Session processing method and device based on timeout locking, equipment and storage medium

Abstract

The invention belongs to the field of message security and finance, and relates to a session processing method based on timeout locking, which comprises the following steps: when the idle time of a current session exceeds a session idle time threshold, generating a notification message in a specific format containing a session locking instruction, and sending the notification message to a client for analysis through a secure channel, the method comprises the following steps: acquiring a session locking instruction, locking a current session according to the session locking instruction, monitoring a user input command, outputting a password input prompt, encrypting a user input password to obtain an encrypted input password, determining whether authentication is passed according to the encrypted input password and a pre-stored encrypted storage password, and if the authentication is passed, locking the current session according to the session locking instruction. And unlocking the locking of the current session, and exiting the session operation when the authentication is not passed. The invention further provides a session processing device and equipment based on timeout locking and a storage medium. In addition, the invention also relates to a block chain technology, and the notification information can be stored in a block chain. The risk of potential errors can be reduced.

Description

Technical Field

[0001] The present application relates to the fields of information security and financial technology, and in particular to a session processing method, apparatus, device and storage medium based on timeout locking. Background Art

[0002] With the rapid development of information technology, computer systems have become the core platform for financial institutions to process a large number of transactions, manage customer information and ensure data security. In computer science, the session mechanism, as a key means of maintaining user status, plays a vital role in improving the efficiency, security and personalized experience of financial services.

[0003] Specifically, the session mechanism allows the server and client to share state information over multiple request and response cycles, thereby effectively supporting the continuous processing of complex financial services such as online transactions, account inquiries, and personalized recommendations. A session is usually initiated when a user passes authentication, such as logging in, and ends when the user actively logs out or a timeout mechanism is triggered due to long periods of inactivity. The management of this life cycle, including the creation, update, and destruction of sessions, is mainly performed by the server to ensure data consistency and security.

[0004] In financial applications, the advantages of the session mechanism are particularly significant. On the one hand, by maintaining the user session state, the server can avoid re-authenticating the user or retrieving user information on each request, thereby significantly reducing the server's processing load and improving the system's response speed and throughput. On the other hand, the session mechanism also provides a basis for implementing user personalized services. For example, it allows users to save their personalized configurations such as transaction preferences and interface settings, and automatically restore them in subsequent sessions, greatly improving the user experience.

[0005] However, as a key link in the session mechanism, session timeout management has a direct impact on system security and user experience. Currently, common session timeout implementation methods are mainly divided into time-based timeout and event-based timeout. The time-based timeout method is widely used because of its simple implementation and easy control. When a session timeout occurs, the system usually takes measures such as closing the process and connection, terminating the current session, or locking the session and requiring the user to re-enter the password to ensure that the data is not accessed by unauthorized persons.

[0006] When dealing with session timeout lock, the traditional approach is to implement the corresponding interface on the server and client respectively, and implement this function through the collaboration of both parties. However, this method has significant problems: first, it requires a lot of code modifications on both the server and client sides, which not only increases development costs, but may also introduce more potential errors due to the large amount of code changes; second, the interface docking and debugging process between the server and the client is complicated, which is easy to cause compatibility issues, further increasing the difficulty and risk of system maintenance. Summary of the invention

[0007] The purpose of the embodiments of the present application is to propose a session processing method, apparatus, device and storage medium based on timeout locking, so as to solve the technical problems that when the related technology processes session timeout locking, more potential errors are introduced due to large code changes, and the interface docking and debugging process between the server and the client is complicated and has poor compatibility.

[0008] In order to solve the above technical problems, the embodiment of the present application provides a session processing method based on timeout locking, which adopts the following technical solution:

[0009] Obtaining a session idle time threshold preset by the server, and determining whether the idle time of the current session exceeds the session idle time threshold;

[0010] When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel;

[0011] receiving the notification message, parsing the notification message through the client, obtaining the session locking instruction, and locking the current session according to the session locking instruction;

[0012] Monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user;

[0013] Sending the password input by the user to the server through the secure channel;

[0014] Receiving the password input by the user, and encrypting the password input by the user by the server using a preset encryption algorithm to obtain an encrypted input password;

[0015] Obtaining a pre-stored encrypted storage password of the user, and determining whether the authentication is successful according to the encrypted input password and the encrypted storage password;

[0016] When the authentication is passed, the current session is unlocked through the client; when the authentication is not passed, an authentication failure prompt is output and an exit session operation is performed.

[0017] In order to solve the above technical problems, the embodiment of the present application further provides a session processing device based on timeout locking, which adopts the following technical solution:

[0018] An acquisition module is used to acquire a session idle time threshold preset by the server, and determine whether the idle time of the current session exceeds the session idle time threshold;

[0019] A message generating module, configured to generate a notification message in a specific message format including a session locking instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel;

[0020] A locking module, configured to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction;

[0021] The monitoring module is used to monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user;

[0022] A sending module, used for sending the password input by the user to the server through the secure channel;

[0023] An encryption module is used to receive the password input by the user, and encrypt the password input by the user by using a preset encryption algorithm through the server to obtain an encrypted input password;

[0024] An authentication module, used to obtain a pre-stored encrypted storage password of the user, and determine whether the authentication is successful based on the encrypted input password and the encrypted storage password;

[0025] The execution module is used to unlock the current session through the client when the authentication is passed; when the authentication is not passed, output an authentication failure prompt and execute an exit session operation.

[0026] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0027] The computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the session processing method based on timeout locking as described above when executing the computer-readable instructions.

[0028] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0029] The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps of the session processing method based on timeout locking as described above are implemented.

[0030] Compared with the prior art, this application has the following beneficial effects:

[0031] The present application provides a session processing method based on timeout locking, which obtains a session idle time threshold preset by a server, generates a notification message in a specific format including a session locking instruction when the idle time of the current session exceeds the session idle time threshold, and sends the notification message to a client through a preset secure channel, parses the notification message through the client, obtains the session locking instruction, and locks the current session according to the session locking instruction, outputs a password input prompt when a user input command is detected, obtains the user input password, sends the user input password to the server, encrypts it to obtain the encrypted input password, obtains the pre-stored encrypted storage password of the user, and according to the encrypted The secret input password and the encrypted storage password are used to determine whether the authentication is successful. When the authentication is successful, the current session is unlocked through the client. When the authentication fails, an authentication failure prompt is output and the session exit operation is executed. This application identifies the timeout by passing a notification message in a specific format containing a session lock instruction, and utilizes the original session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code, reduces the risk of potential errors, and significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0034] Figure 2 is a flowchart of an embodiment of a session processing method based on timeout locking according to the present application;

[0035] Figure 3It is a structural diagram of an embodiment of a session processing device based on timeout locking according to the present application;

[0036] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0037] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0038] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0040] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0041] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0042] The terminal device 101 can be any electronic device with a display screen and supporting web browsing. In addition to a laptop computer 1011, a tablet computer 1012 or a mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV), a laptop computer, a desktop computer, etc.

[0043] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0044] It should be noted that the session processing method based on timeout locking provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the session processing device based on timeout locking is generally arranged in the server / terminal device.

[0045] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0046] Continue to refer Figure 2 , shows a flow chart of an embodiment of a session processing method based on timeout locking according to the present application, comprising the following steps:

[0047] Step S201, obtaining a session idle time threshold preset by the server, and determining whether the idle time of the current session exceeds the session idle time threshold.

[0048] In the session mechanism, session idle time refers to the time from the completion of the last operation to the start of the next operation in a session. It is mainly used to measure the duration of a session in a non-operational state.

[0049] A session refers to the continuous requests and responses between the server and the client. Usually, a session idle time threshold, i.e., a timeout time, is set on the server. When the timeout time is reached, the timeout mechanism is triggered. The session idle time threshold can protect user privacy and data security and improve system security. Sessions that have not been operated for a long time will occupy server resources. By setting the session idle time threshold, the system can automatically release resources, improve the overall performance and response speed of the server, avoid unnecessary waste of resources, and make system resources more reasonably allocated and utilized. In addition, it can also reduce misoperations and enhance user perception.

[0050] In this embodiment, the electronic device (eg Figure 1 The server / terminal device shown in the figure can obtain the session idle time threshold preset by the server through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0051] Get the session idle time threshold preset by the server, and compare the idle time of the current session with the session idle time threshold; if the idle time of the current session exceeds the session idle time threshold, it is determined that the session has timed out; if the idle time of the current session does not exceed the session idle time threshold, it is determined that the session has not timed out; according to the judgment result, adopt the corresponding session management strategy, if it times out, disconnect the session connection and release related resources, if it does not time out, keep the session and continue to monitor its idle time.

[0052] In some optional implementations, by periodically detecting the comparison result between the session idle time and the session idle time threshold, the session management strategy is dynamically adjusted to optimize the server resource utilization. For example, according to the change of the session timeout rate in the past week, the dynamic threshold adjustment algorithm is used to automatically adjust the size of the preset threshold. If the timeout rate is higher than 5%, the session idle time threshold is increased by 10%; if the timeout rate is lower than 1%, the session idle time threshold is reduced by 10%. By dynamically adjusting the threshold, the server resource utilization can be optimized while ensuring the user experience, and too many invalid sessions can be prevented from occupying system resources. In addition, the reasons for session timeouts are regularly analyzed, such as user active exit, network interruption, etc., and the session management strategy is further optimized according to the analysis results to improve the stability and availability of the system.

[0053] Step S202: When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel.

[0054] When the idle time of the current session exceeds the session idle time threshold, it means that the current session has timed out, and the timeout mechanism is triggered. According to the timeout policy, you can choose to time out or time out lock. When the policy is timeout exit, the background process exits, the connection is closed, and the interaction ends; when the policy is timeout lock, a notification message with a specific message format containing the session lock instruction is generated.

[0055] In this embodiment, the specific message format indicates that the message type is an error message, represented by "sqlstate", the session lock instruction can be represented by "ERRCODE_IDLE_SESSION_TIMEOUT_LOCK", and the notification message is a Notice message, that is, the server generates a Notice message with sqlstate as ERRCODE_IDLE_SESSION_TIMEOUT_LOCK.

[0056] It should be emphasized that in order to further ensure the privacy and security of the notification information, the above notification information can also be stored in a blockchain node.

[0057] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0058] In some optional implementations, the step of generating a notification message in a specific message format including a session lock instruction includes:

[0059] Obtain a specific message format corresponding to the session lock from a preset message format library;

[0060] Determine the session lock instruction content to be included in the notification message according to the specific message format;

[0061] Through the natural language generation model, combined with the content of the session lock instruction, the notification message text that conforms to the specific message format is automatically generated;

[0062] The notification message text is associated with the session lock status to form a complete locked session notification message.

[0063] The preset message format library in a session refers to a set customized according to specific needs, which is a set of rules, templates or tools for defining, storing and managing the message format in a session.

[0064] In this embodiment, a specific message format corresponding to the session lock, i.e., a message template for the session lock, is obtained from a preset message format library, which contains placeholders such as the lock reason and the unlock condition. The session lock instruction content to be included in the notification message is determined according to the specific message format, and the session lock instruction content is input into a trained natural language generation model. The natural language generation model automatically fills in the placeholders according to the context information of the input session lock instruction content and the message template to form a complete lock notification message text. The natural language generation model can use a recurrent neural network (RNN), a long short-term memory network (LSTM), a Transformer, etc.

[0065] The generated notification message text is associated with the session lock state, specifically, the notification message text is associated with the session ID, and a standard message data structure is constructed, that is, a structured locked session notification message is obtained. It should be understood that the notification message is generated at the server end and sent to the client end for parsing.

[0066] By generating a notification message and sending it to the client, the success rate of message sending is improved, and a real-time and reliable session lock prompt service can be provided.

[0067] In some optional implementations, the step of sending the notification message to the client through a preset secure channel includes:

[0068] Obtain the message content of the notification message, identify and desensitize the sensitive information in the message content, and obtain the desensitized message content;

[0069] Adopt an asymmetric encryption algorithm, based on a pre-generated public key and private key pair, use the public key to encrypt the desensitized message content to obtain the encrypted ciphertext message;

[0070] The ciphertext message is hashed using a secure hash algorithm to obtain a message hash summary.

[0071] Encapsulate the ciphertext message and the message hash summary into a secure message package, and add security attributes to obtain an encapsulated message package;

[0072] Query the pre-established secure channel information table to obtain the secure channel identifier corresponding to the client;

[0073] Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if available, send the encapsulated message packet to the client through the secure channel;

[0074] If the secure channel is currently unavailable, a currently available secure channel is selected from the preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

[0075] Specifically, after obtaining the message content, regular expressions or natural language processing technology can be used to identify sensitive information in the message content. After identifying the sensitive information, masking, encryption and other methods can be used for desensitization, such as desensitizing the ID card number "110101199001011234" to "1101011990****1234". Desensitization removes sensitive information from the message to avoid privacy data leakage. The desensitized message content is encrypted using the asymmetric encryption algorithm RSA. When encrypting, a 2048-bit key length can be used to generate a public key and a private key pair, and the public key is used to encrypt the message content to obtain the encrypted ciphertext message. The ciphertext message is hashed using the secure hash algorithm SHA-256 to obtain a 256-bit hash summary, which can be used as the basis for message integrity verification.

[0076] Security attributes include timestamps, serial numbers, etc. When encapsulating a secure message package, you can use the JSON format to encapsulate the encrypted ciphertext message, message hash summary, timestamp, serial number and other information into a JSON object. The timestamp can be expressed in milliseconds of the current system time, and the serial number can be expressed in UUID or a self-increasing integer to prevent the message from being replayed.

[0077] After obtaining the secure channel identifier corresponding to the client, determine whether the secure channel corresponding to the secure channel identifier is available. For example, if the current RTT of the channel is less than 300ms and the packet loss rate is less than 1%, it is determined to be available; otherwise, select the channel with the smallest current RTT and the lowest packet loss rate from the three backup secure channels to send the encrypted message.

[0078] In some optional implementations, after receiving the encapsulated message package, the receiver first verifies the timestamp and sequence number of the message to determine whether the message is expired or duplicated. If the verification is successful, the ciphertext message is decrypted using the private key to obtain the original notification message content. The decrypted message content is subjected to SHA-256 hash calculation, and the calculated hash value is compared with the hash summary in the encapsulated message package to verify whether the message has been tampered with during transmission. If they are consistent, it means that the message has not been tampered with during transmission. If the verification is successful, the notification message is passed to the subsequent business processing module for corresponding business logic processing.

[0079] By encrypting the notification message and transmitting it through a secure channel, the security and reliability of message transmission can be improved, privacy data leakage can be avoided, and the security of the system can be improved.

[0080] In some optional implementations, after the above step of sending the notification message to the client through the preset secure channel, the following steps are also included:

[0081] Obtaining the receiving status information of the client, and judging whether the client has successfully received the notification message according to the receiving status information;

[0082] If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered, and the notification message is resent according to the preset retransmission number and time interval until the client successfully receives the message or the maximum retransmission number is reached.

[0083] Specifically, after sending a notification message, wait for 1 second to check the receiving status. If no ACK confirmation is received, resend the notification message at intervals of 2 seconds, 4 seconds, and 8 seconds, and retry up to 3 times. The preset message retransmission mechanism is based on an exponential backoff algorithm, which dynamically adjusts the retransmission time interval to avoid aggravating network congestion. If no ACK is received after 3 retransmissions, the message is marked as failed, a log is recorded, an alarm is triggered, and manual intervention is required.

[0084] By confirming the receiving status after the message is sent, the notification message can be delivered safely and reliably to the greatest extent possible.

[0085] Step S203: receiving a notification message, parsing the notification message through the client, obtaining a session locking instruction, and locking the current session according to the session locking instruction.

[0086] In this embodiment, when the idle time of the current session exceeds the session idle time threshold, the session is locked by generating a notification message.

[0087] Specifically, the notification message is parsed and processed by the client to obtain session locking instruction information; whether the current session needs to be locked is determined according to the session locking instruction information, and if it needs to be locked, the session locking operation is performed; when performing the session locking operation, the session identification information of the current session is obtained, and the corresponding session management record is searched according to the session identification information; it is determined whether the lock status field of the session management record is in an unlocked state, and if it is in an unlocked state, the lock status field is set to a locked state.

[0088] For example, after receiving the notification message sent by the server, the client uses the JSON parsing library to parse the message content of the notification message and extract the session lock instruction information. According to the session ID, lock duration and other parameters in the instruction information, it is determined whether the current session needs to be locked. If locking is required, the corresponding session management record is searched from the local cache according to the session ID, and its lock status field is checked. If the lock status is "unlocked", it is set to "locked", and the lock start timestamp is recorded, and the session status is updated to ensure the correctness of subsequent business processing.

[0089] In some optional implementations, after the session lock operation is completed, a session lock completion message is sent to the server to inform the server that the current session has been successfully locked; the client periodically checks the lock status of the current session, and if no unlocking instruction is received from the server within a preset time, the session is automatically set to an unlocked state.

[0090] By parsing the notification message to obtain the session lock instruction to lock the current session, the security of the session can be improved and user sensitive information can be protected. By locking the session, the corresponding resources can be released and resource usage can be reduced. At the same time, after locking the session, the system can identify and process new session requests more quickly, thereby improving the system's response speed and overall performance.

[0091] Step S204, monitoring the operation of user input commands, if the user input command is detected, outputting a password input prompt to obtain the password input by the user.

[0092] In this embodiment, the user's input command is monitored to determine whether it is in a preset command format, that is, whether it is legal. If so, the password input process is triggered. Specifically, the user input command is monitored, a pre-configured command list is obtained, and each command item in the command list is stored as a string type; the command string of the user input command is obtained, and the string similarity algorithm is used to calculate the command similarity between the command string and each command item in the command list; when the command similarity is greater than or equal to the preset similarity threshold, the user input command is determined to be legal, and a password input prompt is popped up.

[0093] Among them, after obtaining the command string of the user input command, the spaces before and after the string are removed, and the string similarity algorithm is used to calculate the command similarity between the command string and each command item in the command list. According to the preset similarity threshold, it is judged whether the user input command matches a command in the pre-configured command list. If the similarity between the user input command and a command in the pre-configured command list is greater than or equal to the similarity threshold, the command input by the user is judged to be legal and the matching command is returned; if the similarity between the user input command and all commands in the pre-configured command list is less than the similarity threshold, the command input by the user is judged to be illegal and a prompt message of input error is returned. According to the result of the legality judgment of the command, the corresponding subsequent processing logic is executed. If it is legal, the operation corresponding to the command is executed. If it is illegal, the user is required to re-enter the command.

[0094] By monitoring the user input commands and obtaining the user input password, the password input security can be improved and other potential risks caused by misoperation can be prevented.

[0095] Step S205: Send the password input by the user to the server through a secure channel.

[0096] In this embodiment, after the session is locked, the client obtains the user input password according to the password input prompt, and then initiates an authentication process to the server. The server receives the authentication request from the client and sends a user password request to the client. After the client receives the user password request, it sends the user input password to the server through a secure channel. During the sending process, the user input password is encrypted using the TLS protocol to ensure data integrity and communication security during transmission.

[0097] Step S206, receiving the password input by the user, and encrypting the password input by the user using a preset encryption algorithm through the server to obtain an encrypted input password.

[0098] Specifically, when encrypting the passwords entered by users, a hash algorithm based on SHA-256 is used, which can convert the user's password into a unique hash value of a fixed length, ensuring the strength and security of the encryption technology. For example, after the password "password123" entered by the user is encrypted by SHA-256, a 64-bit hash value will be generated, which is extremely difficult to crack during storage and transmission. The encrypted passwords are stored in a database that uses the AES-256 encryption standard, which provides advanced encryption protection and can effectively prevent unauthorized access. Encryption algorithms are reviewed and updated regularly to respond to emerging security threats and improve the security of password processing.

[0099] Step S207, obtaining the pre-stored encrypted storage password of the user, and determining whether the authentication is successful based on the encrypted input password and the encrypted storage password.

[0100] Specifically, the server compares the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent; if they are consistent, an authentication result of passed authentication is generated; if they are inconsistent, an authentication result of failed authentication is generated and the authentication result is returned to the client.

[0101] When performing password comparison, a secure password comparison algorithm can be used to avoid leaking password information during the comparison process. For example, a hash algorithm or an asymmetric encryption algorithm can be used for password comparison. According to the password comparison result, a corresponding authentication result is generated.

[0102] The authentication result is determined by password comparison, which effectively protects the security and privacy of user data and improves authentication efficiency.

[0103] Step S208, when the authentication is passed, the current session is unlocked through the client; when the authentication is not passed, an authentication failure prompt is output and an exit session operation is performed.

[0104] In this embodiment, after successful authentication, the previous processing flow is re-entered to continue the current session; after failed authentication, the client exits and the current session is terminated. At the same time, the server will also determine the next execution flow based on the result of the re-authentication: if the authentication is successful, the server will continue to receive the user command sent by the client and parse and execute it; if the authentication fails, the server will close the connection with the client and terminate the current process.

[0105] This application identifies the timeout by transmitting a notification message in a specific format containing a session lock instruction, utilizing the original session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code, reduces the risk of potential errors, and significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization.

[0106] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0107] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0108] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0109] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a session processing device based on timeout locking, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0110] like Figure 3 As shown, the session processing device 300 based on timeout locking described in this embodiment includes: an acquisition module 301, a message generation module 302, a locking module 303, a monitoring module 304, a sending module 305, an encryption module 306, an authentication module 307 and an execution module 308.

[0111] in:

[0112] The acquisition module 301 is used to acquire a session idle time threshold preset by the server, and determine whether the idle time of the current session exceeds the session idle time threshold;

[0113] The message generation module 302 is used to generate a notification message in a specific message format including a session lock instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel;

[0114] The locking module 303 is used to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction;

[0115] The monitoring module 304 is used to monitor the operation of the user input command. If the user input command is detected, a password input prompt is output to obtain the password input by the user;

[0116] The sending module 305 is used to send the password input by the user to the server through the secure channel;

[0117] The encryption module 306 is used to receive the password input by the user, and encrypt the password input by the user using a preset encryption algorithm through the server to obtain an encrypted input password;

[0118] The authentication module 307 is used to obtain the encrypted storage password of the user stored in advance, and determine whether the authentication is passed according to the encrypted input password and the encrypted storage password;

[0119] The execution module 308 is used to unlock the current session through the client when the authentication is passed; when the authentication is not passed, output an authentication failure prompt and execute a session exit operation.

[0120] It should be emphasized that in order to further ensure the privacy and security of the notification information, the above notification information can also be stored in a blockchain node.

[0121] The session processing device 300 based on timeout locking of the present application identifies the timeout by transmitting a notification message in a specific format containing a session locking instruction, and utilizes the original session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code, reduces the risk of potential errors, and significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization.

[0122] In some optional implementations of this embodiment, the message generating module 302 includes a generating submodule, which is used to:

[0123] Obtain a specific message format corresponding to the session lock from a preset message format library;

[0124] Determining, according to the specific message format, the session locking instruction content to be included in the notification message;

[0125] Automatically generate a notification message text that conforms to the specific message format by combining the session lock instruction content with a natural language generation model;

[0126] The notification message text is associated with the session lock state to form a complete locked session notification message.

[0127] By generating a notification message and sending it to the client, the success rate of message sending is improved, and a real-time and reliable session lock prompt service can be provided.

[0128] In some optional implementations of this embodiment, the message generating module 302 further includes a message sending submodule, which is used to:

[0129] Obtaining the message content of the notification message, performing sensitive information identification and desensitization processing on the message content, and obtaining desensitized message content;

[0130] Using an asymmetric encryption algorithm, based on a pre-generated public key and private key pair, using the public key to encrypt the desensitized message content to obtain an encrypted ciphertext message;

[0131] Performing hash calculation on the ciphertext message using a secure hash algorithm to obtain a message hash summary;

[0132] Encapsulating the ciphertext message and the message hash digest into a secure message package, and adding security attributes to obtain an encapsulated message package;

[0133] Querying a pre-established secure channel information table to obtain a secure channel identifier corresponding to the client;

[0134] Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if available, send the encapsulated message packet to the client through the secure channel;

[0135] If the secure channel is currently unavailable, a currently available secure channel is selected from preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

[0136] By encrypting the notification message and transmitting it through a secure channel, the security and reliability of message transmission can be improved, privacy data leakage can be avoided, and the security of the system can be improved.

[0137] In some optional implementations, the message generation module 302 further includes a feedback submodule, which is used to:

[0138] Acquire reception status information of the client, and determine whether the client has successfully received the notification message according to the reception status information;

[0139] If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered to resend the notification message according to the preset retransmission times and time interval until the client successfully receives the message or the maximum retransmission times are reached.

[0140] By confirming the receiving status after the message is sent, the notification message can be delivered safely and reliably to the greatest extent possible.

[0141] In this embodiment, the locking module 303 includes:

[0142] A parsing submodule, used for parsing the notification message through the client to obtain session locking instruction information;

[0143] A judgment submodule, used for judging whether the current session needs to be locked according to the session locking instruction information, and if locking is required, performing the session locking operation;

[0144] A search submodule, used to obtain the session identification information of the current session when performing the session locking operation, and search for the corresponding session management record according to the session identification information;

[0145] The locking submodule is used to determine whether the locking state field of the session management record is in an unlocked state, and if so, set the locking state field to a locked state.

[0146] By parsing the notification message to obtain the session lock instruction to lock the current session, the security of the session can be improved and user sensitive information can be protected. By locking the session, the corresponding resources can be released and resource usage can be reduced. At the same time, after locking the session, the system can identify and process new session requests more quickly, thereby improving the system's response speed and overall performance.

[0147] In some optional implementations of this embodiment, the monitoring module 304 is further configured to:

[0148] Detecting a user input command, obtaining a pre-configured command list, and storing each command item in the command list as a string type;

[0149] Obtaining a command string of the command input by the user, and using a string similarity algorithm to calculate the command similarity between the command string and each command item in the command list;

[0150] When the command similarity is greater than or equal to a preset similarity threshold, the user input command is determined to be legal, and the password input prompt is popped up.

[0151] By monitoring the user input commands and obtaining the user input password, the password input security can be improved and other potential risks caused by misoperation can be prevented.

[0152] In some optional implementations of this embodiment, the authentication module 307 includes:

[0153] A comparison submodule, used to compare the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent;

[0154] The result generation submodule is used to generate an authentication result indicating that the authentication is passed if they are consistent, and to generate an authentication result indicating that the authentication is failed if they are inconsistent, and return the authentication result to the client.

[0155] The authentication result is determined by password comparison, which effectively protects the security and privacy of user data and improves authentication efficiency.

[0156] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0157] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected and communicated through a system bus. It should be noted that the figure only shows a computer device 4 with a memory 41, a processor 42, and a network interface 43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0158] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0159] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of a session processing method based on timeout locking, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0160] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run the computer-readable instructions stored in the memory 41 or process data, such as running the computer-readable instructions of the session processing method based on timeout locking.

[0161] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0162] By transmitting a notification message in a specific format containing a session lock instruction to mark the timeout, the existing session timeout message processing mechanism is utilized. Only the message content needs to be processed and integrated into the original process, rather than adding or modifying the existing process. This reduces the amount of code and the risk of potential errors. It also significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization.

[0163] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the session processing method based on timeout locking as described above.

[0164] By transmitting a notification message in a specific format containing a session lock instruction to mark the timeout, the existing session timeout message processing mechanism is utilized. Only the message content needs to be processed and integrated into the original process, rather than adding or modifying the existing process. This reduces the amount of code and the risk of potential errors. It also significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization.

[0165] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0166] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A session processing method based on timeout locking, characterized in that: The steps include: Obtaining a session idle time threshold preset by the server, and determining whether the idle time of the current session exceeds the session idle time threshold; When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel; receiving the notification message, parsing the notification message through the client, obtaining the session locking instruction, and locking the current session according to the session locking instruction; Monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user; Sending the password input by the user to the server through the secure channel; Receiving the password input by the user, and encrypting the password input by the user by the server using a preset encryption algorithm to obtain an encrypted input password; Obtaining a pre-stored encrypted storage password of the user, and determining whether the authentication is successful according to the encrypted input password and the encrypted storage password; When the authentication is passed, unlocking the current session through the client; If the authentication fails, an authentication failure prompt will be output and the session exit operation will be executed.

2. The session processing method based on timeout locking according to claim 1, characterized in that: The step of generating a notification message in a specific message format including a session lock instruction comprises: Obtain a specific message format corresponding to the session lock from a preset message format library; Determining, according to the specific message format, the session locking instruction content to be included in the notification message; Automatically generate a notification message text that conforms to the specific message format by combining the session lock instruction content with a natural language generation model; The notification message text is associated with the session lock state to form a complete locked session notification message.

3. The session processing method based on timeout locking according to claim 1, characterized in that: The step of sending the notification message to the client through a preset secure channel includes: Obtaining the message content of the notification message, performing sensitive information identification and desensitization processing on the message content, and obtaining desensitized message content; Using an asymmetric encryption algorithm, based on a pre-generated public key and private key pair, using the public key to encrypt the desensitized message content to obtain an encrypted ciphertext message; Performing hash calculation on the ciphertext message using a secure hash algorithm to obtain a message hash summary; Encapsulating the ciphertext message and the message hash digest into a secure message package, and adding security attributes to obtain an encapsulated message package; Querying a pre-established secure channel information table to obtain a secure channel identifier corresponding to the client; Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if available, send the encapsulated message packet to the client through the secure channel; If the secure channel is currently unavailable, a currently available secure channel is selected from preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

4. The session processing method based on timeout locking according to claim 1, characterized in that: After the step of sending the notification message to the client through the preset secure channel, the method further includes: Acquire reception status information of the client, and determine whether the client has successfully received the notification message according to the reception status information; If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered to resend the notification message according to the preset retransmission times and time interval until the client successfully receives the message or the maximum retransmission times are reached.

5. The session processing method based on timeout locking according to claim 1, characterized in that: The step of parsing the notification message by the client to obtain the session locking instruction and locking the current session according to the session locking instruction includes: The client parses the notification message to obtain session locking instruction information; Determining whether the current session needs to be locked according to the session locking instruction information, and if locking is required, executing the session locking operation; When performing a session locking operation, obtaining the session identification information of the current session, and searching for the corresponding session management record according to the session identification information; It is determined whether the lock state field of the session management record is in an unlocked state; if it is in an unlocked state, the lock state field is set to a locked state.

6. The session processing method based on timeout locking according to claim 1, characterized in that: If a user input command is detected, a password input prompt is output, and the step of obtaining the user input password includes: Detecting a user input command, obtaining a pre-configured command list, and storing each command item in the command list as a string type; Obtaining a command string of the command input by the user, and using a string similarity algorithm to calculate the command similarity between the command string and each command item in the command list; When the command similarity is greater than or equal to a preset similarity threshold, the user input command is determined to be legal, and the password input prompt is popped up.

7. The session processing method based on timeout locking according to claim 1, characterized in that: The step of determining whether the authentication is successful according to the encrypted input password and the encrypted stored password comprises: Compare the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent; If they are consistent, an authentication result indicating that the authentication is passed is generated; if they are inconsistent, an authentication result indicating that the authentication is failed is generated and the authentication result is returned to the client.

8. A session processing device based on timeout locking, characterized in that: include: An acquisition module is used to acquire a session idle time threshold preset by the server, and determine whether the idle time of the current session exceeds the session idle time threshold; A message generating module, configured to generate a notification message in a specific message format including a session locking instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel; A locking module, configured to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction; The monitoring module is used to monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user; A sending module, used for sending the password input by the user to the server through the secure channel; An encryption module is used to receive the password input by the user, and encrypt the password input by the user by using a preset encryption algorithm through the server to obtain an encrypted input password; An authentication module, used to obtain a pre-stored encrypted storage password of the user, and determine whether the authentication is successful based on the encrypted input password and the encrypted storage password; An execution module, used for unlocking the current session through the client when the authentication is passed; If the authentication fails, an authentication failure prompt will be output and the session exit operation will be executed.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the session processing method based on timeout locking as described in any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the session processing method based on timeout locking are implemented as described in any one of claims 1 to 7.

Images