Double-account rechecking authentication method and device based on section and cookie

Abstract

The invention relates to the technical field of authentication, in particular to a double-account recheck authentication method and device based on a section and cookie, and the method comprises the steps: S1, completing the verification of a main account; s2, sensitive operation is recognized, and a user is required to input auxiliary account verification information; s3, auxiliary account verification is completed at the rear end; s4, the back end generates a cookie containing authentication information after passing auxiliary verification, and the cookie is synchronized to a browser to be stored; and S5, reading the cookie stored in the browser by the back-end section, and extracting the authentication information to verify the auxiliary account. According to the invention, the operation frequency of the user during dual identity verification can be reduced, the operation efficiency is improved, and the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of authentication technology, and in particular to a dual-account verification authentication method and device based on aspect and cookie. Background Art

[0002] Business systems often involve some sensitive operations or important decisions, such as various operations on funds, user rights management, information release, or special operations defined in the business system. In these scenarios, in order to improve the security and reliability of the business system, dual-account verification and authentication are usually required. The traditional dual-account verification and authentication process usually requires users to provide verification information for the primary account and auxiliary account before performing sensitive operations. The system will perform the requested sensitive operation after the dual authentication verification is passed. However, this method will increase the number of user logins and reduce user experience.

[0003] Therefore, an efficient and secure dual-account review and authentication process is needed to solve this problem. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a dual-account review and authentication method based on aspects and cookies, which can reduce the number of operations required by users when performing dual identity authentication, improve operational efficiency, and improve user experience.

[0005] This application provides the following technical solutions:

[0006] A dual-account verification and authentication method based on aspects and cookies includes the following steps:

[0007] S1. Verify the user's primary account;

[0008] S2. When a sensitive operation scenario is identified, prompt the user to enter verification information for the auxiliary account;

[0009] S3. Obtain verification information of the auxiliary account, and complete verification through the auxiliary account verification interface of the backend business interface;

[0010] S4. If the user's auxiliary account information is successfully verified, a cookie is generated and synchronized to the browser for storage. The cookie contains the auxiliary account username and the authentication token, and the authentication token is bound to the auxiliary account username. If the verification fails, the user operation is intercepted and an error message is returned to the browser.

[0011] S5. Use the backend section to obtain the cookie from the preset browser section. The backend section includes a verification unit and an authentication information matching table. The verification unit extracts the auxiliary account username and authentication token from the cookie, and reads the relevant records in the authentication information matching table for verification. If the verification passes, sensitive operations are performed. If the verification fails, it is intercepted and an error is reported.

[0012] Technical principle: After completing the verification of the main account user, the user can perform non-sensitive operations; the user's sensitive operation request needs to first enter the auxiliary account information. After the back-end business interface verification is passed, cookie information is generated and synchronized to the browser for storage. The authentication cookie information contains the auxiliary account information and the bound authentication token; subsequently, when the browser initiates a sensitive operation request, the back-end section obtains the cookie from the section point set in the browser and extracts the auxiliary account information and authentication token for verification.

[0013] Beneficial effects: The dual-account verification and authentication process ensures the user's identity and authority, enhances the security and reliability of the system, and prevents malicious operations and illegal access;

[0014] By introducing the Cookie mechanism, users do not need to log in to the auxiliary account again during the verification and authentication process, which improves the user experience and reduces the number of logins.

[0015] Based on aspect programming technology, the integration and expansion of the review and authentication process is achieved without modifying the original application code, which improves the efficiency and convenience of the system.

[0016] Furthermore, the authentication token is generated in real time after the auxiliary account information is verified.

[0017] Beneficial effect: Generate a token bound to the auxiliary account username in real time, effectively improving the security of the authentication system.

[0018] Furthermore, the verification information of the auxiliary account includes one or more of face verification, fingerprint verification, username and password, SMS verification code, email verification, and CAPTCHA verification.

[0019] Furthermore, the cookies saved by the browser are deleted when the main account is logged out.

[0020] Beneficial effect: When the auxiliary account completes verification, the browser saves the cookie containing the authentication information. As long as the main user remains logged in, the backend can complete the auxiliary account verification step by reading the cookie when the user requests sensitive operations, realizing the verification and authentication process without the user repeatedly entering the auxiliary account information. When the main user logs out, the cookie is deleted to ensure that unauthenticated users cannot perform sensitive operations through authentication.

[0021] Furthermore, highly sensitive operations are classified. After the user passes the verification and authentication when performing the same type of highly sensitive operations, when the user needs to perform other types of sensitive operations, the browser clears the cookies.

[0022] Beneficial effects: After the user completes a sensitive operation, the relevant authentication information will be cleared. This is suitable for highly sensitive operations. It requires the user to re-provide the verification information of the auxiliary account before each sensitive operation, which can fully ensure the security of the business system. At the same time, the user only needs to enter the authentication information of the auxiliary account to complete the review and authentication, ensuring operational efficiency.

[0023] On the other hand, the present invention provides a dual-account verification and authentication device based on aspects and cookies, comprising an acquisition module, a first verification module, a second verification module, a third verification module and an execution module, wherein:

[0024] The acquisition module is used to acquire verification information input by the user, wherein the verification information includes primary account verification information and auxiliary account verification information;

[0025] The first verification module is used to verify the primary account verification information;

[0026] The second verification module is used to verify the auxiliary account verification information, and after the verification is passed, a cookie containing the auxiliary account username and authentication token is generated and synchronized to the acquisition module; if the verification fails, an error is reported to the acquisition module;

[0027] The third verification module uses the aspect to obtain the cookie from the acquisition module, extracts the auxiliary account username and authentication token from the cookie, verifies the auxiliary account, and sends an authentication pass signal to the execution module if the verification passes. If the verification fails, an error message is sent to the acquisition module.

[0028] The execution module calls the sensitive program operation interface through a signal based on the authentication.

[0029] Furthermore, the second verification module generates an authentication token in real time after the auxiliary account verification information is verified.

[0030] Furthermore, the auxiliary account verification information includes one or more of face verification, fingerprint verification, username and password, SMS verification code, email verification, and CAPTCHA verification.

[0031] Furthermore, the acquisition module clears the cookie when the primary account logs out.

[0032] Furthermore, the acquisition module classifies highly sensitive operations, and after the same type of highly sensitive operations are reviewed and authenticated, when sensitive operation requests of other types are obtained, the browser clears cookies and re-acquires verification information of the auxiliary account. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of the dual account verification and authentication method based on aspects and cookies;

[0034] Figure 2 The structure diagram of the dual account verification and authentication device based on aspects and cookies. DETAILED DESCRIPTION

[0035] The traditional dual-account authentication method requires the user to input the primary account verification information and the auxiliary account verification information at the same time, which requires more operations and reduces the user experience. The present invention provides a dual-account verification authentication method based on aspects and cookies, which can reduce the number of verification information input times of the user, and complete the verification authentication while improving the user experience.

[0036] The following is further described in detail through specific implementation methods:

[0037] Embodiment 1

[0038] This embodiment is a dual account verification and authentication method based on aspects and cookies. Figure 1 As shown, the following steps are included:

[0039] S1. Verify the user's primary account;

[0040] After the user completes the login verification of the main account in the browser, he can use the non-sensitive operations in the system normally. For example, after the user logs in to the online banking system using a browser, he can freely browse the predefined non-sensitive operations such as financial product information, bank recommended activities, deposit policies, etc. without verifying the auxiliary account.

[0041] S2. When a sensitive operation scenario is identified, prompt the user to enter verification information for the auxiliary account;

[0042] For example, when a user logs into the online banking system using a browser, selects the account page and clicks the query button, the system identifies that the fund query operation meets the definition of sensitive operations, and a pop-up window is displayed asking the user to perform auxiliary account verification. Auxiliary account verification can be performed in a variety of ways, which can be one or more of the following: username and password, SMS verification code, email verification, and CAPTCHA verification.

[0043] S3. Obtain verification information of the auxiliary account, and complete verification through the auxiliary account verification interface of the backend business interface;

[0044] After the user provides the auxiliary account verification information as required, the browser sends the obtained verification information to the background server, and the background server calls the corresponding auxiliary account verification interface to complete the verification process.

[0045] S4. If the user's auxiliary account information is successfully verified, a cookie is generated and synchronized to the browser for storage. The cookie contains the auxiliary account username and the authentication token, and the authentication token is bound to the auxiliary account username. If the verification fails, the user operation is intercepted and an error message is returned to the browser.

[0046] In this step, after the verification is passed, the background auxiliary account verification program generates an authentication token bound to the auxiliary account username and saves it to the redis database; at the same time, it generates a cookie containing the auxiliary account username and token, and synchronizes it to the browser for saving through the HTTP response header; if the verification fails, the server intercepts the user's operation and returns an error message, and the browser displays a prompt message to the user saying "User authentication failed!"

[0047] S5. Use aspect programming to obtain cookies from the preset browser cut-point. The cut-point contains a verification unit and an authentication information matching table. The authentication information matching table obtains the authentication token information from the redis database. The verification unit extracts the auxiliary account username and authentication token from the obtained cookie, and reads the relevant records of the authentication information matching table for verification. If the verification passes, sensitive operations are performed. If the verification fails, it is intercepted and an error is reported.

[0048] After the aspect passes the verification of the auxiliary account, the backend server writes the main account information, auxiliary account information and the type of sensitive operation into the system log. Before the user logs out of the main account, if other sensitive operations need to be performed, the verification unit of the aspect also executes according to the steps of S5. Since the browser stores the authentication information cookie, the user's double-check authentication can be completed without repeatedly entering the verification information of the two accounts.

[0049] When the user logs out of the main account, the browser clears the cookies, and unauthenticated users or other users who have only logged in to the main account cannot perform sensitive operations through double-checking and authentication.

[0050] Embodiment 2

[0051] Sensitive operations can be defined at different levels, including low-sensitivity operations and high-sensitivity operations. In order to further improve the user experience and system security performance, this embodiment performs different processing in step S5 for highly sensitive operations: highly sensitive operations are classified, and users can continuously perform the same type of sensitive operations after the same type of highly sensitive operations are reviewed and authenticated. When the user needs to perform sensitive operations of other levels, the browser clears the cookies, and the user needs to repeat steps S2 to S5 to re-complete the verification of the auxiliary account.

[0052] For example, if a user wants to check the number and number of personal bank cards, the system will classify it as the same type of highly sensitive operation; if a user wants to transfer funds or query funds, the system will define this type of operation as another type of highly sensitive operation. After the user enters the auxiliary account information for the first time and passes the verification, the user can continuously query the number of debit cards and credit cards, and query the card numbers of different bank cards. When the user selects a card to check the balance or transfer funds, the system clears the cookies and prompts the user to re-verify the auxiliary account.

[0053] Embodiment 3

[0054] This embodiment provides a dual account verification and authentication device based on slices and cookies, such as Figure 2 As shown, it includes an acquisition module, a first verification module, a second verification module, a third verification module and an execution module, wherein:

[0055] The acquisition module is used to acquire verification information input by the user, wherein the verification information includes primary account verification information and auxiliary account verification information;

[0056] The first verification module is used to verify the primary account verification information;

[0057] The second verification module is used to verify the auxiliary account verification information, and after the verification is passed, a cookie containing the auxiliary account username and authentication token is generated and synchronized to the acquisition module; if the verification fails, an error is reported to the acquisition module;

[0058] The third verification module uses the aspect to obtain the cookie from the acquisition module, extracts the auxiliary account username and authentication token from the cookie, verifies the auxiliary account, and sends an authentication pass signal to the execution module if the verification passes. If the verification fails, an error message is sent to the acquisition module.

[0059] The execution module calls the sensitive program operation interface through a signal based on the authentication.

[0060] In this embodiment, the acquisition module is implemented by the browser of the user end, and completes the functions of acquiring user verification information, sending user prompt information, saving cookies and authentication information, etc.

[0061] The first verification module and the second verification module are respectively implemented by a main account verification interface and an auxiliary account verification interface set on the backend server;

[0062] The third verification module is implemented by aspect programming. This aspect implants an incision in the browser to obtain the cookie information saved by the browser. At the same time, this aspect can obtain the authentication token saved in the redis database, generate an authentication information matching table, and verify the auxiliary account username and authentication token extracted from the cookie. When the verification passes, the sensitive operation requested by the user will be executed. If the verification fails, an error will be reported to the browser and the user operation will be intercepted. The browser will send an error prompt to the user that the verification failed.

[0063] The execution module is implemented by the sensitive operation interface caller in the server.

[0064] The specific working process of each module is as described in the first embodiment.

[0065] Embodiment 4

[0066] This embodiment provides a dual-account verification and authentication device based on aspects and cookies. Different from the third embodiment, the acquisition module classifies highly sensitive operations. After the same type of highly sensitive operation is verified and authenticated, when other types of sensitive operation requests are obtained, the browser clears the cookies and re-obtains the verification information of the auxiliary account. This verification and authentication method corresponds to the description of the second embodiment.

[0067] Embodiment 5

[0068] In this embodiment, different levels are set for sensitive operations, and the server generates graded cookie information according to the different levels of sensitive operations. For operations with higher sensitivity levels, the server sets the effective time limit and number of times for the cookie; for operations with lower sensitivity levels, the server sets the cookie to be valid for a long time, and adds a mark of low-level authentication passing to the cookie. For highly sensitive operations requested by users, the back-end aspect first detects whether there is a low-level authentication cookie for the same user. If not, it is executed according to normal authentication requirements. If a low-level authentication cookie already exists, it means that the user has authenticated the operation with a lower sensitivity level, and the information required for auxiliary account authentication for highly sensitive operations can be appropriately simplified, such as simplifying the face + password verification requirements to password verification. The simplified setting can be determined based on the length of time the cookie exists, the risk level of highly sensitive operations, etc.

[0069] The above are only embodiments of the present invention. The invention is not limited to the field involved in this implementation case. The common knowledge such as the known specific structure and characteristics in the scheme is not described in detail here. It should be pointed out that for those skilled in the art, several deformations and improvements can be made without departing from the structure of the present invention, which should also be regarded as the protection scope of the present invention, and these will not affect the effect of the implementation of the present invention and the practicality of the patent. The scope of protection required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. A dual account verification and authentication method based on aspects and cookies, characterized in that: The following steps are involved: S1. Verify the user's primary account; S2. When a sensitive operation scenario is identified, prompt the user to enter verification information for the auxiliary account; S3. Obtain verification information of the auxiliary account, and complete verification through the auxiliary account verification interface of the backend business interface; S4. If the user's auxiliary account information is successfully verified, a cookie is generated and synchronized to the browser for storage. The cookie contains the auxiliary account username and authentication token. The authentication token is bound to the auxiliary account username. If the verification fails, the user operation is intercepted and an error message is returned to the browser; S5. Use the backend section to obtain the cookie from the preset browser section. The backend section includes a verification unit and an authentication information matching table. The verification unit extracts the auxiliary account username and authentication token from the cookie, and reads the relevant records in the authentication information matching table for verification. If the verification passes, sensitive operations are performed. If the verification fails, it is intercepted and an error is reported.

2. According to claim 1, a dual account verification and authentication method based on aspects and cookies is characterized by: The authentication token is generated in real time after the auxiliary account information is verified.

3. According to claim 1, a dual account verification and authentication method based on aspects and cookies is characterized in that: The verification information of the auxiliary account includes one or more of face verification, fingerprint verification, username and password, SMS verification code, email verification, and CAPTCHA verification.

4. According to claim 1, a dual account verification and authentication method based on aspects and cookies is characterized in that: Delete the cookies saved by the browser when the main account logs out.

5. According to claim 1, a dual account verification and authentication method based on aspect and cookie, characterized in that: Highly sensitive operations are classified. After the user passes the verification and authentication when performing the same type of highly sensitive operations, when the user needs to perform other types of sensitive operations, the browser will clear the cookies.

6. A dual-account verification and authentication device based on slices and cookies, characterized in that: It includes an acquisition module, a first verification module, a second verification module, a third verification module and an execution module, wherein: The acquisition module is used to acquire verification information input by the user, wherein the verification information includes primary account verification information and auxiliary account verification information; The first verification module is used to verify the primary account verification information; The second verification module is used to verify the auxiliary account verification information, and after the verification is passed, a cookie containing the auxiliary account username and authentication token is generated and synchronized to the acquisition module; if the verification fails, an error is reported to the acquisition module; The third verification module uses the aspect to obtain the cookie from the acquisition module, extracts the auxiliary account username and authentication token from the cookie, verifies the auxiliary account, and sends an authentication pass signal to the execution module if the verification passes. If the verification fails, an error message is sent to the acquisition module. The execution module calls the sensitive program operation interface through a signal based on the authentication.

7. A dual-account verification and authentication device based on slices and cookies according to claim 6, characterized in that: The second verification module generates an authentication token in real time after the auxiliary account verification information is verified.

8. According to claim 6, a dual account verification and authentication device based on slices and cookies is characterized in that: The verification information of the auxiliary account includes one or more of face verification, fingerprint verification, username and password, SMS verification code, email verification, and CAPTCHA verification.

9. A dual-account verification and authentication device based on slices and cookies according to claim 6, characterized in that: The acquisition module clears the cookie when the primary account logs out.

10. A dual account verification and authentication device based on slices and cookies according to claim 6, characterized in that: The acquisition module classifies highly sensitive operations. After the same type of highly sensitive operations are reviewed and authenticated, when other types of sensitive operation requests are obtained, the browser clears the cookie and re-obtains the verification information of the auxiliary account.

Images