Login verification method and device based on browser, electronic equipment and storage medium
By calling the public key information storage JS interface in the browser to obtain the SM2 key pair, the dual-factor verification of user login is achieved, and the problems of increasing costs and inconvenience in the existing technology are solved. The use of domestic SM2 algorithm improves security and convenience .
Patent Information
- Application Number
- CN202411436121.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-15
- Publication Date
- 2024-12-31
AI Technical Summary
The existing user login dual factor verification technology increases the cost of using the information system, makes users inconvenient to operate, and rely on foreign password algorithms, which cannot be controlled independently and has security risks.
Using the browser-based login verification method, the SM2 key pair information is obtained by calling the browser's public key information storage JS interface, and the SM2 key pair information is achieved, and the two-factor verification of user login is realized. The SM2 algorithm is used for encryption and decryption, and the key information is stored in On different servers, the key information is dynamically updated.
The two-factor verification of user login is realized without additional costs, simplifies the user input verification steps, improves security and convenience, and is completely based on an independent and controllable domestic algorithm system.
Smart Images
Figure CN119232476A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of login verification, and in particular to a browser-based login verification method, device, electronic device, and storage medium. Background Art
[0002] With the development of information technology, more and more enterprises and institutions store data information on online servers. Due to the various unstable and unsafe factors in the online network environment, network security issues are becoming increasingly serious and sensitive user data leaks frequently occur.
[0003] In order to improve the security of user login, it is necessary to verify the user login information in different ways to enhance user identity authentication and ensure that the identity of the accessing user is credible.
[0004] The user login of existing online information systems generally adopts the authentication method of username and password; some information systems with slightly higher security requirements will add an identity authentication method, such as: SMS code, Ukey certificate, Token password, etc. However, the existing user login double factor authentication technology has the following disadvantages:
[0005] (1) Generally, there will be additional costs for using information system identity authentication.
[0006] (2) The user needs to manually obtain and enter the verification code or password, which is inconvenient to use and the user often makes mistakes in entering the character string.
[0007] (3) The cryptographic algorithms used in the technical process all adopt foreign standards. The cryptographic standard system is dominated and controlled by foreign countries and cannot be independently controlled. Once it is used for attack, it will have a major impact on domestic network security. Summary of the invention
[0008] The embodiments of the present application provide a browser-based login verification method, device, electronic device, and storage medium to implement double-factor verification of user login without adding additional factors.
[0009] The present application embodiment adopts the following technical solutions:
[0010] In a first aspect, an embodiment of the present application provides a browser-based login verification method, wherein the method comprises:
[0011] Call the browser's public key information storage JS interface to obtain the public key information;
[0012] If the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser; and
[0013] Based on the new public key information, user name and user ID, double verification of user login is achieved.
[0014] In some embodiments, the browser includes a reading and storage interface for the asymmetric public key information of the national secret SM2 algorithm and an encryption and decryption interface of the SM2 algorithm, and the web site server can call the browser's public key information storage JS interface to obtain the public key information, including:
[0015] Receive a username, user ID, and password as user information;
[0016] The SM2 public key information of the current website and the current user stored in the browser is obtained, and the encryption and decryption interface of the SM2 algorithm of the browser is called according to the SM2 public key information for the current user.
[0017] In some embodiments, if the public key information is not obtained, applying for new SM2 key pair information from the key management server and calling the browser's public key information storage JS interface to store the new public key information in the browser includes:
[0018] If the public key information is not obtained and is within the validity period, the image acquisition module of the operating system is called to obtain the facial image information of the current user in real time;
[0019] Both the facial information and the user information are sent to the background web server to trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair. The new SM2 asymmetric key pair is stored separately, wherein the private key information is matched with the user ID and password information and stored in the key management server, and the public key information is transmitted to the web page on the browser and saved by calling the browser's public key information storage JS interface.
[0020] In some embodiments, the method further comprises:
[0021] If the public key information is obtained and is within the validity period, then construct an information string to be encrypted, the information string including user name + user ID + password + random number + checksum;
[0022] Call the browser's reading and storage interface for the asymmetric public key information of the national encryption SM2 algorithm, and encrypt the information string with the SM2 algorithm according to the user's public key information;
[0023] The encrypted ciphertext is sent to the backend web server, and the user information is also sent to the backend web server synchronously.
[0024] In some embodiments, implementing double verification of user login based on the new public key information as well as the user name and user ID includes:
[0025] Send the user name and password to perform primary identity authentication;
[0026] When the primary identity authentication is successful, the user ID and the ciphertext are sent for secondary identity authentication, and the ciphertext is decrypted using the user's private key information obtained from the key management server.
[0027] In some embodiments, implementing double verification of user login based on the new public key information as well as the user name and user ID includes:
[0028] Parse the decrypted string in the following format: username + user ID + password + random number + checksum;
[0029] Verify the parsed username, user ID and password information for consistency with the information transmitted from the web page front end;
[0030] If the consistency verification passes, it means that the secondary verification passes; otherwise, the login fails.
[0031] In some embodiments, the method further comprises:
[0032] If any user's key pair information is potentially leaked, an invalid user key list is established and maintained on the backend web server to automatically trigger the update of the user's private key information in the key management server and the user's public key information stored in the browser when the user logs in next time.
[0033] In some embodiments, the public key is stored in the client browser while the private key is stored in the key management server, and the decryption process of the ciphertext is placed in the background web server.
[0034] In a second aspect, an embodiment of the present application further provides a browser-based login verification device, wherein the device comprises:
[0035] The calling module is used to call the public key information storage JS interface of the browser to obtain the public key information;
[0036] An application module, for applying for new SM2 key pair information from a key management server and calling the browser's public key information storage JS interface to store the new public key information in the browser if the public key information is not obtained; and
[0037] The verification module is used to implement double verification of user login based on the new public key information as well as the user name and user ID.
[0038] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory arranged to store computer executable instructions, wherein the executable instructions, when executed, cause the processor to perform the above method.
[0039] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which stores one or more programs. When the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes the above method.
[0040] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: based on calling the public key information storage JS interface of the browser, the public key information is obtained. If the public key information is not obtained, the new SM2 key pair information is applied to the key management server and the public key information storage JS interface of the browser is called to store the new public key information in the browser. Finally, the double verification of the user login is realized according to the new public key information as well as the user name and user ID. Through the above login verification method, no additional use cost is added, the step of user inputting verification information is simplified, the storage and use of key information are completely on different servers, and the key information can also be dynamically updated by the front-end web page as needed. In addition, the entire encryption / decryption verification is completely based on an autonomous and controllable domestic algorithm system, which also improves the security and convenience of user login verification. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0042] Figure 1 Provide a two-factor authentication solution for user login in related technologies;
[0043] Figure 2 This is a flowchart of a browser-based login verification method in an embodiment of the present application;
[0044] Figure 3 This is a flowchart of a browser-based login verification method in an embodiment of the present application;
[0045] Figure 4 This is a schematic diagram of the structure of a browser-based login verification device in an embodiment of the present application;
[0046] Figure 5 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION
[0047] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.
[0048] The existing two-factor authentication technology solutions for user login generally use different communication methods to obtain other authentication information, such as SMS code, Ukey certificate, Token password, etc. Taking SMS verification code as an example, the existing technical solutions are described as follows:
[0049] like Figure 1 As shown, it includes a browser, a web site server and a serial number server.
[0050] (1) First, the user starts the browser and opens the online information system to be logged in; and enters the user name and password information in the login interface.
[0051] (2) The user clicks the button to obtain the SMS verification code on the login interface; the web page will send the user's request information to the backend web server. The backend web server will immediately send the user's mobile phone number to the third-party SMS server to request the generation of a new verification code. After the third-party SMS server generates the verification code, it will immediately send the verification code to the user's mobile phone via SMS and return the verification code to the backend web server at the same time.
[0052] (3) After the user receives the verification code SMS, he / she enters the verification code on the login interface and clicks to trigger the login verification. After the backend web server receives the login request, it will first verify the user name and password, and then verify the serial number. If both verifications are successful, the verification is successful and the user can log in online to access the information system; otherwise, the user is prompted that the login failed.
[0053] After analysis, it is known that the existing user login double verification technology solutions generally use different communication methods to obtain other verification information, such as: SMS code, Ukey certificate, Token password, etc. The user reads the verification code string from these smart peripherals, and then manually enters it into the web login page. The user clicks to log in to the web information system; after the backend web server receives the user's login request, it will first perform a primary verification based on the user name and password, and then perform a secondary verification based on the verification code to determine whether the user has successfully logged in. The disadvantages are as follows:
[0054] (1) It will increase the system usage cost of information system identity authentication: SMS verification codes will increase telecommunications SMS charges, Token codes will increase the cost of purchasing smart Token peripherals, and Ukey certificates will increase the cost of purchasing smart Ukey peripherals.
[0055] (2) Users often make mistakes when manually entering serial numbers: Users are required to check the serial number on the peripheral and then manually enter it into the web login interface. Users often misread or enter numbers incorrectly, resulting in errors in the verification code they enter and failure to log in successfully.
[0056] (3) The verification code used has the risk of being leaked: Since the verification code is usually transmitted in plain text, there is a risk of being leaked. Therefore, it is usually only valid for a short period of time. A new verification code must be applied for each time you log in, which is troublesome to use.
[0057] (4) The verification code used is at risk of being cracked by brute force: Since the verification code used is generally 4 or 6 digits, there is a security risk of being cracked by brute force.
[0058] (5) There are uncontrollable risks in the related cryptographic algorithms used: The cryptographic algorithms generally used all adopt foreign standards. The cryptographic standard system is dominated and controlled by the United States and the United Kingdom and cannot be independently controlled. Once used for attack, it will cause a major impact on my country's network security.
[0059] In view of the shortcomings of the existing technical solutions, a set of browser-based user login double-factor authentication technology is implemented. The front-end web page automatically applies for the national secret SM2 asymmetric encryption key pair from the back-end server, and then receives the login information entered by the user and encrypts the login information using the SM2 public key.
[0060] When the ciphertext of the login information is received in the background, it is decrypted using the SM2 private key, and then the correctness of the decrypted information and the username and password are verified to determine whether the user has logged in successfully.
[0061] The above method can avoid the situation where users make mistakes when manually obtaining and inputting verification codes, and can also provide timely warnings and handle emergencies when encountering foreign certificate revocation.
[0062] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.
[0063] The present application embodiment provides a browser-based login verification method, such as Figure 2 As shown, a flowchart of a browser-based login verification method in an embodiment of the present application is provided, and the method at least includes the following steps S210 to S230:
[0064] Step S210, calling the browser's public key information storage JS interface to obtain public key information.
[0065] Two types of JS interfaces related to the national secret SM2 algorithm were developed and implemented in the browser. One of the JS interfaces is an interface for reading and storing asymmetric public key information of the national secret SM2 algorithm. The other JS interface is an interface for encrypting and decrypting the SM2 algorithm. And the web pages on the web site server can call these two types of JS interfaces.
[0066] The user enters the user name, user ID, password, and clicks to log in to the information system on the front-end web page login interface of the online web information system. Optionally, the user ID can be a bank internal information system, a teller number, a mobile phone number, etc.
[0067] Step S220: If the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser.
[0068] The front-end web page first calls the browser's SM2 algorithm public key information reading interface to try to obtain the SM2 public key information of the web site and the user that has been stored in the browser; if it is not obtained, it will apply for new SM2 key pair information from the key management server, and call the browser's public key information storage JS interface to store the new public key related information in the browser. Then the user's login information will be packaged, the browser's SM2 encryption JS interface will be called, the packaged information will be encrypted, and transmitted to the background web server. After receiving the ciphertext, the background web server will use the SM2 private key to decrypt it; finally, the verification message information will be parsed, and the user's identity will be verified based on the user name and password. This will achieve double verification of the user's identity, without the user having to perform additional verification code operations, and improve the security of user verification.
[0069] It can be understood that each time a new SM2 key pair information is applied to the key management server, face recognition is required to verify the user's information online in real time to ensure that the operation is performed by the user himself.
[0070] Step S230, implementing double verification of user login based on the new public key information as well as the user name and user ID.
[0071] Two-factor authentication is a more secure method of account login authentication, which is different from the traditional password authentication method. Two-factor authentication requires users to enter other forms of authentication information after entering their username and password to verify their identity. Generally, SMS codes, Ukey, or Token passwords are used as the second type of authentication. In addition to entering usernames and passwords, users also use user ID + ciphertext for secondary identity authentication.
[0072] Through the above method, firstly, the use cost of information system identity authentication will not be increased, and at the same time, the user does not need to obtain and enter additional verification code information.
[0073] Through the above method, secondly, using the national secret SM2 asymmetric key pair can avoid the risk of brute force cracking.
[0074] Through the above method, it is further possible to dynamically control the usage period of the key pair in the background. If the key pair is likely to be leaked, the key pair can be immediately revoked in the background.
[0075] Through the above method, finally, the cryptographic algorithm adopts the independent and controllable national SM2 cryptographic algorithm, which is technically safe and controllable.
[0076] In one embodiment of the present application, the browser includes a reading and storage interface for the asymmetric public key information of the national secret SM2 algorithm and an encryption and decryption interface of the SM2 algorithm, and the web site server can call the browser's public key information storage JS interface to obtain public key information, including: receiving a user name, user ID and password as user information; obtaining the SM2 public key information of the current web site and for the current user that has been stored in the browser, and calling the encryption and decryption interface of the SM2 algorithm of the browser according to the SM2 public key information for the current user.
[0077] The reading and storage interface for the asymmetric public key information of the national secret SM2 algorithm is developed in the embodiment of the present application and stored in the browser. The encryption and decryption interface of the SM2 algorithm is a national standard and is also stored in the browser.
[0078] like Figure 3 As shown in Figure 1, basic user information, including user name, password, and user face information, is saved and managed on each web server, and related backend services of the web information system are deployed. Figure 3 As shown, at the same time, the SM2 national encryption algorithm key pair generation, private key management and other services are configured in the key management server, and the user ID and password information are saved for matching and managing a user's private key information.
[0079] When the user starts the browser, opens the web login page of the information system that needs to be accessed, and enters the user name, user ID, and password, the login begins.
[0080] In one embodiment of the present application, if the public key information is not obtained, then apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser, including: if the public key information is not obtained and is within the validity period, call the image acquisition module of the operating system and obtain the facial image information of the current user in real time; send both the facial information and the user information to the background web server to trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair, and the new SM2 asymmetric key pair is stored separately, wherein the private key information is matched with the user ID and password information and stored in the key management server, and the public key information is transmitted to the web page on the browser and saved by calling the browser's public key information storage JS interface.
[0081] If the public key information is not obtained and is within the validity period, the image acquisition module of the operating system is called to obtain the facial image information of the current user in real time. Through the web page of the login interface, the web page will call the camera of the operating system through the browser to obtain the facial image information of the current user in real time. Usually laptops, mobile phones, and pads have built-in cameras, and ordinary desktop computers can be connected to a camera peripheral, which can be used to obtain image information.
[0082] The facial information and the user information are sent to the background web server to trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair, that is, the facial information and user information (user name, user ID, password) are sent to the remote background server; and then the background web server is triggered to send a request to the key management server to generate a new SM2 asymmetric key pair.
[0083] The generated SM2 asymmetric key pair will be stored separately: the private key information is matched with the user ID and password information and stored in the key management server, the public key information is transmitted to the web page on the browser, and the JS interface provided by the browser to save the user public key information is called:
[0084] (window.crypto.subtle.saveKey(ipAddress,username,keyString,validPeriod)) and then saved in the browser.
[0085] In one embodiment of the present application, the method also includes: if the public key information is obtained and is within the validity period, constructing an information string to be encrypted, the information string including user name + user ID + password + random number + checksum; calling the browser's reading and storage interface for the asymmetric public key information of the national secret SM2 algorithm, and performing SM2 algorithm encryption processing on the information string according to the user's public key information; sending the ciphertext obtained after the encryption processing to the background web server, and synchronously sending the user information to the background web server.
[0086] like Figure 3 As shown, a string of information to be encrypted is constructed on the web page of the login interface, and the content of the string of information includes: user name (32 bytes) + user ID (32 bytes) + password (32 bytes) + random number (32 bytes) + checksum (2 bytes).
[0087] If the user information does not reach 32 bytes, it will be filled with zeros.
[0088] The random number is obtained by calling the JS interface (window.crypto.getRandomValues(Uint8Array)) provided by the browser when the front-end web page calls the random number.
[0089] The checksum is the continuous accumulation of every two fields of all the previous fields, which is used to assist in verifying the integrity and accuracy of the information string during network transmission.
[0090] Afterwards, the browser's national encryption SM2 algorithm interface is called on the login interface web page (window.crypto.subtle.encrypt({name:SM2,iv:ivSM2,},sm2Key,needencodedMsg)).
[0091] Based on the public key information of the user, the information string is encrypted using the SM2 algorithm, and the ciphertext is sent to the backend web server, and later the user name, user ID and password are also sent to the backend web server.
[0092] In one embodiment of the present application, double verification of user login is implemented based on the new public key information as well as the user name and user ID, including: sending the user name and the password to perform a first-level identity authentication; when the first-level identity authentication is successful, sending the user ID and the ciphertext to perform a second-level identity authentication, and the ciphertext is decrypted using the user's private key information obtained from the key management server.
[0093] After receiving the information, the backend web server will first perform a first-level login verification on the received username and password. If the verification is successful, the ciphertext will be subsequently verified. Then, the private key information of the user is obtained from the key management server based on the user ID and password information; and the received ciphertext is decrypted based on the private key information. The decrypted string is then checked and verified. If the checksum verification passes, the next step of parsing and verification is performed.
[0094] In one embodiment of the present application, double verification of user login is implemented based on the new public key information as well as the username and user ID, including: parsing the decrypted string in the following format: username + user ID + password + random number + checksum; verifying the parsed username, user ID and password information for consistency with the information transmitted from the web page front end; if the consistency verification passes, it means that the second-level verification passes; otherwise, the login fails.
[0095] Please continue to refer to Figure 3 , parse the decrypted string in the following format: Username (32 bytes) + User ID (32 bytes) + Password (32 bytes) + Random number (32 bytes) + Checksum (2 bytes). Verify the parsed username, user ID and password information with the information transmitted from the web front end. If the consistency verification passes, it means that the secondary verification passes; otherwise, the login fails.
[0096] Please continue to refer to Figure 3 After that, the background web server will return the login verification result to the browser. If the login is successful, the user can enter the online web information system and continue browsing; otherwise, it will prompt that the login failed.
[0097] In one embodiment of the present application, the method also includes: if the key pair information of any user is potentially leaked, establishing and maintaining an invalid user key list on the background web server to automatically trigger the update of the user's private key information in the key management server and the user's public key information stored in the browser when the user logs in next time.
[0098] During daily system operation and maintenance, if it is found that the key pair information of some users may be leaked, a list of invalid user keys can be established and maintained on the background web server. When the user logs in next time, it will trigger the update of the user's private key information in the key management server and the user's public key information stored in the browser.
[0099] It is understandable that the leakage may be that a server is known to be compromised, and the stored user information may be leaked; if a user fails the second-level verification multiple times in a row when logging in, the user's key pair information may also be leaked.
[0100] Please refer to Figure 3 The processing flow is described in detail as follows:
[0101] Step S1, save and manage the basic information of users on each web server, including user name, password and user face information, and deploy relevant background services of the web information system.
[0102] Step S1, on the key management server, configure SM2 national encryption algorithm key pair generation, private key management and other services, and save user ID and password information for matching and managing a user's private key information.
[0103] Step S2, the user starts the browser, opens the web login page of the information system to be accessed, and enters the user name, user ID, and password to start logging in.
[0104] Step S4, the web page of the login interface will first call the JS interface (window.crypto.subtle.getKey(ipAddress,username)) provided by the browser to read a user's SM2 public key information, and obtain the public key information of the user of the web site from the browser based on the user name and the address information of the web site.
[0105] If the public key information of the user on the website can be obtained and the public key information is within the validity period, then go to step S6; otherwise, go to step S5.
[0106] Step S5, the web page of the login interface will call the camera of the operating system through the browser to obtain the facial image information of the current user in real time.
[0107] And send the face information and user information (user name, user ID, password) to the remote background server; then trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair.
[0108] The generated SM2 asymmetric key pair will be stored separately: the private key information is matched with the user ID and password information and stored in the key management server, the public key information is transmitted to the web page on the browser, and the JS interface provided by the browser to save the user public key information (window.crypto.subtle.saveKey(ipAddress,username,keyString,validPeriod)) is called and saved in the browser.
[0109] Step S6, the web page of the login interface constructs the information string to be encrypted, and the content of the information string includes: user name (32 bytes) + user ID (32 bytes) + password (32 bytes) + random number (32 bytes) + checksum (2 bytes). Among them: if the user information does not reach 32 bytes, it will be filled with zeros; the random number is obtained by the front-end web page calling the JS interface (window.crypto.getRandomValues(Uint8Array)) provided by the browser to obtain random numbers; the checksum is the continuous accumulation of every two fields of all the previous fields, which is used to assist in verifying the integrity and accuracy of the information string during network transmission.
[0110] Next, the web page of the login interface calls the browser's national encryption SM2 algorithm interface (window.crypto.subtle.encrypt({name:SM2,iv:ivSM2,},sm2Key,needencodedMsg)), and encrypts the information string using the SM2 algorithm based on the user's public key information; the ciphertext is sent to the background web server, and the user name, user ID and password are also sent to the background web server later.
[0111] Step S7, after the background web server receives the information, it will first perform a first-level login verification on the received username and password. If the verification is successful, the ciphertext will be subsequently verified. Then, the private key information of the user is obtained from the key management server based on the user ID and password information; and the received ciphertext is decrypted based on the private key information. The decrypted string is then checked and verified. If the checksum verification passes, the next step of parsing and verification is performed. The decrypted string is parsed in the following format: username (32 bytes) + user ID (32 bytes) + password (32 bytes) + random number (32 bytes) + checksum (2 bytes). The parsed username, user ID and password information are verified for consistency with the information transmitted from the front end of the web page. If the consistency verification passes, it means that the second-level verification is passed; otherwise, the login fails.
[0112] Step S8, the backend web server will return the login verification result to the browser. If the login is successful, the user can enter the online web information system and continue browsing; otherwise, it will prompt that the login failed.
[0113] Step S9: During the daily system operation and maintenance process, if it is found that the key pair information of some users may be leaked, an invalid user key list can be established and maintained on the background web server. When the user logs in next time, the user's private key information in the key management server and the user's public key information stored in the browser will be updated.
[0114] Step S10, end.
[0115] The present application embodiment also provides a browser-based login verification device 400, such as Figure 4 As shown, a schematic diagram of the structure of a browser-based login verification device in an embodiment of the present application is provided. The browser-based login verification device 400 at least includes: a calling module 410, an application module 420, and a verification module 430, wherein:
[0116] In one embodiment of the present application, the calling module 410 is specifically used to: call the public key information storage JS interface of the browser to obtain the public key information.
[0117] Two types of JS interfaces related to the national secret SM2 algorithm were developed and implemented in the browser. One of the JS interfaces is an interface for reading and storing asymmetric public key information of the national secret SM2 algorithm. The other JS interface is an interface for encrypting and decrypting the SM2 algorithm. And the web pages on the web site server can call these two types of JS interfaces.
[0118] The user enters the user name, user ID, password, and clicks to log in to the information system on the front-end web page login interface of the online web information system. Optionally, the user ID can be a bank internal information system, a teller number, a mobile phone number, etc.
[0119] In one embodiment of the present application, the application module 420 is specifically used to: if the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser.
[0120] The front-end web page first calls the browser's SM2 algorithm public key information reading interface to try to obtain the SM2 public key information of the web site and the user that has been stored in the browser; if it is not obtained, it will apply for new SM2 key pair information from the key management server, and call the browser's public key information storage JS interface to store the new public key related information in the browser. Then the user's login information will be packaged, the browser's SM2 encryption JS interface will be called, the packaged information will be encrypted, and transmitted to the background web server. After receiving the ciphertext, the background web server will use the SM2 private key to decrypt it; finally, the verification message information will be parsed, and the user's identity will be verified based on the user name and password. This will achieve double verification of the user's identity, without the user having to perform additional verification code operations, and improve the security of user verification.
[0121] It can be understood that each time a new SM2 key pair information is applied to the key management server, face recognition is required to verify the user's information online in real time to ensure that the operation is performed by the user himself.
[0122] In one embodiment of the present application, the verification module 430 is specifically used to implement double verification of user login based on the new public key information as well as the user name and user ID.
[0123] Two-factor authentication is a more secure method of account login authentication, which is different from the traditional password authentication method. Two-factor authentication requires users to enter other forms of verification information after entering their username and password to verify their identity. Generally, SMS codes, Ukey, or Token passwords are used as the second form of authentication. In addition to entering usernames and passwords, users also use user ID + ciphertext for secondary identity authentication.
[0124] In one embodiment of the present application, the calling module 410 is also used to
[0125] Receive a username, user ID, and password as user information;
[0126] The SM2 public key information of the current website and the current user stored in the browser is obtained, and the encryption and decryption interface of the SM2 algorithm of the browser is called according to the SM2 public key information for the current user.
[0127] In one embodiment of the present application, the application module 420 is also used to
[0128] If the public key information is not obtained and is within the validity period, the image acquisition module of the operating system is called to obtain the facial image information of the current user in real time;
[0129] Both the facial information and the user information are sent to the background web server to trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair. The new SM2 asymmetric key pair is stored separately, wherein the private key information is matched with the user ID and password information and stored in the key management server, and the public key information is transmitted to the web page on the browser and saved by calling the browser's public key information storage JS interface.
[0130] In one embodiment of the present application, the application module 420 is also used to
[0131] If the public key information is obtained and is within the validity period, then construct an information string to be encrypted, the information string including user name + user ID + password + random number + checksum;
[0132] Call the browser's reading and storage interface for the asymmetric public key information of the national encryption SM2 algorithm, and encrypt the information string with the SM2 algorithm according to the user's public key information;
[0133] The encrypted ciphertext is sent to the backend web server, and the user information is also sent to the backend web server synchronously.
[0134] In one embodiment of the present application, the verification module 430 is also used to
[0135] Send the user name and password to perform primary identity authentication;
[0136] When the primary identity authentication is successful, the user ID and the ciphertext are sent for secondary identity authentication, and the ciphertext is decrypted using the user's private key information obtained from the key management server.
[0137] In one embodiment of the present application, the verification module 430 is further used to parse the decrypted string according to the following format: user name + user ID + password + random number + checksum;
[0138] Verify the parsed username, user ID and password information for consistency with the information transmitted from the web page front end;
[0139] If the consistency verification passes, it means that the secondary verification passes; otherwise, the login fails.
[0140] In one embodiment of the present application, it also includes: an optimization module for
[0141] If any user's key pair information is potentially leaked, an invalid user key list is established and maintained on the backend web server to automatically trigger the update of the user's private key information in the key management server and the user's public key information stored in the browser when the user logs in next time.
[0142] It can be understood that the above-mentioned browser-based login verification device can implement the various steps of the browser-based login verification method provided in the aforementioned embodiment. The relevant explanations about the browser-based login verification method are applicable to the browser-based login verification device and will not be repeated here.
[0143] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 5 At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. Of course, the electronic device may also include hardware required for other services.
[0144] The processor, network interface and memory can be interconnected through an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.
[0145] The memory is used to store the program. Specifically, the program may include a program code, and the program code includes a computer operation instruction. The memory may include a memory and a non-volatile memory, and provides instructions and data to the processor.
[0146] The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a browser-based login verification device at the logical level. The processor executes the program stored in the memory and is specifically used to perform the following operations:
[0147] Call the browser's public key information storage JS interface to obtain the public key information;
[0148] If the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser; and
[0149] Based on the new public key information, user name and user ID, double verification of user login is achieved.
[0150] The above application Figure 2 The method performed by the browser-based login verification device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
[0151] The electronic device may also perform Figure 2 A method for executing a browser-based login verification device in the Figure 2 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.
[0152] The present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by an electronic device including multiple application programs, enable the electronic device to execute Figure 2 The method performed by the browser-based login verification device in the illustrated embodiment is specifically used to perform:
[0153] Call the browser's public key information storage JS interface to obtain the public key information;
[0154] If the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser; and
[0155] Based on the new public key information, user name and user ID, double verification of user login is achieved.
[0156] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0157] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0158] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.
[0159] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0160] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0161] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.
[0162] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0163] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0164] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.
[0165] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims
1. A browser-based login verification method, wherein: The method comprises: Call the browser's public key information storage JS interface to obtain the public key information; If the public key information is not obtained, apply for new SM2 key pair information from the key management server and call the browser's public key information storage JS interface to store the new public key information in the browser; and Based on the new public key information, user name and user ID, double verification of user login is achieved.
2. The method of claim 1, wherein: The browser includes a reading and storage interface for the asymmetric public key information of the national secret SM2 algorithm and an encryption and decryption interface of the SM2 algorithm, and the web site server can call the browser's public key information storage JS interface to obtain the public key information, including: Receive a username, user ID, and password as user information; The SM2 public key information of the current website and the current user stored in the browser is obtained, and the encryption and decryption interface of the SM2 algorithm of the browser is called according to the SM2 public key information for the current user.
3. The method of claim 2, wherein: If the public key information is not obtained, applying for new SM2 key pair information from the key management server and calling the browser's public key information storage JS interface to store the new public key information in the browser includes: If the public key information is not obtained and is within the validity period, the image acquisition module of the operating system is called to obtain the facial image information of the current user in real time; Both the facial information and the user information are sent to the background web server to trigger the background web server to send a request to the key management server to generate a new SM2 asymmetric key pair. The new SM2 asymmetric key pair is stored separately, wherein the private key information is matched with the user ID and password information and stored in the key management server, and the public key information is transmitted to the web page on the browser and saved by calling the browser's public key information storage JS interface.
4. The method of claim 2, wherein: The method further comprises: If the public key information is obtained and is within the validity period, then construct an information string to be encrypted, the information string including user name + user ID + password + random number + checksum; Call the browser's reading and storage interface for the asymmetric public key information of the national encryption SM2 algorithm, and encrypt the information string with the SM2 algorithm according to the user's public key information; The encrypted ciphertext is sent to the backend web server, and the user information is also sent to the backend web server synchronously.
5. The method of claim 4, wherein: The double verification of user login is implemented according to the new public key information, the user name and the user ID, including: Send the user name and password to perform primary identity authentication; When the primary identity authentication is successful, the user ID and the ciphertext are sent for secondary identity authentication, and the ciphertext is decrypted using the user's private key information obtained from the key management server.
6. The method of claim 5, wherein: The double verification of user login is implemented according to the new public key information, the user name and the user ID, including: Parse the decrypted string in the following format: username + user ID + password + random number + checksum; Verify the parsed username, user ID and password information for consistency with the information transmitted from the web page front end; If the consistency verification passes, it means that the secondary verification passes; otherwise, the login fails.
7. The method of claim 1, wherein: The method further comprises: If any user's key pair information is potentially leaked, an invalid user key list is established and maintained on the backend web server to automatically trigger the update of the user's private key information in the key management server and the user's public key information stored in the browser when the user logs in next time.
8. The method of claim 7, wherein: The method further comprises: The public key is stored in the client browser while the private key is stored in the key management server, and the decryption process of the ciphertext is placed in the background web server.
9. A browser-based login verification device, wherein: The device comprises: The calling module is used to call the public key information storage JS interface of the browser to obtain the public key information; An application module, for applying for new SM2 key pair information from a key management server and calling the browser's public key information storage JS interface to store the new public key information in the browser if the public key information is not obtained; and The verification module is used to implement double verification of user login based on the new public key information as well as the user name and user ID.
10. An electronic device comprising: processor; as well as A memory arranged to store computer executable instructions, which when executed cause the processor to perform the method of any one of claims 1 to 7.