A two-factor login authentication method and apparatus for one-way communication in adjacent networks

Abstract

This invention discloses a two-factor login authentication method and apparatus for one-way communication in adjacent networks. The method includes: registering user accounts in a pre-built verification management system and binding user accounts to RFID cards using an RFID reader / writer; when a user accesses a pre-built data relay system using a terminal device, obtaining the user account and password through the Internet (WAN), placing the obtained user account and password into a message queue (MQ), and publishing a message Q1; after the local area network (LAN) of the verification management system listens to the message Q1 published by the message queue (MQ), it obtains the message Q1 from the message queue (MQ), obtains the user account and password from the message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data relay system; based on the verification result received from the verification management system, the data relay system sends corresponding prompt information to the user's terminal device to indicate whether the login was successful or not.

Description

Technical Field

[0001] This invention relates to the field of login authentication technology, and more specifically, to a two-factor login authentication method and apparatus for one-way communication between adjacent networks. Background Technology

[0002] We live in an era of interconnected information, where the dissemination and acquisition of information have become unprecedentedly convenient and rapid, bringing people unprecedented convenience and opportunities and profoundly impacting social development. At the same time, the data security risks behind informatization are becoming increasingly prominent. Data breaches, data eavesdropping, and data misuse are frequent occurrences, making the protection of data assets a matter of great concern to all sectors of society.

[0003] In data-sensitive industries, to prevent the leakage of confidential / restricted information to the internet, they typically establish a logically isolated, one-way communication local area network (LAN) for these confidential systems. This means creating and configuring a LAN that only allows access from the higher-security network to the lower-security network. For example, only the LAN can access the internet (WAN), but the WAN cannot access the LAN. This configuration effectively restricts access to the LAN, thereby reducing the risk of data leakage. Furthermore, when accessing business system information within the LAN, authentication methods are often implemented, such as requiring the identification of correctly registered employee RFID cards to grant access. Combining LAN and RFID significantly enhances the data security of business systems.

[0004] However, in certain special applications (such as when employees are working remotely), it is necessary to log in and access system business data on a local area network (LAN) via the Internet (WAN). The LAN login and access method described above is clearly insufficient to meet the needs of employees logging in and retrieving business system data from the LAN when they are away from home.

[0005] Considering the security of system access, it is particularly necessary and important to conduct strict and secure system login authentication between two adjacent one-way communication networks. Summary of the Invention

[0006] To address at least one of the problems described in the background section, the present invention provides a two-factor login authentication method and apparatus for one-way communication between adjacent networks.

[0007] According to one aspect of the present invention, a two-factor login authentication method for one-way communication between adjacent networks is provided, comprising:

[0008] Register user accounts in a pre-built verification management system and bind user accounts to RFID cards using RFID readers; the verification management system is a business system deployed on a local area network (LAN).

[0009] When a user accesses a pre-built data relay system using a terminal device, the user's account and password are obtained through the Internet (WAN), and the obtained user account and password are placed in the message queue (MQ), and message Q1 is published. The data relay system is a business system deployed on the Internet (WAN), and the local area network (LAN) can access the Internet (WAN).

[0010] After the local area network (LAN) of the verification management system listens for message Q1 published by message queue MQ, it retrieves message Q1 from message queue MQ, obtains the user account and password from message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data transfer system.

[0011] Based on the verification results received from the verification management system, the data relay system sends corresponding prompts to the user's terminal device to indicate whether the login was successful or not.

[0012] Optionally, the step of placing the obtained user account and password into a message queue (MQ) and publishing message Q1 includes:

[0013] The acquired user accounts and passwords are encapsulated;

[0014] Call the message queue MQ to publish message Q1, where message Q1 includes the encapsulated user account and password.

[0015] Optionally, the step of verifying the user account and password according to preset rules and returning the verification result to the data transfer system includes:

[0016] Verify that the user account and password match those stored in the verification management system;

[0017] If the user account and password match those stored in the verification management system, the system retrieves the RFID number R1 bound to the user account and verifies the user's login eligibility based on RFID number R1. If the user is verified to be qualified to log in, the system returns the verification information to the data transfer system. If the user is not verified to be qualified to log in, the system returns the verification information to the data transfer system.

[0018] If the user account and password do not match those stored in the verification management system, the verification failure message will be returned to the data transfer system.

[0019] Optionally, the further verification of user eligibility based on RFID number R1 includes:

[0020] Determine if RFID number R1 is empty;

[0021] If the RFID number R1 is not empty, a random number N1 with a preset validity period is generated, and the user is further verified to be qualified to log in based on the random number N1; if the RFID number R1 is empty, the user is verified not to be qualified to log in.

[0022] Optionally, the further verification of whether a user is qualified to log in based on a random number N1 includes:

[0023] The verification management system uses RFID number R1 to encrypt random number N1 to obtain ciphertext E1, and then sends ciphertext E1 and user account to the data relay system.

[0024] The data relay system obtains the user's RFID number R2, decrypts the ciphertext E1 using the RFID number R2 to obtain a random number N2, puts the random number N2 into the message queue MQ, and publishes the message Q2.

[0025] After the local area network (LAN) of the verification management system listens to the message Q2 published by the message queue MQ, it retrieves the message Q2 from the message queue MQ and obtains the random number N2 from the message Q2.

[0026] The verification management system calculates the time difference between the time when the random number N2 is received by the local area network (LAN) and the time when the random number N1 is generated, and determines whether the time difference exceeds the preset valid time of the random number N1; the verification management system also determines whether the random number N2 and the random number N1 are consistent.

[0027] If the time difference does not exceed the preset valid time of random number N1 and random number N2 is the same as random number N1, then the user is confirmed to be qualified to log in; otherwise, the user is confirmed to be unqualified to log in.

[0028] Optionally, the data relay system acquires the user's RFID number R2, including:

[0029] After receiving the encrypted E1, the data relay system will send a notification to the user's terminal device, informing the user that they need to open a target application on the terminal device that can obtain the RFID card number;

[0030] Once the target application reads the user's RFID number R2, it automatically sends the RFID number R2 to the data relay system.

[0031] According to another aspect of the present invention, a two-factor login authentication device for one-way communication between adjacent networks is provided, comprising:

[0032] The registration and binding module is used to register user accounts in the pre-built verification management system and bind user accounts to RFID cards using an RFID reader / writer; the verification management system is a business system deployed on a local area network (LAN).

[0033] The message publishing module is used to obtain the user's account and password through the Internet WAN when the user accesses the pre-built data relay system using the terminal device, and put the obtained user account and password into the message queue MQ and publish message Q1; where the data relay system is a business system deployed on the Internet WAN, and the local area network LAN can access the Internet WAN.

[0034] The verification module is used to verify that after the local area network (LAN) of the management system listens for message Q1 published by the message queue MQ, it retrieves message Q1 from the message queue MQ, obtains the user account and password from message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data relay system.

[0035] The notification module is used by the data relay system to send corresponding notification information to the user's terminal device based on the verification result received from the verification management system, in order to indicate whether the login was successful or not.

[0036] Optionally, the message publishing module is specifically used for:

[0037] The acquired user accounts and passwords are encapsulated;

[0038] Call the message queue MQ to publish message Q1, where message Q1 includes the encapsulated user account and password.

[0039] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0040] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0041] This invention, when handling communication between adjacent networks, does not simply expose the LAN to the internet by opening its firewall, thus making the LAN more vulnerable to virus intrusion and hacker attacks. Instead, while maintaining one-way communication, it achieves message transmission by having the LAN actively acquire a specific message queue from the internet. Specifically, it utilizes a message queue (MQ) to enable one-way communication between adjacent networks, overcoming the problem of data not being able to be transmitted to a more secure LAN. Through the system design and explanation of two-factor authentication for one-way communication between adjacent networks based on RFID cards and TOTP verification codes, a clearer understanding of how adjacent networks exchange messages is provided. This also offers a secure and scientific approach to application systems logging into and accessing LANs on the internet, avoiding a series of security risks such as data theft, economic losses, and social security issues. Attached Figure Description

[0042] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0043] Figure 1 This is a flowchart illustrating a two-factor login authentication method for one-way communication between adjacent networks provided in an exemplary embodiment of the present invention.

[0044] Figure 2 This is a schematic diagram of the architecture of a two-factor login authentication system provided in an exemplary embodiment of the present invention;

[0045] Figure 3 This is a logical timing diagram of a two-factor login authentication method for one-way communication in adjacent networks provided by an exemplary embodiment of the present invention;

[0046] Figure 4 This is a schematic diagram of the structure of a two-factor login authentication device for one-way communication between adjacent networks provided in an exemplary embodiment of the present invention;

[0047] Figure 5 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0048] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0049] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0050] To address the security challenges of secure system login authentication between two adjacent, one-way communicating networks, and to resolve the security issues faced by users logging into and accessing business systems on a local area network (LAN) within an Internet (WAN), this invention proposes a two-factor authentication method based on RFID cards and TOTP verification codes for one-way communication between adjacent networks. The technical solution of this invention will be described in detail below with reference to the accompanying drawings to facilitate understanding and mastery.

[0051] Figure 1 A flowchart illustrating the two-factor login authentication method for one-way communication in adjacent networks provided by this invention is shown. Figure 1 As shown, the two-factor login authentication method for one-way communication between adjacent networks includes:

[0052] Step S101: Register user accounts in the pre-built verification management system and bind user accounts to RFID cards using an RFID reader / writer; wherein, the verification management system is a business system deployed on a local area network (LAN);

[0053] In this embodiment of the invention, a logically isolated, unidirectional communication network environment is described, that is, a local area network (LAN) with a high security level only allows access to a network (WAN) with a low security level. To ensure that data information between the LAN and the WAN can communicate with each other, the communication environment between the LAN and the WAN is first established. (See attached...) Figure 2 As shown, firstly, in the Internet (WAN) network environment, the MQ environment is built. Secondly, a business system APP for data relay, namely the Internet WAN (also known as the data relay system), needs to be built. In addition, a target application APP, namely RFID, which can obtain RFID card numbers, needs to be installed on the mobile device terminal. In the local area network (LAN) environment, a business system APP, namely the LAN (also known as the authentication and management system), needs to be built to support the verification of user login accounts and passwords and the management of RFID card identities.

[0054] Therefore, it is necessary to register user accounts in the business system APP - local area network (LAN) and bind the user accounts to RFID cards using an RFID reader / writer. This mainly involves binding the user to the unique serial number of the physical RFID card.

[0055] Step S102: When a user accesses the pre-built data relay system using a terminal device, the user account and password are obtained through the Internet WAN, and the obtained user account and password are placed in the message queue MQ, and message Q1 is published; wherein, the data relay system is a business system deployed on the Internet WAN, and the local area network LAN can access the Internet WAN;

[0056] Optionally, the step of putting the obtained user account and password into a message queue (MQ) and publishing message Q1 includes: encapsulating the obtained user account and password; and calling the message queue (MQ) to publish message Q1, wherein message Q1 includes the encapsulated user account and password.

[0057] In embodiments of the present invention, such as Figure 3 As shown, a user accesses the business system APP-InternetNetworkWAN deployed on the Internet WAN using a mobile device (such as a mobile phone), opens the login page of APP-InternetNetworkWAN, enters the account and password required for system login, and clicks submit. After obtaining the account and password, APP-InternetNetworkWAN puts the account and password into the message queue MQ and publishes the message Q1.

[0058] Step S103: After the local area network (LAN) of the verification management system listens to message Q1 published by message queue MQ, it retrieves message Q1 from message queue MQ, retrieves the user account and password from message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data transfer system.

[0059] Optionally, the step of verifying the user account and password according to preset rules and returning the verification result to the data transfer system includes: verifying whether the user account and password are consistent with the user account and password stored in the verification management system; if the user account and password are consistent with the user account and password stored in the verification management system, obtaining the RFID number R1 bound to the user account, and verifying whether the user has login qualifications based on the RFID number R1; when the user is verified to have login qualifications, returning the verification passed information to the data transfer system; when the user is verified to have login qualifications, returning the verification failed information to the data transfer system; if the user account and password are inconsistent with the user account and password stored in the verification management system, returning the verification failed information to the data transfer system.

[0060] Optionally, the step of further verifying whether the user is qualified to log in based on the RFID number R1 includes: determining whether the RFID number R1 is empty; if the RFID number R1 is not empty, then randomly generating a random number N1 with a preset valid time, and further verifying whether the user is qualified to log in based on the random number N1; if the RFID number R1 is empty, then verifying that the user is not qualified to log in.

[0061] Optionally, the further verification of user login eligibility based on random number N1 includes: the verification management system encrypts random number N1 using RFID number R1 to obtain ciphertext E1, and sends ciphertext E1 and user account to the data relay system; the data relay system obtains the user's RFID number R2, decrypts ciphertext E1 using RFID number R2 to obtain random number N2, puts random number N2 into message queue MQ, and publishes message Q2; after the local area network (LAN) of the verification management system listens to message Q2 published by message queue MQ, it retrieves message Q2 from message queue MQ and obtains random number N2 from message Q2; the verification management system calculates the time difference between the time when the LAN receives random number N2 and the time when random number N1 is generated, and determines whether the time difference exceeds the preset validity time of random number N1; the verification management system determines whether random number N2 and random number N1 are consistent; if the time difference does not exceed the preset validity time of random number N1 and random number N2 and random number N1 are consistent, then the user is confirmed to have login eligibility; otherwise, the user is confirmed to have no login eligibility.

[0062] Optionally, the data relay system acquires the user's RFID number R2 by: after receiving the encrypted text E1, the data relay system sends a notification to the user's terminal device to inform the user that a target application capable of acquiring the RFID card number needs to be opened on the terminal device; when the target application reads the user's RFID number R2, it automatically sends the RFID number R2 to the data relay system.

[0063] Step S104: The data relay system sends a corresponding prompt message to the user's terminal device based on the verification result received from the verification management system to indicate whether the login was successful or not.

[0064] In embodiments of the present invention, such as Figure 3 As shown, since the Local Area Network (LAN) can access the Internet (WAN), the business system APP (LAN) located on the LAN, after listening to the message published by the MQ, will retrieve the MQ message Q1 and thus obtain the account and password. The business system APP (LAN) then verifies whether the account and password match the system's account. If the match fails, the system will notify the application service APP (WAN) located on the Internet via an interface, and then display a login failure message on the mobile phone.

[0065] If the account password verification is successful, the system further retrieves the RFID number R1 associated with the account. If RFID number R1 is empty, it means the user has not bound an RFID tag and cannot access the APP-LAN system, resulting in verification failure. In this case, the system will notify the application service APP-Internet WAN located on the Internet WAN via an interface, and a login failure message will be displayed on the mobile phone. If RFID number R1 is not empty, it means the account has already been bound to an RFID card on the system. The LAN application service will then randomly generate a 6-bit OTP random number N1 with a validity period of 3 minutes, and encrypt this 6-bit OTP random number using the RFID number to obtain ciphertext E1. The LAN application service then sends the encrypted ciphertext E1 and the user account information to the application service APP-Internet WAN located on the Internet WAN via an interface.

[0066] After receiving the information containing the encrypted text E1, the Internet WAN application service (APP-Internet WAN) informs the user via a prompt message that they need to open an application (APP-RFID) on their mobile device to obtain the RFID card number. Once the APP-RFID application reads the user's RFID number, it automatically sends the RFID number to the Internet WAN application service (APP-Internet WAN). Upon receiving the RFID number R2, the Internet WAN application service (APP-Internet WAN) decrypts the encrypted text E1 using RFID number R2. If decryption fails, the login fails. Otherwise, decryption succeeds, yielding a 6-digit OTP random number N2. The Internet WAN application service then uses the MQ service to generate a message queue Q2 from this 6-digit OTP number N2 and publishes it. When the LAN application service (APP-LAN) receives this message Q2, it parses the message to obtain a 6-digit OTP number N2. Finally, it checks if the request has exceeded 3 minutes (equal to the time it took for the LAN to receive N2 minus the time it took to generate N1) and compares N2 with the previously generated 6-digit OTP number N1. If the timeout period does not expire and N1 and N2 match, the login verification is successful. The APP (Local Area Network) then calls the interface to notify the WAN (Internet Network) application service. The WAN application service (APP-Internet Network) then displays a successful login message on the mobile device. Otherwise, the user is prompted to log in again.

[0067] When handling communication between adjacent networks, this invention does not simply expose the LAN to the Internet by opening the LAN's firewall, thus making the LAN more vulnerable to virus intrusion and hacker attacks. Instead, while maintaining one-way communication, it achieves message transmission by having the LAN actively obtain a specific message queue from the Internet. That is, it uses message queue (MQ) to realize one-way communication between adjacent networks, overcoming the problem that data cannot be transmitted to the more secure LAN.

[0068] Furthermore, in the login authentication process, this invention combines TOTP authentication technology and encryption technology to overcome the problems of static passwords being guessed and cracked, as well as the problem that static passwords cannot fundamentally determine the user's identity and can be easily forged into a fake identity or have an existing user's identity stolen, thus strengthening the system's secure login authentication.

[0069] In summary, this invention, through the system design and description of two-factor login authentication based on RFID cards and TOTP verification codes for one-way communication between adjacent networks, provides a clearer understanding of how adjacent networks exchange and communicate messages. It also provides a safe and scientific approach for application systems that log in to and access local area networks on the Internet, avoiding a series of security risks such as data theft, economic losses, and social security issues.

[0070] Exemplary device

[0071] Figure 4 This is a schematic diagram of the structure of a two-factor login authentication device for unidirectional communication in adjacent networks provided in an exemplary embodiment of the present invention. Figure 4 As shown, the device 400 includes:

[0072] The registration and binding module 410 is used to register user accounts in the pre-built verification management system and bind user accounts to RFID cards using an RFID reader / writer; wherein, the verification management system is a business system deployed on a local area network (LAN);

[0073] The message publishing module 420 is used to obtain the user account and password through the Internet WAN when the user accesses the pre-built data relay system using the terminal device, and put the obtained user account and password into the message queue MQ and publish message Q1; wherein, the data relay system is a business system deployed on the Internet WAN, and the local area network LAN can access the Internet WAN.

[0074] The verification module 430 is used to verify that after the local area network (LAN) of the management system listens to the message Q1 published by the message queue MQ, it retrieves the message Q1 from the message queue MQ, retrieves the user account and password from the message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data transfer system.

[0075] The prompt module 440 is used by the data relay system to send corresponding prompt information to the user's terminal device based on the verification result received from the verification management system, so as to prompt the user whether the login was successful or not.

[0076] Optionally, the message publishing module 420 is specifically used for:

[0077] The acquired user accounts and passwords are encapsulated;

[0078] Call the message queue MQ to publish message Q1, where message Q1 includes the encapsulated user account and password.

[0079] The two-factor login authentication device for one-way communication in adjacent networks in this embodiment of the invention corresponds to the two-factor login authentication method for one-way communication in adjacent networks in another embodiment of the invention, and will not be described again here.

[0080] Exemplary electronic devices

[0081] Figure 5 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 5 As shown, the electronic device 50 includes one or more processors 51 and memory 52.

[0082] The processor 51 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0083] The memory 52 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 51 may execute the program instructions to implement the methods for information mining of historical change records and / or other desired functions of the software programs of the various embodiments of the present invention described above. In one example, the electronic device may also include an input device 53 and an output device 54, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0084] In addition, the input device 53 may also include, for example, a keyboard, a mouse, etc.

[0085] The output device 54 can output various information to the outside. The output device 54 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0086] Of course, for the sake of simplicity, Figure 5 Only some of the components of the electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0087] Exemplary computer program products and computer-readable storage media

[0088] In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0089] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0090] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods for information mining of historical change records according to various embodiments of the present invention as described in the "Exemplary Methods" section above.

[0091] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0092] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0093] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0094] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0095] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0096] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0097] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A two-factor login authentication method for one-way communication in adjacent networks, characterized in that, include: Register user accounts in a pre-built verification management system and bind user accounts to RFID cards using RFID readers; the verification management system is a business system deployed on a local area network (LAN). When a user accesses a pre-built data relay system using a terminal device, the user's account and password are obtained through the Internet (WAN), and the obtained user account and password are placed in the message queue (MQ), and message Q1 is published. The data relay system is a business system deployed on the Internet (WAN), and the local area network (LAN) can access the Internet (WAN). After the local area network (LAN) of the verification management system listens for message Q1 published by message queue MQ, it retrieves message Q1 from message queue MQ, obtains the user account and password from message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data transfer system. Based on the verification results received from the verification management system, the data relay system sends corresponding prompts to the user's terminal device to indicate whether the login was successful or not. The process of verifying user accounts and passwords according to preset rules includes: Verify whether the user account and password are consistent with the user account and password stored in the verification management system; if the user account and password are consistent with the user account and password stored in the verification management system, obtain the RFID number R1 bound to the user account, and verify whether the user is qualified to log in based on the RFID number R1. The step of verifying a user's login eligibility based on RFID number R1 includes: Determine if RFID number R1 is empty; If the RFID number R1 is not empty, a random number N1 with a preset validity period is randomly generated, and the user's login qualification is further verified based on the random number N1; if the RFID number R1 is empty, the user's login qualification is verified. The step of further verifying whether a user is qualified to log in based on a random number N1 includes: The verification management system uses RFID number R1 to encrypt random number N1 to obtain ciphertext E1, and then sends ciphertext E1 and user account to the data relay system. The data relay system obtains the user's RFID number R2, decrypts the ciphertext E1 using the RFID number R2 to obtain a random number N2, puts the random number N2 into the message queue MQ, and publishes the message Q2. After the local area network (LAN) of the verification management system listens to the message Q2 published by the message queue MQ, it retrieves the message Q2 from the message queue MQ and obtains the random number N2 from the message Q2. The verification management system calculates the time difference between the time when the random number N2 is received by the local area network (LAN) and the time when the random number N1 is generated, and determines whether the time difference exceeds the preset valid time of the random number N1; the verification management system also determines whether the random number N2 and the random number N1 are consistent. If the time difference does not exceed the preset valid time of random number N1 and random number N2 is the same as random number N1, then the user is confirmed to be qualified to log in; otherwise, the user is confirmed to be unqualified to log in.

2. The method according to claim 1, characterized in that, The step of placing the obtained user account and password into the message queue MQ and publishing message Q1 includes: The acquired user accounts and passwords are encapsulated; Call the message queue MQ to publish message Q1, where message Q1 includes the encapsulated user account and password.

3. The method according to claim 1, characterized in that, The verification results are returned to the data transfer system, including: When a user is verified to be eligible to log in, the system returns a successful verification message to the data transfer system; when a user is verified to be ineligible to log in, the system returns a failed verification message to the data transfer system. If the user account and password do not match those stored in the verification management system, the verification failure message will be returned to the data transfer system.

4. The method according to claim 1, characterized in that, The data relay system acquires the user's RFID number R2, including: After receiving the encrypted E1, the data relay system will send a notification to the user's terminal device, informing the user that they need to open a target application on the terminal device that can obtain the RFID card number; Once the target application reads the user's RFID number R2, it automatically sends the RFID number R2 to the data relay system.

5. A two-factor login authentication device for one-way communication in adjacent networks, characterized in that, include: The registration and binding module is used to register user accounts in the pre-built verification management system and bind user accounts to RFID cards using an RFID reader / writer; the verification management system is a business system deployed on a local area network (LAN). The message publishing module is used to obtain the user's account and password through the Internet WAN when the user accesses the pre-built data relay system using the terminal device, and put the obtained user account and password into the message queue MQ and publish message Q1; where the data relay system is a business system deployed on the Internet WAN, and the local area network LAN can access the Internet WAN. The verification module is used to verify that after the local area network (LAN) of the management system listens for message Q1 published by the message queue MQ, it retrieves message Q1 from the message queue MQ, obtains the user account and password from message Q1, verifies the user account and password according to preset rules, and returns the verification result to the data relay system. The prompt module is used by the data relay system to send corresponding prompt information to the user's terminal device based on the verification result received from the verification management system, so as to indicate whether the user has successfully logged in. The process of verifying user accounts and passwords according to preset rules includes: Verify whether the user account and password are consistent with the user account and password stored in the verification management system; if the user account and password are consistent with the user account and password stored in the verification management system, obtain the RFID number R1 bound to the user account, and verify whether the user is qualified to log in based on the RFID number R1. The step of verifying a user's login eligibility based on RFID number R1 includes: Determine if RFID number R1 is empty; If the RFID number R1 is not empty, a random number N1 with a preset validity period is randomly generated, and the user's login qualification is further verified based on the random number N1; if the RFID number R1 is empty, the user's login qualification is verified. The step of further verifying whether a user is qualified to log in based on a random number N1 includes: The verification management system uses RFID number R1 to encrypt random number N1 to obtain ciphertext E1, and then sends ciphertext E1 and user account to the data relay system. The data relay system obtains the user's RFID number R2, decrypts the ciphertext E1 using the RFID number R2 to obtain a random number N2, puts the random number N2 into the message queue MQ, and publishes the message Q2. After the local area network (LAN) of the verification management system listens to the message Q2 published by the message queue MQ, it retrieves the message Q2 from the message queue MQ and obtains the random number N2 from the message Q2. The verification management system calculates the time difference between the time when the random number N2 is received by the local area network (LAN) and the time when the random number N1 is generated, and determines whether the time difference exceeds the preset valid time of the random number N1; the verification management system also determines whether the random number N2 and the random number N1 are consistent. If the time difference does not exceed the preset valid time of random number N1 and random number N2 is the same as random number N1, then the user is confirmed to be qualified to log in; otherwise, the user is confirmed to be unqualified to log in.

6. The apparatus according to claim 5, characterized in that, The message publishing module is specifically used for: The acquired user accounts and passwords are encapsulated; Call the message queue MQ to publish message Q1, where message Q1 includes the encapsulated user account and password.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-4.

8. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-4.

Images