Account login method and device and computer readable storage medium

Abstract

The invention provides an account login method and device and a computer readable storage medium. The method comprises the following steps: receiving a generation instruction triggered by a user based on a first front end; according to the generation instruction, generating a temporary account, a temporary password and a token corresponding to login account information of the logged-in application; encrypting the temporary account, the temporary password and the generation time corresponding to the temporary account and the temporary password, and sending the ciphertext and the token to a back end, so that the back end decrypts the ciphertext and the token, obtains verification information according to the temporary account, the temporary password, the generation time and login account information of the logged-in application, and sends the verification information to the back end. And the verification information is stored in the back-end cache, and account login is realized based on the verification information in the back-end cache. According to the method, the device and the computer readable storage medium, the problem that an existing account login method cannot avoid sniffing of various sniffing tools and malicious tentative cracking can be solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an account login method, device and computer-readable storage medium. Background Art

[0002] With the continuous development of digital technology, various account authentication and encryption login methods are widely used in daily system use to ensure information security. The initial login method based on plain text account and password has gradually transitioned to various encryption algorithms, which are divided into reversible encryption algorithms and irreversible encryption algorithms. Irreversible encryption algorithms are further divided into symmetric encryption and asymmetric encryption. Authentication technology plays an important role in the security of various information systems in open environments. It is widely used in various computer communication networks, office automation and various password management systems. It is an effective method for authenticating various password management activities and behaviors.

[0003] However, the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide an account login method, device and computer-readable storage medium in view of the above-mentioned deficiencies in the prior art, so as to solve the problem that the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack.

[0005] In a first aspect, the present invention provides an account login method, which is applied to a first front end, where the first front end is a front end of a logged-in application, and the method includes:

[0006] Receiving a generation instruction triggered by a user based on the first front end;

[0007] Generate a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction;

[0008] The temporary account, temporary password and the generation time corresponding to the temporary account and temporary password are encrypted by the public key pre-stored in the first front end to obtain a ciphertext, and the ciphertext and the token are sent to the back end, so that the back end decrypts the ciphertext and the token by the private key pre-stored in the back end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtains verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and saves the verification information in the back end cache, and implements account login based on the verification information in the back end cache.

[0009] Furthermore, the method further comprises:

[0010] Receive and store the public key sent by the backend, where the public key is sent after the backend uses an asymmetric encryption algorithm to generate the public key and private key.

[0011] Furthermore, the sending of the ciphertext and the token to the backend specifically includes:

[0012] The ciphertext and the token are combined into a message, wherein the ciphertext is the body of the message and the token is the header of the message;

[0013] The message is sent to the back end in a plain text transmission mode.

[0014] In a second aspect, the present invention provides an account login method, which is applied to a backend, and the method comprises:

[0015] Receive the ciphertext and token sent by the first front end, wherein the ciphertext and token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, generating a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored by the first front end, and sending it after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application;

[0016] Decrypt the ciphertext and the token using the private key pre-stored in the backend to obtain the temporary account, temporary password, generation time, and login account information of the logged-in application;

[0017] Obtain verification information based on the temporary account, temporary password, generation time, and login account information of the logged-in application, and save the verification information in a backend cache;

[0018] Based on the verification information in the backend cache, account login is achieved.

[0019] Furthermore, the verification information includes a key-value pair of a real account corresponding to the logged-in application, a key-value pair of a temporary account, a key-value pair of a temporary password, and a key-value pair of a login deadline;

[0020] The verification information is obtained according to the temporary account, temporary password, generation time and login account information of the logged-in application, specifically including:

[0021] Generate a key-value pair of the temporary account, a key-value pair of the temporary password, and a key-value pair of the real account according to the temporary account, the temporary password, and the login account information of the logged-in application;

[0022] A key-value pair of the login deadline is generated according to the generation time and the preset agreed duration.

[0023] Furthermore, the account login is implemented based on the verification information in the backend cache, specifically including:

[0024] Receive the encrypted temporary account and temporary password sent by the second front end, where the encrypted temporary account and temporary password are sent by the second front end after encrypting the temporary account and temporary password input by the user using the public key pre-stored in the second front end, wherein the second front end is the front end of the application to be logged in;

[0025] Decrypt the encrypted temporary account and temporary password using the private key of the backend to obtain the temporary account and temporary password;

[0026] In response to the temporary account and temporary password being consistent with the temporary account and temporary password in the verification information and the receiving time corresponding to the encrypted temporary account and temporary password being before the login deadline in the verification information, a login token is obtained based on the real account in the verification information, and the login token is sent to the second front end. The login token is used to indicate a successful login.

[0027] Furthermore, the method further comprises:

[0028] The public key and the private key are generated by using an asymmetric encryption algorithm, and the public key is sent to the first front end and the second front end.

[0029] Furthermore, after obtaining a login token according to the real account in the verification information and sending the login token to the second front end, the method further includes:

[0030] Destroys the authentication information in the backend cache.

[0031] In a third aspect, the present invention provides an account login device, which is arranged at a first front end, the first front end is a front end of a logged-in application, and the device comprises:

[0032] A first receiving module, used to receive a generation instruction triggered by a user based on the first front end;

[0033] A generating module, connected to the first receiving module, for generating a token corresponding to a temporary account, a temporary password and login account information of a logged-in application according to the generating instruction;

[0034] An encryption and sending module is connected to the generation module, and is used to encrypt the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end to obtain a ciphertext, and send the ciphertext and the token to the back end, so that the back end decrypts the ciphertext and the token through the private key pre-stored in the back end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtain verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in the back end cache, and implement account login based on the verification information in the back end cache.

[0035] In a fourth aspect, the present invention provides an account login device, which is arranged at a back end, and the device comprises:

[0036] A second receiving module is used to receive the ciphertext and token sent by the first front end, wherein the ciphertext and token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, generating a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end, and sending after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application;

[0037] A decryption module, connected to the second receiving module, for decrypting the ciphertext and the token using the private key pre-stored in the backend to obtain the temporary account, temporary password, generation time, and login account information of the logged-in application;

[0038] A saving module is obtained, connected to the decryption module, and is used to obtain verification information according to the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in a backend cache;

[0039] The account login module is connected to the obtaining and saving module and is used to implement account login based on the verification information in the backend cache.

[0040] In a fifth aspect, the present invention provides an account login device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the account login method described in the first aspect or the second aspect above.

[0041] In a sixth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the account login method described in the first aspect or the second aspect is implemented.

[0042] The account login method, device and computer-readable storage medium provided by the present invention first receive a generation instruction triggered by a user based on a first front end; then generate a token corresponding to a temporary account, a temporary password and the login account information of a logged-in application according to the generation instruction; finally, encrypt the temporary account, the temporary password and the generation time corresponding to the temporary account and the temporary password by a public key pre-stored in the first front end to obtain a ciphertext, and send the ciphertext and the token to a back end, so that the back end decrypts the ciphertext and the token by a private key pre-stored in the back end to obtain the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and obtains verification information according to the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and saves the verification information in a back end cache, and implements account login based on the verification information in the back end cache. The present invention generates a temporary account, a temporary password and a token corresponding to the login account information of the application that has logged in to the first front-end through a first front-end, and uses a public key to encrypt the temporary account, temporary password and the corresponding generation time to obtain a ciphertext, and then sends the ciphertext and token to the back-end. After decryption, the back-end generates verification information based on the temporary account, temporary password, generation time and login account information and caches it, and implements account login based on the verification information in the cache, thereby avoiding sniffing by various sniffing tools and malicious attempts to crack, while reducing the cost of building a system authentication solution, and solving the problem that the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of an account login method according to Embodiment 1 of the present invention;

[0044] Figure 2 An interactive schematic diagram of an account login method according to an embodiment of the present invention;

[0045] Figure 3 This is a diagram of an application page showing a temporary account and a temporary password according to an embodiment of the present invention;

[0046] Figure 4 This is a flow chart of an account login method according to Embodiment 2 of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of an account login device according to Embodiment 3 of the present invention;

[0048] Figure 6 This is a schematic diagram of the structure of an account login device according to Embodiment 4 of the present invention;

[0049] Figure 7 This is a structural diagram of an account login device according to Example 5 of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0051] It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention rather than to limit the present invention.

[0052] It can be understood that, in the absence of conflict, the various embodiments of the present invention and the various features in the embodiments can be combined with each other.

[0053] It can be understood that, for the convenience of description, the drawings of the present invention only show the parts related to the present invention, while the parts irrelevant to the present invention are not shown in the drawings.

[0054] It can be understood that each unit and module involved in the embodiments of the present invention may correspond to only one physical structure, or may be composed of multiple physical structures, or multiple units and modules may be integrated into one physical structure.

[0055] It can be understood that, in the absence of conflict, the functions and steps marked in the flowcharts and block diagrams of the present invention may occur in an order different from that marked in the drawings.

[0056] It is understood that the flowcharts and block diagrams of the present invention illustrate the possible architectures, functions, and operations of the systems, devices, equipment, and methods according to the various embodiments of the present invention. Each box in the flowchart or block diagram may represent a unit, module, program segment, or code, which contains executable instructions for implementing the specified functions. Moreover, each box or combination of boxes in the block diagram and flowchart may be implemented by a hardware-based system that implements the specified functions, or may be implemented by a combination of hardware and computer instructions.

[0057] It can be understood that the units and modules involved in the embodiments of the present invention can be implemented by software or hardware. For example, the units and modules can be located in a processor.

[0058] Application Overview

[0059] With the continuous development of digital technology, various account authentication and encryption login methods are widely used in daily system use to ensure information security. From the initial login method based on plain text account and password, it gradually transitions to various encryption algorithms, which are divided into reversible encryption algorithms and irreversible encryption algorithms. Irreversible encryption algorithms are further divided into symmetric encryption and asymmetric encryption. The general evaluation of the security of the authentication system includes: ① Theoretical security. It has nothing to do with the computing power and time of the intruder. Any effort made by the intruder to decipher the authentication system is no greater than the probability of success of a random attack. ② Practical security. It is evaluated based on the amount of calculation required for the intruder to decipher the authentication system. If an authentication system can be deciphered in theory, but the existing computing power cannot complete it, it is called a computationally secure authentication system; if it can be proved that the difficulty of deciphering the authentication system is equivalent to solving a mathematical problem, it is called a provably secure authentication system. Authentication technology plays an important role in the security of various information systems in an open environment. It is widely used in various computer communication networks, office automation and various password management systems. It is an effective method for authenticating various password management activities and behaviors.

[0060] Disadvantages of existing technology:

[0061] 1. Login with plain text account and password: In the current network environment, the abuse of various sniffing tools has made the authentication system ineffective.

[0062] 2. Encryption algorithm: The salting algorithm can significantly reduce the success rate of database collision, but the user account password cannot be reused. In particular, after various systems require the use of passwords composed of complex numeric characters, users are forced to take shortcuts and change the passwords of various systems to the same, which greatly reduces system security.

[0063] 3. Single sign-on method: It has high requirements on the system and requires the separate development of a related single-point authentication module. Moreover, even if single sign-on is performed through https in the intranet environment, it is actually impossible to avoid being sniffed and leaked because most websites lack trusted CA certificate authentication.

[0064] 4. High authentication cost: When the backend management platform is used by few people and has low performance requirements, it is necessary to deploy complex authentication methods such as face and fingerprint authentication, which is costly.

[0065] In response to the above technical problems, the present application provides an account login method, device and computer-readable storage medium, which generates a temporary account, a temporary password and a token corresponding to the login account information of the application that has logged in by the first front end, and uses a public key to encrypt the temporary account, temporary password and the corresponding generation time to obtain a ciphertext, and then sends the ciphertext and token to the back end. After decryption, the back end generates verification information based on the temporary account, temporary password, generation time and login account information and caches it, and implements account login based on the verification information in the cache, thereby avoiding sniffing by various sniffing tools and malicious attempts to crack, while reducing the cost of building a system authentication solution, so as to at least solve the problem that the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack.

[0066] After introducing the basic principles of the present application, various non-limiting embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0067] Embodiment 1:

[0068] This embodiment provides an account login method, which is applied to a first front end, where the first front end is a front end of a logged-in application, such as Figure 1 As shown, the method includes:

[0069] Step S101: receiving a generation instruction triggered by a user based on a first front end.

[0070] Specifically, when a user triggers a generation instruction by single-clicking, double-clicking, long pressing, or touching a preset object, where the preset object can be any form of button, text, picture, etc., the first front end receives the user's generation instruction.

[0071] In an optional embodiment, the method further includes:

[0072] Receive and store the public key sent by the backend, where the public key is sent after the backend uses an asymmetric encryption algorithm to generate the public key and private key.

[0073] It should be noted that the backend may be the backend of the logged-in application, the backend of the application to be logged-in, or the backend of other applications except the logged-in application and the application to be logged-in.

[0074] Specifically, the backend generates a pair of public and private keys using an asymmetric encryption algorithm, the backend stores the private key and sends the public key to the first frontend, and the first frontend receives and stores the public key sent by the backend.

[0075] It should be noted that public keys and private keys can also be generated and distributed by a third-party authority using an asymmetric encryption algorithm.

[0076] Step S102: Generate a token corresponding to a temporary account, a temporary password, and the login account information of the logged-in application according to the generation instruction.

[0077] Specifically, the first front end randomly generates a temporary account and a temporary password based on the generation instruction, extracts the login account information of the currently cached logged-in application, and uses the public key encryption to generate a token corresponding to the login account information of the logged-in application.

[0078] It should be noted that after the first front end randomly generates the temporary account and temporary password, it displays the temporary account and temporary password on the application page so that the user can obtain the temporary account and temporary password.

[0079] Step S103: Encrypt the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front-end to obtain a ciphertext, and send the ciphertext and the token to the back-end, so that the back-end decrypts the ciphertext and the token through the private key pre-stored in the back-end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtain verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in the back-end cache, and implement account login based on the verification information in the back-end cache.

[0080] Specifically, the first front end extracts the timestamp when the temporary account and temporary password are generated (that is, the generation time corresponding to the temporary account and temporary password), and combines them using an agreed format. For example, the temporary account, temporary password, and timestamp can be combined into the format of temporary account:temporary password|timestamp, and the combined temporary account, temporary password, and timestamp are encrypted using the public key to generate ciphertext.

[0081] Specifically, the specific method for the first front end to send the ciphertext and the token to the back end may be to form a message with the ciphertext and the token, wherein the ciphertext is the body of the message and the token is the header of the message; and send the message to the back end in plain text transmission. This can greatly reduce the cost of front-end security transformation and is almost impossible to crack.

[0082] Specifically, the back end receives the message sent by the first front end, uses the private key to decrypt the ciphertext in the message to obtain the temporary account, temporary password and timestamp in the agreed format, and uses the private key to decrypt the token in the message to obtain the login account information of the logged-in application, generates a key-value pair of the temporary account according to the temporary account, generates a key-value pair of the temporary password according to the temporary password, generates a key-value pair of the real account corresponding to the logged-in application according to the login account information of the logged-in application, and adds the timestamp to the preset agreed duration The corresponding time is used as the login deadline. For example, assuming the timestamp is 7:00 and the agreed duration is 2 minutes, the login deadline is 7:02, and generates a key-value pair of the login deadline based on the login deadline. The key-value pair of the real account corresponding to the logged-in application, the key-value pair of the temporary account, the key-value pair of the temporary password, and the key-value pair of the login deadline are used as verification information, and are written into the backend cache to save the verification information.

[0083] It should be noted that in order to facilitate data recovery when abnormalities such as program crashes and power outages occur, the verification information can be written into the background database as needed.

[0084] Specifically, the specific method for implementing account login based on the verification information in the back-end cache can be that the user inputs the temporary account and temporary password obtained from the first front-end on the second front-end, the second front-end receives the temporary account and temporary password entered by the user, encrypts the temporary account and temporary password using the public key sent by the back-end that was previously received and stored, and then sends them to the back-end, the back-end receives the encrypted temporary account and temporary password sent by the second front-end, and records the receiving time corresponding to the current encrypted temporary account and temporary password, decrypts them using the private key, and compares them with the verification information saved in the back-end cache, if the temporary account and temporary password match the temporary account and temporary password in the verification information, and the receiving time is before the login deadline, the back-end issues a login token containing the real account to the second front-end cache, and the second front-end interface prompts that the login is successful and jumps to the home page.

[0085] It should be noted that if the account login fails, the user needs to restart the relevant process. Regardless of whether the verification fails or not, the verification information saved in the backend cache will be destroyed.

[0086] It is worth mentioning that the present invention is based on the first front-end dynamically generating a token encryption carrying a temporary account and password, and the back-end decrypts the cache and immediately destroys the right after account authentication. Other parties cannot imitate and use it without authorization. The purpose of the present invention is to reuse the authenticated account information on the front end to generate a temporary account and password, and adopt a technical solution of reading and burning it, which can avoid sniffing by various sniffing tools and malicious attempts to crack, while reducing the cost of building a system authentication solution.

[0087] In a specific embodiment, an account login method for reusing complex account authentication of front-end applications is provided, and the corresponding interaction diagram is as follows: Figure 2 As shown, the account login method may specifically include the following:

[0088] 1. First, use an asymmetric encryption algorithm to generate a pair of public and private keys. The public key is saved in the user-side logged-in application front-end (i.e., the first front-end) and the back-end management system front-end (i.e., the second front-end) code, and the private key is saved in the application back-end code;

[0089] 2. When the backend administrator clicks the relevant module in the front-end application of the logged-in application, the application is triggered to generate a random temporary account and a random temporary password, such as Figure 3 As shown, it is displayed on the application page, and the current timestamp is extracted. After combining them in the agreed format (such as account: password | timestamp), it is encrypted using the public key to generate ciphertext;

[0090] The ciphertext tokenStr is as follows (due to the use of timestamp salt, even if the same account password is generated with a very small probability, the generated ciphertext will be different):

[0091] {"tokenStr":"R9+r3sJtuD46XZJ6DecBhQTDn4gge+RO3WQJy R47z / YMrKMkk5mGuvouD / 9HdoYKe4gG9yRoi39PIZpI / 8W / W7CU RiUagLAf1JLWiBqya6Ty9YI0hg1EdYuTDQw2i8I90bcAFGnwBmR QEK97ECRRN2fyqBa1XauPO5PgMwFECnz6lwoyyceUpzRpz8HO2MOdep0F3Yg56Ab5nXVevGJjA+SE nuk1NymgCR3vgnm3dS8z8Yk3tfNcMBELCflsGexx6PNTNiZkDaYaRl4 / qF7p6l8GtfjFdE1ZPBBVo iT8mBYV7BkCIeq3G7b5MVf3ETZSolTH0zoaZb334mMJcfshyMg30qeXnAD20iGEzYtdNgrM7iL1ZQzQ1xBL7W9zsJv3Kr8+2SNG755nQr4b+q+IP8NRSjDiuzuRFxTOo M96Gruf7UZyjw1aIbxuIG9bvby4QW2tE5K+oecWu8OJhOWrOVN+9TzcWFpH7K7qUPYMMeQYE+zH6ZdI6pJrgPwhtdjfxaqTRgTrF4czKgLfAe+09Td7N0pniyLqb4+yq E+mN7mpE+Ho5C9IaLMrV4 / KEPqxZlBD8C+MbPIthrqlDOhH+W3N47nCy+iNPkK4HIGlYanTJrH2qDExemwhvNM6kD / xkd5E7mU077SmmMot2ybUe / c1jEQ1wVERyobkIoaFmxw="}

[0092] 3. The front-end application of the logged-in application extracts the currently cached login account information, encrypts it with the public key, generates a token and two ciphertexts to form a message, where the message body is the ciphertext and the message header is the token, which are transmitted to the back-end program together, which can greatly reduce the cost of front-end security transformation and is almost impossible to crack;

[0093] 4. After receiving the message, the backend uses the private key to decrypt the ciphertext and obtains the agreed format (such as account: password | timestamp) combination, decrypts the real login account information carried in the message header, generates a key-value pair of the real account, temporary account, temporary password and login deadline (timestamp + agreed duration, such as 2 minutes), and writes it to the backend cache to save the verification information, and writes it to the backend database as needed (data serialization storage is convenient for data recovery when program crashes, power outages, etc. occur);

[0094] The backend response message is as follows (result contains the decrypted real login account):

[0095]

[0096] The key-value pairs in the cache are written to the backend database. The ciphertext tokenStr generated in point 2 has been successfully decrypted. The key-value pairs are written to the backend database as shown in Table 1 (the format is for reference only, as long as they can be compared when logging in):

[0097] Table 1: Records of key-value pairs written into the backend database

[0098]

[0099]

[0100] 5. The backend administrator uses the temporary account and temporary password to log in to the front end of the backend management system. The application uses the public key to encrypt the temporary account and temporary password and sends them to the backend program. The backend records the current receiving time. The backend program uses the private key to decrypt and compare the verification information saved in the backend cache. If the temporary account and temporary password match, and the receiving time is before the login deadline (such as 2 minutes), the backend program issues a login token containing the real account to the front-end cache of the backend management system. The front-end interface prompts that the login is successful and jumps to the home page. If the login fails, the user needs to start the relevant process again from point 2. Regardless of whether the verification fails or not, the verification information saved in the backend cache is destroyed.

[0101] 6. You can make full use of the login information authenticated by high-security authentication systems (such as face, fingerprint, etc.) such as the company's external network APP or mini-programs, reuse the unified account system on the back-end management platform that cannot access the intranet within the company, and use asymmetric encryption, validity period salting, and read-and-destroy technology to ensure user password security and save investment.

[0102] The account login method provided by the embodiment of the present invention first receives a generation instruction triggered by a user based on a first front-end; then, according to the generation instruction, generates a token corresponding to a temporary account, a temporary password and the login account information of the logged-in application; finally, the temporary account, the temporary password and the generation time corresponding to the temporary account and the temporary password are encrypted by the public key pre-stored in the first front-end to obtain a ciphertext, and the ciphertext and the token are sent to the back-end, so that the back-end decrypts the ciphertext and the token by the private key pre-stored in the back-end to obtain the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and obtains verification information based on the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and saves the verification information in the back-end cache, and implements account login based on the verification information in the back-end cache. The present invention generates a temporary account, a temporary password and a token corresponding to the login account information of the application that has logged in to the first front-end through a first front-end, and uses a public key to encrypt the temporary account, temporary password and the corresponding generation time to obtain a ciphertext, and then sends the ciphertext and token to the back-end. After decryption, the back-end generates verification information based on the temporary account, temporary password, generation time and login account information and caches it, and implements account login based on the verification information in the cache, thereby avoiding sniffing by various sniffing tools and malicious attempts to crack, while reducing the cost of building a system authentication solution, and solving the problem that the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack.

[0103] Embodiment 2:

[0104] This embodiment provides an account login method, which is applied to the back end, such as Figure 4 As shown, the method includes:

[0105] Step S201: Receive the ciphertext and token sent by the first front end, the ciphertext and the token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, and generating a temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end, and sending it after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application.

[0106] Specifically, the back end receives a message sent by the first front end, wherein the message consists of a ciphertext and a token, the ciphertext is the body of the message, and the token is the header of the message.

[0107] In an optional embodiment, the method further includes:

[0108] The public key and the private key are generated by using an asymmetric encryption algorithm, and the public key is sent to the first front end and the second front end.

[0109] Specifically, the backend generates a pair of public and private keys using an asymmetric encryption algorithm, the backend stores the private key and sends the public key to the first front end and the second front end, and the first front end and the second front end receive and store the public key sent by the backend.

[0110] Step S202: decrypting the ciphertext and the token using the private key pre-stored in the backend to obtain the temporary account, temporary password, generation time, and login account information of the logged-in application;

[0111] Specifically, the backend uses the private key to decrypt the ciphertext in the message to obtain the temporary account, temporary password and timestamp in the agreed format, and uses the private key to decrypt the token in the message to obtain the login account information of the logged-in application.

[0112] Step S203: obtaining verification information according to the temporary account, temporary password, generation time and login account information of the logged-in application, and saving the verification information in the backend cache.

[0113] Specifically, based on the temporary account, temporary password, generation time and login account information of the logged-in application, verification information is obtained and written into the backend cache to save the verification information.

[0114] In an optional embodiment, the verification information includes a key-value pair of a real account corresponding to the logged-in application, a key-value pair of a temporary account, a key-value pair of a temporary password, and a key-value pair of a login deadline;

[0115] The verification information is obtained according to the temporary account, temporary password, generation time and login account information of the logged-in application, specifically including:

[0116] Generate a key-value pair of the temporary account, a key-value pair of the temporary password, and a key-value pair of the real account according to the temporary account, the temporary password, and the login account information of the logged-in application;

[0117] A key-value pair of the login deadline is generated according to the generation time and the preset agreed duration.

[0118] Specifically, a key-value pair of the temporary account is generated based on the temporary account, a key-value pair of the temporary password is generated based on the temporary password, a key-value pair of the real account corresponding to the logged-in application is generated based on the login account information of the logged-in application, the time corresponding to the time obtained by adding the preset agreed duration to the timestamp is used as the login deadline, and a key-value pair of the login deadline is generated based on the login deadline.

[0119] Step S204: Implement account login based on the verification information in the backend cache.

[0120] In an optional embodiment, implementing account login based on the verification information in the backend cache specifically includes:

[0121] Receive the encrypted temporary account and temporary password sent by the second front end, where the encrypted temporary account and temporary password are sent by the second front end after encrypting the temporary account and temporary password input by the user using the public key pre-stored in the second front end, wherein the second front end is the front end of the application to be logged in;

[0122] Decrypt the encrypted temporary account and temporary password using the private key of the backend to obtain the temporary account and temporary password;

[0123] In response to the temporary account and temporary password being consistent with the temporary account and temporary password in the verification information and the receiving time corresponding to the encrypted temporary account and temporary password being before the login deadline in the verification information, a login token is obtained based on the real account in the verification information, and the login token is sent to the second front end. The login token is used to indicate a successful login.

[0124] Specifically, the specific method for implementing account login based on the verification information in the back-end cache can be that the user inputs the temporary account and temporary password obtained from the first front-end on the second front-end, the second front-end receives the temporary account and temporary password entered by the user, encrypts the temporary account and temporary password using the public key sent by the back-end that was previously received and stored, and then sends them to the back-end, the back-end receives the encrypted temporary account and temporary password sent by the second front-end, and records the receiving time corresponding to the current encrypted temporary account and temporary password, decrypts them using the private key, and compares them with the verification information saved in the back-end cache, if the temporary account and temporary password match the temporary account and temporary password in the verification information, and the receiving time is before the login deadline, the back-end issues a login token containing the real account to the second front-end cache, and the second front-end interface prompts that the login is successful and jumps to the home page.

[0125] It should be noted that if the account login fails, the user needs to restart the relevant process. Regardless of whether the verification fails or not, the verification information saved in the backend cache will be destroyed.

[0126] Embodiment 3:

[0127] like Figure 5 As shown, this embodiment provides an account login device, which is arranged in a first front end, and the first front end is the front end of the logged-in application, and is used to execute the account login method in the above embodiment 1, including:

[0128] A first receiving module 11 is used to receive a generation instruction triggered by a user based on a first front end;

[0129] A generating module 12, connected to the first receiving module 11, for generating a token corresponding to a temporary account, a temporary password and login account information of a logged-in application according to the generating instruction;

[0130] The encryption and sending module 13 is connected to the generation module 12, and is used to encrypt the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end to obtain the ciphertext, and send the ciphertext and the token to the back end, so that the back end decrypts the ciphertext and the token through the private key pre-stored in the back end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtain verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in the back end cache, and implement account login based on the verification information in the back end cache.

[0131] Furthermore, the device also includes:

[0132] The receiving and storing module is used to receive and store the public key sent by the back end, where the public key is sent after the back end uses an asymmetric encryption algorithm to generate the public key and private key.

[0133] Furthermore, the encryption sending module 13 includes:

[0134] A composition unit, used to combine the ciphertext and the token into a message, wherein the ciphertext is the body of the message and the token is the header of the message;

[0135] The sending unit is used to send the message to the back end in a plain text transmission mode.

[0136] Embodiment 4:

[0137] like Figure 6 As shown, this embodiment provides an account login device, which is arranged at the back end and is used to execute the account login method in the above embodiment 2, including:

[0138] The second receiving module 21 is used to receive the ciphertext and token sent by the first front end, wherein the ciphertext and token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, generating a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end, and sending after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application;

[0139] A decryption module 22, connected to the second receiving module 21, is used to decrypt the ciphertext and the token by using the private key pre-stored in the back-end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application;

[0140] A storage module 23 is obtained, which is connected to the decryption module 22, and is used to obtain verification information according to the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in the backend cache;

[0141] The account login module 24 is connected to the obtaining and saving module 23 and is used to implement account login based on the verification information in the backend cache.

[0142] Furthermore, the verification information includes a key-value pair of a real account corresponding to the logged-in application, a key-value pair of a temporary account, a key-value pair of a temporary password, and a key-value pair of a login deadline;

[0143] The obtaining and saving module 23 comprises:

[0144] A first generating unit, configured to generate a key-value pair of the temporary account, a key-value pair of the temporary password, and a key-value pair of the real account according to the temporary account, the temporary password, and the login account information of the logged-in application;

[0145] The second generating unit is used to generate a key-value pair of the login deadline according to the generating time and a preset agreed duration.

[0146] Furthermore, the account login module 24 specifically includes:

[0147] A first receiving unit is used to receive an encrypted temporary account and temporary password sent by a second front end, wherein the encrypted temporary account and temporary password are sent after the second front end encrypts the temporary account and temporary password input by the user using a public key pre-stored by the second front end, wherein the second front end is a front end of an application to be logged in;

[0148] A decryption unit, used to decrypt the encrypted temporary account and temporary password by using the private key of the backend to obtain the temporary account and temporary password;

[0149] A sending unit is obtained, which is used to obtain a login token according to the real account in the verification information in response to the temporary account and temporary password being consistent with the temporary account and temporary password in the verification information and the receiving time corresponding to the encrypted temporary account and temporary password being before the login deadline in the verification information, and send the login token to the second front end, wherein the login token is used to indicate a successful login.

[0150] Furthermore, the device also includes:

[0151] A generating and sending module is used to generate the public key and the private key by adopting an asymmetric encryption algorithm, and send the public key to the first front end and the second front end.

[0152] Furthermore, the device also includes:

[0153] The destruction module is used to destroy the verification information in the backend cache.

[0154] Embodiment 5:

[0155] refer to Figure 7 This embodiment provides an account login device, including a memory 31 and a processor 32. The memory 31 stores a computer program, and the processor 32 is configured to run the computer program to execute the account login method in Example 1, or execute the account login method in Example 2.

[0156] The memory 31 is connected to the processor 32 . The memory 31 may be a flash memory, a read-only memory or other memory. The processor 32 may be a central processing unit or a single-chip microcomputer.

[0157] Embodiment 6:

[0158] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the account login method in the above-mentioned embodiment 1 or embodiment 2 is implemented.

[0159] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0160] In summary, the account login method, device and computer-readable storage medium provided by the embodiments of the present invention first receive a generation instruction triggered by a user based on a first front-end; then, according to the generation instruction, generate a token corresponding to a temporary account, a temporary password and the login account information of the logged-in application; finally, encrypt the temporary account, the temporary password and the generation time corresponding to the temporary account and the temporary password through the public key pre-stored in the first front-end to obtain a ciphertext, and send the ciphertext and the token to the back-end, so that the back-end decrypts the ciphertext and the token through the private key pre-stored in the back-end to obtain the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and obtains verification information based on the temporary account, the temporary password, the generation time and the login account information of the logged-in application, and saves the verification information in the back-end cache, and implements account login based on the verification information in the back-end cache. The present invention generates a temporary account, a temporary password and a token corresponding to the login account information of the application that has logged in to the first front-end through a first front-end, and uses a public key to encrypt the temporary account, temporary password and the corresponding generation time to obtain a ciphertext, and then sends the ciphertext and token to the back-end. After decryption, the back-end generates verification information based on the temporary account, temporary password, generation time and login account information and caches it, and implements account login based on the verification information in the cache, thereby avoiding sniffing by various sniffing tools and malicious attempts to crack, while reducing the cost of building a system authentication solution, and solving the problem that the existing account login method cannot avoid sniffing by various sniffing tools and malicious attempts to crack.

[0161] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. An account login method, characterized in that: Applied to a first front end, the first front end being a front end of a logged-in application, the method comprises: Receiving a generation instruction triggered by a user based on the first front end; Generate a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction; The temporary account, temporary password and the generation time corresponding to the temporary account and temporary password are encrypted by the public key pre-stored in the first front end to obtain a ciphertext, and the ciphertext and the token are sent to the back end, so that the back end decrypts the ciphertext and the token by the private key pre-stored in the back end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtains verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and saves the verification information in the back end cache, and implements account login based on the verification information in the back end cache.

2. The method according to claim 1, characterized in that The method further comprises: Receive and store the public key sent by the backend, where the public key is sent after the backend uses an asymmetric encryption algorithm to generate the public key and private key.

3. The method according to claim 1, characterized in that The sending of the ciphertext and the token to the backend specifically includes: The ciphertext and the token are combined into a message, wherein the ciphertext is the body of the message and the token is the header of the message; The message is sent to the back end in a plain text transmission mode.

4. An account login method, characterized in that: Applied to the backend, the method includes: Receive the ciphertext and token sent by the first front end, wherein the ciphertext and token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, generating a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored by the first front end, and sending it after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application; Decrypt the ciphertext and the token using the private key pre-stored in the backend to obtain the temporary account, temporary password, generation time, and login account information of the logged-in application; Obtain verification information based on the temporary account, temporary password, generation time, and login account information of the logged-in application, and save the verification information in a backend cache; Based on the verification information in the backend cache, account login is achieved.

5. The method according to claim 4, characterized in that The verification information includes a key-value pair of the real account corresponding to the logged-in application, a key-value pair of the temporary account, a key-value pair of the temporary password, and a key-value pair of the login deadline; The verification information is obtained according to the temporary account, temporary password, generation time and login account information of the logged-in application, specifically including: Generate a key-value pair of the temporary account, a key-value pair of the temporary password, and a key-value pair of the real account according to the temporary account, the temporary password, and the login account information of the logged-in application; A key-value pair of the login deadline is generated according to the generation time and the preset agreed duration.

6. The method according to claim 5, characterized in that Implementing account login based on the verification information in the backend cache specifically includes: Receive the encrypted temporary account and temporary password sent by the second front end, where the encrypted temporary account and temporary password are sent by the second front end after encrypting the temporary account and temporary password input by the user using the public key pre-stored in the second front end, wherein the second front end is the front end of the application to be logged in; Decrypt the encrypted temporary account and temporary password using the private key of the backend to obtain the temporary account and temporary password; In response to the temporary account and temporary password being consistent with the temporary account and temporary password in the verification information and the receiving time corresponding to the encrypted temporary account and temporary password being before the login deadline in the verification information, a login token is obtained based on the real account in the verification information, and the login token is sent to the second front end. The login token is used to indicate a successful login.

7. The method according to claim 6, characterized in that The method further comprises: The public key and the private key are generated by using an asymmetric encryption algorithm, and the public key is sent to the first front end and the second front end.

8. The method according to claim 6, characterized in that After obtaining a login token according to the real account in the verification information and sending the login token to the second front end, the method further includes: Destroys the authentication information in the backend cache.

9. An account login device, characterized in that: Set at a first front end, the first front end is the front end of the logged-in application, and the device includes: A first receiving module, used to receive a generation instruction triggered by a user based on the first front end; A generating module, connected to the first receiving module, for generating a token corresponding to a temporary account, a temporary password and login account information of a logged-in application according to the generating instruction; An encryption and sending module is connected to the generation module, and is used to encrypt the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end to obtain a ciphertext, and send the ciphertext and the token to the back end, so that the back end decrypts the ciphertext and the token through the private key pre-stored in the back end to obtain the temporary account, temporary password, generation time and login account information of the logged-in application, and obtain verification information based on the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in the back end cache, and implement account login based on the verification information in the back end cache.

10. An account login device, characterized in that: Arranged at the back end, the device comprises: A second receiving module is used to receive the ciphertext and token sent by the first front end, wherein the ciphertext and token are generated by the first front end after receiving the generation instruction triggered by the user based on the first front end, generating a token corresponding to the temporary account, temporary password and login account information of the logged-in application according to the generation instruction, and encrypting the temporary account, temporary password and the generation time corresponding to the temporary account and temporary password through the public key pre-stored in the first front end, and sending after obtaining the ciphertext, wherein the first front end is the front end of the logged-in application; A decryption module, connected to the second receiving module, for decrypting the ciphertext and the token by using the private key pre-stored in the back-end to obtain the temporary account, temporary password, generation time, and login account information of the logged-in application; A saving module is obtained, connected to the decryption module, and is used to obtain verification information according to the temporary account, temporary password, generation time and login account information of the logged-in application, and save the verification information in a backend cache; The account login module is connected to the obtaining and saving module and is used to implement account login based on the verification information in the backend cache.

11. An account login device, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to implement the account login method as described in any one of claims 1-3, or to implement the account login method as described in any one of claims 4-8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the account login method according to any one of claims 1 to 3 is implemented, or the account login method according to any one of claims 4 to 8 is implemented.

Images