user to re-enter the password on the client side when an error occurs in the password input.

[0050] After completing the password verification, the user's identity legitimacy needs to be tested, and the user's behavior characteristics and password accuracy are combined to determine whether the login is a script or machine login. This includes testing whether the difference between the number of occurrences of the third abnormal mark in the user's temporary behavior characteristics, the value of the time in each key-value combination sequence, and the number of occurrences of the third abnormal mark in the historical behavior characteristics, and the value of the time in each key-value combination sequence meets the preset range.

[0051] In this way, the method described in this embodiment can effectively prevent users from submitting password information memorized by the browser or automatically filled in for identity authentication, prevent login attacks by robots, and timely predict abnormal login behaviors based on the time characteristics of the client keystroke events to prevent illegal logins, thereby improving user login security.

[0052] Example 2

[0053] The present embodiment provides a user account login security protection system, which is used to execute a user account login security protection method described in the above-mentioned embodiment 1, including: a client keyboard event processing module, which is used to collect and record the user's login operations and typing events; a key event recording module, which is used to record the key event detection module to verify whether the key value combination sequence conforms to the preset interval and generate a first exception mark; an exception handling module, which is used to perform exception judgment when performing string comparison; a data conversion module, which is used to convert visible characters; a data comparison module, which is used to judge the consistency of user behavior; a consistency verification module, which is used to judge the text consistency of visible characters and preset passwords; an identity legitimacy detection module, which is used to perform differentiated comparisons between user temporary behavior characteristics and user historical behavior characteristics.

[0054] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A user account login security protection method, characterized in that: Includes steps: Monitor the user's keyboard key operation, and store each user's key input event as a key value combination sequence; the key input event includes the key operation performed by the user and the time, wherein each key on the keyboard has a preset value, and each key operation of the user will assign a value to the key value combination sequence; Verify whether the key-value combination sequence conforms to a preset interval, mark the key-value combination sequence that does not conform to the preset interval as a first exception, and provide feedback to the client; Each key-value combination sequence that meets the preset interval is read cyclically. When the last typing event ends, all its sequences are converted into visible characters, and the time interval between each typing event is recorded to generate the temporary behavior characteristics of the user; Compare the key-value combination sequence with the preset sequence to determine the consistency of user behavior; if the behavior consistency is not met, perform a second abnormal mark and provide feedback on the client; if the consistency is met, generate a consistency mark and update the temporary behavior characteristics of the user in the database; Compare the string with the preset password to determine the consistency of the user password; if the password consistency is not met, generate a third abnormal mark and feedback on the client; if it is met, generate a password consistency mark; Perform identity legitimacy detection on key operations with password consistency marks, including: after reading the user account password, extracting the user's historical behavior characteristics from the database, and performing a difference comparison between the temporary behavior characteristics and the historical behavior characteristics; The value of the key-value combination sequence includes the value of the auxiliary key, the key value and the time. The end mark of the monitoring event of any key-value combination sequence is the completion of the key value input. The start mark of the monitoring event of any key-value combination sequence is the program initialization start and / or the end of the monitoring of the previous key-value combination sequence event. In the key value combination sequence, the preset value of pressing the auxiliary key is 1, and the initial value is 0; the key value is cached via ASCII code, and the value range of the time is 0-59; The character string comparison between the key-value combination sequence and the preset sequence is used to determine whether there is a logical anomaly in the user's typing feature, and the logical anomaly includes whether there is a positive correlation between the value of the auxiliary key and the ASCII code of the key value.

2. A user account login security protection method according to claim 1, characterized in that: In the step of verifying the key value combination sequence, the preset intervals include: Whether the key value of any key-value combination sequence is empty and / or is in the ASCII code table; Whether the time of any key-value combination sequence is empty and / or greater than 59.

3. A user account login security protection method according to claim 1, characterized in that: The recording of the temporary behavior characteristics includes: recording the key value combination sequence of each operation typed by the user in the current login operation, cyclically reading each key value combination sequence in the login operation before the user clicks the login option, extracting the time value in each sequence, and arranging and recording them in sequence according to the input order.

4. A user account login security protection method according to claim 1, characterized in that: Before performing the password consistency check, the key values ​​in the key value combination sequence are converted into visible characters, and the visible characters are compared with the preset password; wherein, during the conversion process, if the visible characters are non-preset keyboard characters, they are discarded.

5. A user account login security protection method according to claim 4, characterized in that: When performing the password consistency check, the client identifier corresponding to the user's keyboard sequence is also checked.

6. A user account login security protection method according to claim 3, characterized in that: The identity legitimacy is used to detect whether the difference between the number of occurrences of the third abnormal mark in the user's temporary behavior characteristics, the value of the time in each key-value combination sequence, and the number of occurrences of the third abnormal mark in the historical behavior characteristics, and the value of the time in each key-value combination sequence meets a preset range.

7. A user account login security protection system, characterized in that: include: A client keyboard event processing module, which is used to collect and record user login operations and typing events; A key event recording module, wherein the key event recording detection module is used to verify whether the key value combination sequence conforms to a preset interval and generate a first abnormality mark; An exception handling module, the exception handling module is used to perform exception judgment when performing string comparison; A data conversion module, the data conversion module is used to convert the visible characters; A data comparison module, which is used to determine the consistency of user behavior; A consistency check module, the consistency check module is used to determine the text consistency between the visible characters and the preset password; An identity legitimacy detection module, which is used to perform a differential comparison between a user's temporary behavior characteristics and a user's historical behavior characteristics; The value of the key-value combination sequence includes the value of the auxiliary key, the key value and the time. The end mark of the monitoring event of any key-value combination sequence is the completion of the key value input. The start mark of the monitoring event of any key-value combination sequence is the program initialization start and / or the end of the monitoring of the previous key-value combination sequence event. In the key value combination sequence, the preset value of pressing the auxiliary key is 1, and the initial value is 0; the key value is cached via ASCII code, and the value range of the time is 0-59; The character string comparison between the key-value combination sequence and the preset sequence is used to determine whether there is a logical anomaly in the user's typing feature, and the logical anomaly includes whether there is a positive correlation between the value of the auxiliary key and the ASCII code of the key value.