A safe multi-system login intercommunication method and system

Abstract

The application relates to the technical field of data security, and relates to a safe multi-system login intercommunication method and system.The method is as follows: after a user account password is verified to be correct by an account login main platform, an x-bit string c is obtained by using an algorithm, the algorithm is that a current month is added with a fixed interference value n, then hash calculation is performed on the preset string k to obtain an x-bit string c as a cookie name; user information is asymmetrically encrypted by a private key to obtain encrypted user information s, and the encrypted user information s is stored in a cookie named c; a sub-platform uses an encapsulated SDK, the SDK generates the same cookie name c according to the algorithm of step 1 and reads the corresponding encrypted cookie value s named c, the SDK uses a public key to perform a decryption operation on the encrypted s, and if user information is successfully obtained, the user is in a login state, the sub-platform is successfully logged in, otherwise, the user is in a non-login state, and data security can be ensured in the case that the SDK is used to realize login.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a secure method and system for multi-system login and interoperability. Background Technology

[0002] The company provides a unified account login system. After a user logs in, the platform stores the user information in a cookie. Sub-platforms in other departments can obtain and parse the cookie to retrieve the user information, thus enabling interoperability. To simplify the work of each department, the account login system provides an SDK that encapsulates the code for retrieving and decrypting login cookie data, which can be called by each department's sub-platform. However, this approach has a potential security risk: the SDK's source code is public, and departments can see the encryption and decryption algorithms. It's possible to simulate user login information by mimicking the SDK's source code algorithms, thereby arbitrarily constructing any user login. If a department's key management is improper and leads to key leakage, attackers can use the leaked key to construct forged login information and request the target site according to the cookie rules, thus achieving arbitrary login and endangering the department's data security. Summary of the Invention

[0003] To overcome the problem that login security cannot be guaranteed in the company's development platform, which would affect data security, the purpose of this invention is to provide a secure method and system for multi-system login interoperability, ensuring data security when using SDK to implement login.

[0004] This invention is implemented using the following scheme:

[0005] A secure method for interoperability of logins across multiple systems, comprising the following steps:

[0006] Step 1: After the user logs in to the main platform and verifies that the user account and password are correct, an algorithm is used to obtain an x-character string c. The algorithm is to add a fixed interference value n to the current month, and then perform a hash calculation with a preset string k to obtain an x-character string c as the cookie name.

[0007] Step 2: User information is asymmetrically encrypted using a private key to obtain encrypted user information s, which is then stored in a cookie named c;

[0008] Step 3: The sub-platform uses the encapsulated SDK. The SDK generates the same cookie name c according to the algorithm in Step 1 and reads the corresponding encrypted cookie value s. The SDK uses the public key to decrypt the encrypted s. If the user information is successfully obtained, it means that the user is logged in and the sub-platform login is successful; otherwise, the user is not logged in.

[0009] Furthermore, the asymmetric encryption includes RSA asymmetric encryption, DSA asymmetric encryption, and ECC asymmetric encryption.

[0010] Furthermore, after step 2, a group of random interference strings can be generated. Specifically, several random interference values ​​and several random interference strings are generated, and hash calculations are performed on each one to obtain several 'a'-digit strings as interference cookie names. Based on the length of the encrypted user information 's' mentioned in step 2, several groups of interference strings of equal length are randomly generated and stored under several groups of interference cookie names.

[0011] A secure multi-system login and interoperability system, the system comprising: a first encryption module, a second encryption module, and a sub-platform decryption login module;

[0012] The first encryption module is used to verify the user's account password after the account login main platform is correct. It uses an algorithm to obtain an x-character string c. The algorithm is to add a fixed interference value n to the current month, and then perform a hash calculation with a preset string k to obtain an x-character string c as the cookie name.

[0013] The second encryption module is used to perform asymmetric encryption on user information using a private key to obtain encrypted user information s, which is then stored in a cookie named c.

[0014] The sub-platform decryption login module is used by the sub-platform to use the encapsulated SDK. The SDK generates the same cookie name c according to the algorithm of the first encryption module and reads the corresponding encrypted cookie value s with the name c. The SDK uses the public key to decrypt the encrypted s. If the user information is successfully obtained, it means that the user is in the logged-in state and the sub-platform login is successful; otherwise, it is in the non-login state.

[0015] Furthermore, the asymmetric encryption includes RSA asymmetric encryption, DSA asymmetric encryption, and ECC asymmetric encryption.

[0016] Furthermore, it can also generate random interference string groups, specifically: generating several random interference values ​​and several random interference strings, performing hash calculations on each to obtain several 'a'-digit strings as interference cookie names; and randomly generating several groups of interference strings of equal length according to the length of the encrypted user information 's' described in the second encryption module, storing them under several groups of interference cookie names.

[0017] The beneficial effects of this invention are as follows:

[0018] This invention provides a secure method and system for multi-system login interoperability, offering a convenient SDK method for sub-platforms to obtain user information while ensuring the data security of user information and preventing attackers from arbitrarily tampering with user login data. This is because only the public key is exposed in the SDK source code, and even if an attacker guesses the calculation method of the cookie name, they cannot obtain the private key to simulate encryption of user information. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention;

[0020] Figure 2 This is a structural block diagram of the system of the present invention. Detailed Implementation

[0021] The invention will now be further described with reference to the accompanying drawings.

[0022] See Figure 1 A secure method for interoperability of logins across multiple systems, comprising the following steps:

[0023] Step 1: After the user logs in to the main platform and verifies that the user account and password are correct, an algorithm is used to obtain an x-character string c. The algorithm is to add a fixed interference value n to the current month, and then perform a hash calculation with a preset string k to obtain an x-character string c as the cookie name.

[0024] Step 2: User information is asymmetrically encrypted using a private key to obtain encrypted user information s, which is then stored in a cookie named c;

[0025] Step 3: The sub-platform uses the encapsulated SDK. The SDK generates a cookie with the same name 'c' according to the algorithm in Step 1 and reads the corresponding encrypted cookie value 's'. The SDK uses the public key to decrypt the encrypted 's'. If the user information is successfully obtained, it indicates that the user is logged in, and the sub-platform login is successful; otherwise, the user is not logged in. The following specific embodiment further illustrates the invention:

[0026] A secure method for interoperability of logins across multiple systems, the method comprising the following steps:

[0027] Step 1: When user yewei logs in, the account login system first verifies whether user yewei's password is correct. If incorrect, it returns a login failure message. If correct, it continues with the following steps: It retrieves the month of the current date, assuming m = 7, and adds a fixed interference value n = 123, resulting in a sum of 130. Next, it concatenates 130 with the fixed string k = F5C8564E and uses the MD5 hash algorithm to calculate the 16-bit string c = DF3A2857AC7511EF. The user information is then asymmetrically encrypted using the private key privateKey to obtain the encrypted user information s, which is finally stored in a cookie named DF3A2857AC7511EF.

[0028] Step 2: Generate several random interference values ​​and several random interference strings, and perform hash calculations on each one to obtain several 'a'-digit strings as interference cookie names; based on the length of the encrypted user information 's' mentioned in Step 2, randomly generate several groups of interference strings of equal length and store them under several groups of interference cookie names.

[0029] Five random noise values ​​are generated, such as 1, 4, 10, 20, and 44. Five random noise strings are then generated, such as xjshwy, aisjwu21, djudh32, 8dhsh3, and 4hdh28. Each string is hashed using the MD5 algorithm to obtain five 16-bit strings as noise cookie names: A3DD57DB69C1E35E, DC35457020F90958, FA92C53F0790AAD3, 90373A7765B4C35F, and D3F743F23E20872E. Assuming the encrypted user information 's' generated in step 1 is a 60-character string, five 60-character strings are randomly generated and stored under each of the five noise cookie names. These five cookies serve as noise to obscure the correct cookie.

[0030] Step 3: The sub-platform uses the encapsulated SDK. The SDK generates the same cookie name c according to the algorithm in Step 1 and reads the corresponding encrypted cookie value s. The SDK uses the public key to decrypt the encrypted s. If the user information is successfully obtained, it means that the user is in a logged-in state and the sub-platform login is successful; otherwise, the user is in a non-login state.

[0031] The sub-platform uses a packaged SDK to call a method to retrieve user information. The SDK code execution flow is as follows: First, the SDK retrieves the month of the current date, assuming m = 7, and adds a fixed interference value n = 123, resulting in a sum of 130. Next, 130 is concatenated with the fixed string k = F5C8564E, and the MD5 hash algorithm is used to calculate the 16-bit string c = DF3A2857AC7511EF. The SDK then retrieves a cookie value named DF3A2857AC7511EF, which stores the user information s encrypted with the private key. Finally, the SDK uses the public key to decrypt the encrypted user information s to obtain the user information. Successfully retrieving the user information indicates that the user is logged in; otherwise, the user is not logged in.

[0032] See Figure 2 A secure multi-system login and interoperability system, the system comprising: a first encryption module, a second encryption module, and a sub-platform decryption login module;

[0033] The first encryption module is used to verify the user's account password after the account login main platform is correct. It uses an algorithm to obtain an x-character string c. The algorithm is to add a fixed interference value n to the current month, and then perform a hash calculation with a preset string k to obtain an x-character string c as the cookie name.

[0034] The second encryption module is used to perform asymmetric encryption on user information using a private key to obtain encrypted user information s, which is then stored in a cookie named c.

[0035] The sub-platform decryption login module is used by the sub-platform to use the encapsulated SDK. The SDK generates the same cookie name c according to the algorithm of the first encryption module and reads the corresponding encrypted cookie value s with the name c. The SDK uses the public key to decrypt the encrypted s. If the user information is successfully obtained, it means that the user is in the logged-in state and the sub-platform login is successful; otherwise, it is in the non-login state.

[0036] In one embodiment of the present invention, the asymmetric encryption includes RSA asymmetric encryption, DSA asymmetric encryption, and ECC asymmetric encryption.

[0037] In one embodiment of the present invention, a random interference string group can also be generated, specifically: generating several random interference values ​​and several random interference strings, performing hash calculations on each one to obtain several 'a'-digit strings as interference cookie names; randomly generating several groups of interference strings of equal length according to the length of the encrypted user information 's' in the second encryption module, and storing them under several groups of interference cookie names.

[0038] The above description is only a preferred embodiment of the present invention. All equivalent changes and modifications made within the scope of the claims of the present invention should be included in the scope of the present invention.

Claims

1. A method for secure multi-system login interworking, characterized in that, The method steps are as follows: Step 1: After the account login main platform verifies that the user account password is correct, an x-bit string c is obtained by using an algorithm, the algorithm is to add a fixed interference value n to the current month, then hash calculation is performed with the preset string k to obtain an x-bit string c as the cookie name; Step 2: The user information is asymmetrically encrypted by a private key to obtain encrypted user information s, and stored in the cookie named c; Step 3: The sub-platform uses the encapsulated SDK, and the SDK generates the same cookie name c according to the algorithm of step 1 and reads the corresponding encrypted cookie value s named c, and the SDK uses the public key to decrypt the encrypted s, successfully obtains the user information, which indicates that the user is in a login state, the sub-platform login is successful, otherwise it is a non-login state.

2. The method of claim 1, wherein, The asymmetric encryption includes RSA asymmetric encryption, DSA asymmetric encryption and ECC asymmetric encryption.

3. The method of claim 1, wherein, After step 2, a random interference string group can also be generated, specifically: a plurality of random interference values and a plurality of random interference strings are generated, and a plurality of a-bit strings are obtained by hash calculation as interference cookie names; a plurality of groups of interference strings with equal length are randomly generated according to the length of the encrypted user information s in step 2, and are stored under a plurality of groups of interference cookie names.

4. A system for secure multi-system login interworking, characterized in that, The system comprises: a first encryption module, a second encryption module, and a sub-platform decryption login module; The first encryption module is used for obtaining an x-bit string c by using an algorithm after the account login main platform verifies that the user account password is correct, the algorithm is to add a fixed interference value n to the current month, then hash calculation is performed with the preset string k to obtain an x-bit string c as the cookie name; The second encryption module is used for asymmetrically encrypting the user information by a private key to obtain encrypted user information s, and storing in the cookie named c; The sub-platform decryption login module is used for the sub-platform to use the encapsulated SDK, and the SDK generates the same cookie name c according to the algorithm of the first encryption module and reads the corresponding encrypted cookie value s named c, and the SDK uses the public key to decrypt the encrypted s, successfully obtains the user information, which indicates that the user is in a login state, the sub-platform login is successful, otherwise it is a non-login state.

5. The system of claim 4, wherein, The asymmetric encryption includes RSA asymmetric encryption, DSA asymmetric encryption and ECC asymmetric encryption.

6. The system of claim 4, wherein, The random interference string group can also be generated, specifically, a plurality of random interference values and a plurality of random interference strings are generated, and a plurality of a-bit strings are obtained by performing hash calculation one by one as interference The second encryption module generates a plurality of interference strings with equal length according to the length of the encrypted user information s, and stores the interference strings under a plurality of interference cookie names.

Images