Session processing method, device, equipment and storage medium based on timeout locking

Abstract

The present application belongs to the field of message security and finance, and relates to a session processing method based on timeout locking, including generating a notification message in a specific format containing a session lock instruction when the idle time of the current session exceeds the session idle time threshold, sending the notification message to the client through a secure channel for parsing, obtaining the session lock instruction, locking the current session according to the session lock instruction, monitoring the user input command, outputting a password input prompt, encrypting the user input password to obtain an encrypted input password, determining whether the authentication is passed based on the encrypted input password and a pre-stored encrypted storage password, unlocking the current session when the authentication is passed, and exiting the session operation when the authentication fails. The present application also provides a session processing device, equipment, and storage medium based on timeout locking. In addition, the present application also relates to blockchain technology, and notification information can be stored in the blockchain. The present application can reduce the risk of potential errors.

Description

Technical Field

[0001] The present application relates to the fields of information security and financial technology, and in particular to a session processing method, apparatus, device and storage medium based on timeout locking. Background Art

[0002] With the rapid development of information technology, computer systems have become the core platform for financial institutions to process large volumes of transactions, manage customer information, and ensure data security. In computer science, the session mechanism, as a key means of maintaining user status, plays a vital role in improving the efficiency, security, and personalized experience of financial services.

[0003] Specifically, the session mechanism allows servers and clients to share state information across multiple request and response cycles, effectively supporting the continuous processing of complex financial services such as online transactions, account inquiries, and personalized recommendations. A session typically starts when a user passes authentication, such as logging in, and ends when the user actively logs out or a timeout is triggered due to prolonged inactivity. The management of this lifecycle, including session creation, updates, and destruction, is primarily the responsibility of the server to ensure data consistency and security.

[0004] The advantages of session mechanisms are particularly significant in financial applications. By maintaining user session state, servers can avoid re-authenticating users or retrieving user information for each request, significantly reducing server processing load and improving system response speed and throughput. Furthermore, session mechanisms provide a foundation for personalized user services. For example, they allow users to save their transaction preferences, interface settings, and other personalized configurations, which can then be automatically restored in subsequent sessions, significantly improving the user experience.

[0005] However, session timeout management, a critical component of the session mechanism, has a direct impact on system security and user experience. Currently, common session timeout implementation methods are categorized as time-based and event-based. Time-based methods are widely adopted due to their simplicity and controllability. When a session timeout occurs, the system typically takes measures such as closing the process and connection, terminating the current session, or locking the session and requiring the user to re-enter the password to prevent unauthorized access to data.

[0006] The traditional approach to handling session timeout lockouts is to implement the corresponding interfaces on both the server and client, allowing both parties to work together to achieve this functionality. However, this approach presents significant problems: First, it requires extensive code modifications on both the server and client sides, which not only increases development costs but also introduces more potential errors due to the large number of code changes. Second, the interface docking and debugging process between the server and client is complex, which can easily lead to compatibility issues, further increasing the difficulty and risk of system maintenance. Summary of the Invention

[0007] The purpose of the embodiments of the present application is to propose a session processing method, apparatus, device and storage medium based on timeout locking, so as to solve the technical problems that in the related technology, when processing session timeout locking, more potential errors are introduced due to large code changes, and the interface docking and debugging process between the server and the client is complicated and has poor compatibility.

[0008] In order to solve the above technical problems, the embodiment of the present application provides a session processing method based on timeout locking, which adopts the following technical solution:

[0009] Obtaining a session idle time threshold preset by the server, and determining whether the idle time of the current session exceeds the session idle time threshold;

[0010] When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel;

[0011] receiving the notification message, parsing the notification message through the client to obtain the session locking instruction, and locking the current session according to the session locking instruction;

[0012] Monitor the user input command operation, if the user input command is detected, output a password input prompt and obtain the user input password;

[0013] Sending the password input by the user to the server through the secure channel;

[0014] Receiving the password input by the user, and encrypting the password input by the user using a preset encryption algorithm by the server to obtain an encrypted input password;

[0015] Obtaining a pre-stored encrypted storage password of the user, and determining whether authentication is successful based on the encrypted input password and the encrypted storage password;

[0016] When the authentication is passed, the current session is unlocked through the client; when the authentication is not passed, an authentication failure prompt is output and an exit session operation is performed.

[0017] In order to solve the above technical problems, the embodiment of the present application further provides a session processing device based on timeout locking, which adopts the following technical solution:

[0018] An acquisition module is used to obtain a session idle time threshold preset by the server and determine whether the idle time of the current session exceeds the session idle time threshold;

[0019] a message generating module, configured to generate a notification message in a specific message format including a session lock instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel;

[0020] a locking module, configured to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction;

[0021] The monitoring module is used to monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user;

[0022] A sending module, configured to send the password input by the user to the server through the secure channel;

[0023] An encryption module is used to receive the password input by the user, and encrypt the password input by the user using a preset encryption algorithm through the server to obtain an encrypted input password;

[0024] An authentication module, configured to obtain a pre-stored encrypted stored password of the user, and determine whether the authentication is successful based on the encrypted input password and the encrypted stored password;

[0025] The execution module is used to unlock the current session through the client when the authentication is passed; when the authentication is not passed, output an authentication failure prompt and execute an exit session operation.

[0026] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0027] The computer device includes a memory and a processor. The memory stores computer-readable instructions. When the processor executes the computer-readable instructions, the steps of the session processing method based on timeout locking are implemented.

[0028] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0029] The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the session processing method based on timeout locking as described above.

[0030] Compared with the prior art, this application has the following beneficial effects:

[0031] The present application provides a session processing method based on timeout locking, which obtains a session idle time threshold preset by the server, generates a notification message in a specific format containing a session lock instruction when the idle time of the current session exceeds the session idle time threshold, and sends the notification message to the client through a preset secure channel, parses the notification message, obtains the session lock instruction, and locks the current session according to the session lock instruction, monitors the user input command, outputs a password input prompt, obtains the user input password, sends the user input password to the server, encrypts it to obtain the encrypted input password, obtains the pre-stored encrypted storage password of the user, and locks the current session according to the encrypted password. The secret input password and the encrypted storage password are used to determine whether the authentication is passed. When the authentication is passed, the current session is unlocked through the client. When the authentication fails, an authentication failure prompt is output and the session exit operation is executed. This application identifies the timeout by delivering a notification message in a specific format containing a session lock instruction, and utilizes the original session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code, reduces the risk of potential errors, and significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0033] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0034] Figure 2 is a flowchart of an embodiment of a session processing method based on timeout locking according to the present application;

[0035] Figure 3This is a structural diagram of an embodiment of a session processing device based on timeout locking according to the present application;

[0036] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0037] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0038] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0040] like Figure 1 As shown, system architecture 100 may include a terminal device 101, a network 102, and a server 103. Terminal device 101 may be a laptop computer 1011, a tablet computer 1012, or a mobile phone 1013. Network 102 is a medium for providing a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0041] The user can use the terminal device 101 to interact with the server 103 via the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0042] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer and a desktop computer, etc.

[0043] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0044] It should be noted that the session processing method based on timeout locking provided in the embodiment of the present application is generally executed by a server / terminal device. Accordingly, the session processing device based on timeout locking is generally provided in the server / terminal device.

[0045] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0046] Continue to refer Figure 2 , shows a flowchart of an embodiment of a session processing method based on timeout locking according to the present application, comprising the following steps:

[0047] Step S201: Obtain a session idle time threshold preset by the server, and determine whether the idle time of the current session exceeds the session idle time threshold.

[0048] In the session mechanism, session idle time refers to the time from the completion of the last operation to the start of the next operation in a session. It is mainly used to measure the duration of the session in the no-operation state.

[0049] A session refers to the continuous flow of requests and responses between a server and a client. A session idle time threshold, or timeout, is typically set on the server. When the timeout is reached, a timeout mechanism is triggered. The session idle time threshold protects user privacy and data security, improving system security. Sessions that remain inactive for extended periods of time consume server resources. Setting a session idle time threshold automatically frees up resources, improving overall server performance and responsiveness, avoiding unnecessary resource waste and ensuring more efficient allocation and utilization of system resources. It also reduces misoperations and enhances user experience.

[0050] In this embodiment, the electronic device (eg Figure 1 The server / terminal device shown in the figure can obtain the session idle time threshold preset by the server through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0051] Obtain the session idle time threshold preset by the server and compare the idle time of the current session with the session idle time threshold. If the idle time of the current session exceeds the session idle time threshold, the session is judged to have timed out. If the idle time of the current session does not exceed the session idle time threshold, the session is judged to have not timed out. Based on the judgment result, adopt the corresponding session management strategy. If the timeout occurs, disconnect the session connection and release related resources. If the timeout does not occur, maintain the session and continue to monitor its idle time.

[0052] In some optional implementations, session management policies are dynamically adjusted to optimize server resource utilization by regularly comparing session idle time with a session idle time threshold. For example, based on the changes in session timeout rates over the past week, a dynamic threshold adjustment algorithm is used to automatically adjust the preset threshold. If the timeout rate is above 5%, the session idle time threshold is increased by 10%; if the timeout rate is below 1%, the session idle time threshold is reduced by 10%. By dynamically adjusting the threshold, server resource utilization can be optimized while ensuring user experience, preventing excessive idle sessions from occupying system resources. Furthermore, the causes of session timeouts, such as user-initiated logouts and network outages, are regularly analyzed. Based on the analysis results, session management policies are further optimized to improve system stability and availability.

[0053] Step S202: When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel.

[0054] When the current session idle time exceeds the session idle time threshold, the session times out, triggering the timeout mechanism. Depending on the timeout policy, you can choose to time out or lock the session. If the timeout policy is timeout, the background process exits, the connection is closed, and the interaction ends. If the timeout policy is lock, a notification message with a specific message format is generated, including the session lock instruction.

[0055] In this embodiment, the specific message format indicates that the message type is an error message, represented by "sqlstate", the session lock instruction can be represented by "ERRCODE_IDLE_SESSION_TIMEOUT_LOCK", and the notification message is a Notice message, that is, the server generates a Notice message with sqlstate as ERRCODE_IDLE_SESSION_TIMEOUT_LOCK.

[0056] It should be emphasized that in order to further ensure the privacy and security of notification information, the above notification information can also be stored in a blockchain node.

[0057] The blockchain referred to in this application is a new application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0058] In some optional implementations, the step of generating a notification message in a specific message format including a session lock instruction includes:

[0059] Obtain a specific message format corresponding to the session lock from a preset message format library;

[0060] Determine the session lock instruction content to be included in the notification message according to the specific message format;

[0061] By using a natural language generation model and combining it with the session lock instruction content, notification message text that conforms to a specific message format is automatically generated.

[0062] The notification message text is associated with the session lock status to form a complete locked session notification message.

[0063] The preset message format library in a session refers to a set of rules, templates, or tools customized according to specific needs, used to define, store, and manage message formats in a session.

[0064] In this embodiment, a specific message format corresponding to a session lock, namely, a session lock message template, is obtained from a preset message format library. This message template contains placeholders for the lock reason and unlock conditions. The session lock instruction content required for the notification message is determined based on the specific message format. The session lock instruction content is then input into a trained natural language generation model. The natural language generation model automatically fills in the placeholders based on the context of the input session lock instruction content and the message template, forming the complete lock notification message text. The natural language generation model can employ a recurrent neural network (RNN), a long short-term memory network (LSTM), a Transformer, or the like.

[0065] The generated notification message text is associated with the session lock status. Specifically, the notification message text is associated with the session ID to construct a standard message data structure, that is, a structured locked session notification message is obtained. It should be understood that the notification message is generated on the server side and sent to the client side for parsing and processing.

[0066] By generating a notification message and sending it to the client, the success rate of message sending is improved, and a real-time and reliable session lock prompt service can be provided.

[0067] In some optional implementations, the step of sending the notification message to the client through a preset secure channel includes:

[0068] Obtain the message content of the notification message, identify sensitive information in the message content and perform desensitization processing to obtain the desensitized message content;

[0069] Using an asymmetric encryption algorithm, based on a pre-generated public and private key pair, the public key is used to encrypt the desensitized message content to obtain the encrypted ciphertext message;

[0070] The ciphertext message is hashed using a secure hash algorithm to obtain a message hash digest.

[0071] Encapsulating the ciphertext message and the message hash digest into a secure message package, and adding security attributes to obtain an encapsulated message package;

[0072] Query the pre-established secure channel information table to obtain the secure channel identifier corresponding to the client;

[0073] Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if so, send the encapsulated message packet to the client through the secure channel;

[0074] If the secure channel is currently unavailable, a currently available secure channel is selected from the preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

[0075] Specifically, after obtaining the message content, regular expressions or natural language processing techniques can be used to identify sensitive information. Once sensitive information is identified, it can be desensitized using methods such as masking and encryption. For example, the ID number "110101199001011234" can be desensitized to "1101011990****1234." Desensitization removes sensitive information from the message, preventing private data leakage. The desensitized message content is encrypted using the asymmetric RSA encryption algorithm. A 2048-bit key length is used to generate a public and private key pair. The public key is then used to encrypt the message content, producing the encrypted ciphertext message. The ciphertext message is hashed using the secure hash algorithm SHA-256 to generate a 256-bit hash digest, which can be used as a basis for message integrity verification.

[0076] Security attributes include timestamps and sequence numbers. When encapsulating a secure message package, you can use the JSON format to encapsulate the encrypted message, message hash, timestamp, sequence number, and other information into a single JSON object. The timestamp can be expressed in milliseconds of the current system time, and the sequence number can be expressed as a UUID or auto-incrementing integer to prevent message replay attacks.

[0077] After obtaining the secure channel identifier corresponding to the client, it is determined whether the secure channel corresponding to the secure channel identifier is available. For example, if the current RTT of the channel is less than 300ms and the packet loss rate is less than 1%, it is determined to be available; otherwise, the channel with the smallest current RTT and the lowest packet loss rate is selected from the three backup secure channels to send the encrypted message.

[0078] In some optional implementations, upon receiving the encapsulated message package, the recipient first verifies the message's timestamp and sequence number to determine whether the message is expired or duplicated. If verification is successful, the recipient uses the private key to decrypt the ciphertext message to obtain the original notification message content. A SHA-256 hash calculation is performed on the decrypted message content, and the calculated hash value is compared with the hash digest in the encapsulated message package to verify whether the message has been tampered with during transmission. If the two values ​​match, indicating that the message has not been tampered with during transmission, the notification message is passed to the subsequent business processing module for corresponding business logic processing.

[0079] By encrypting notification messages and transmitting them through a secure channel, the security and reliability of message transmission can be improved, privacy data leakage can be avoided, and system security can be improved.

[0080] In some optional implementations, after the step of sending the notification message to the client through the preset secure channel, the following steps are further included:

[0081] Obtaining the client's receiving status information, and determining whether the client has successfully received the notification message based on the receiving status information;

[0082] If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered, and the notification message is resent according to the preset retransmission number and time interval until the client successfully receives the message or the maximum retransmission number is reached.

[0083] Specifically, after sending a notification message, the system checks the reception status after waiting one second. If no ACK is received, the notification message is resent at intervals of 2, 4, and 8 seconds, for a maximum of three retries. The pre-set message retransmission mechanism, based on an exponential backoff algorithm, dynamically adjusts the retransmission interval to avoid exacerbating network congestion. If no ACK is received after three retries, the message is marked as failed, logged, and an alarm is triggered, requiring manual intervention.

[0084] By confirming the receipt status after the message is sent, the notification message can be delivered safely and reliably to the greatest extent possible.

[0085] Step S203: receiving a notification message, parsing the notification message through the client, obtaining a session locking instruction, and locking the current session according to the session locking instruction.

[0086] In this embodiment, when the idle time of the current session exceeds the session idle time threshold, the session is locked by generating a notification message.

[0087] Specifically, the client parses and processes the notification message to obtain session lock instruction information; determines whether the current session needs to be locked based on the session lock instruction information, and if so, performs the session lock operation; when performing the session lock operation, obtains the session identification information of the current session, and searches for the corresponding session management record based on the session identification information; determines whether the lock status field of the session management record is in the unlocked state, and if so, sets the lock status field to the locked state.

[0088] For example, after receiving a notification message from the server, the client uses a JSON parsing library to parse the message content and extract the session lock instruction. Based on parameters such as the session ID and lock duration in the instruction, it determines whether the current session needs to be locked. If locking is required, the client searches the local cache for the corresponding session management record based on the session ID and checks its lock status field. If the lock status is "unlocked," it sets it to "locked," records the lock start timestamp, and updates the session status to ensure the correctness of subsequent business processing.

[0089] In some optional implementations, after the session lock operation is completed, a session lock completion message is sent to the server to inform the server that the current session has been successfully locked; the client periodically checks the lock status of the current session. If no unlock instruction is received from the server within a preset time period, the session is automatically set to an unlocked state.

[0090] Locking the current session by parsing the session lock instruction obtained from the notification message can improve session security and protect user sensitive information. By locking the session, corresponding resources can be released and resource usage can be reduced. At the same time, after locking the session, the system can identify and process new session requests more quickly, thereby improving the system's response speed and overall performance.

[0091] Step S204: monitor the user input command operation. If the user input command is detected, output a password input prompt to obtain the password input by the user.

[0092] In this embodiment, the user's input command is monitored to determine whether it conforms to a preset command format, i.e., whether it is legal. If so, the password entry process is triggered. Specifically, upon detecting the user's input command, a pre-configured command list is retrieved, and each command item in the command list is stored as a string type. The command string of the user's input command is obtained, and a string similarity algorithm is used to calculate the command similarity between the command string and each command item in the command list. If the command similarity is greater than or equal to a preset similarity threshold, the user's input command is determined to be legal, and a password entry prompt is displayed.

[0093] After obtaining the command string of the user input command, the spaces before and after the string are removed, and the string similarity algorithm is used to calculate the command similarity between the command string and each command item in the command list. Based on the preset similarity threshold, it is determined whether the user input command matches a command in the pre-configured command list. If the similarity between the user input command and a command in the pre-configured command list is greater than or equal to the similarity threshold, the command input by the user is determined to be legal and the matching command is returned. If the similarity between the user input command and all commands in the pre-configured command list is less than the similarity threshold, the command input by the user is determined to be illegal and an input error prompt message is returned. Based on the result of the command legitimacy judgment, the corresponding subsequent processing logic is executed. If it is legal, the operation corresponding to the command is executed. If it is illegal, the user is required to re-enter the command.

[0094] By monitoring the user input commands and obtaining the user input password, the password input security can be improved and other potential risks caused by misoperation can be prevented.

[0095] Step S205: Send the password entered by the user to the server through a secure channel.

[0096] In this embodiment, after the session is locked, the client obtains the user input password according to the password input prompt and initiates an authentication process to the server. The server receives the client's authentication request and sends a user password request to the client. The client receives the user password request and sends the user input password to the server through a secure channel. During the sending process, the user input password is encrypted using the TLS protocol to ensure data integrity and communication security during transmission.

[0097] Step S206: receiving the password input by the user, and encrypting the password input by the user using a preset encryption algorithm at the server to obtain an encrypted password.

[0098] Specifically, when encrypting user-entered passwords, we use a hash algorithm based on SHA-256. This algorithm converts user passwords into a unique hash value of fixed length, ensuring the strength and security of the encryption technology. For example, after the user-entered password "password123" is encrypted with SHA-256, a 64-bit hash value is generated, which is extremely difficult to crack during storage and transmission. The encrypted password is stored in a database that uses the AES-256 encryption standard, which provides advanced encryption protection and can effectively prevent unauthorized access. The encryption algorithm is regularly reviewed and updated to address emerging security threats and improve the security of password processing.

[0099] Step S207: Obtain the pre-stored encrypted storage password of the user, and determine whether the authentication is successful based on the encrypted input password and the encrypted storage password.

[0100] Specifically, the server compares the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent; if they are consistent, an authentication result of passed authentication is generated; if they are inconsistent, an authentication result of failed authentication is generated and the authentication result is returned to the client.

[0101] When performing password comparison, a secure password comparison algorithm can be used to prevent password information from being leaked during the comparison process. For example, a hash algorithm or an asymmetric encryption algorithm can be used for password comparison. Based on the password comparison result, a corresponding authentication result is generated.

[0102] The authentication result is determined by password comparison, which effectively protects the security and privacy of user data and improves authentication efficiency.

[0103] Step S208: When the authentication is successful, the current session is unlocked through the client; when the authentication is unsuccessful, an authentication failure prompt is output and an exit session operation is executed.

[0104] In this embodiment, if authentication succeeds, the client re-enters the previous process and continues the current session. If authentication fails, the client exits and the current session is terminated. Simultaneously, the server determines the next execution flow based on the re-authentication result: if authentication succeeds, the server continues to receive user commands sent by the client and parses and executes them; if authentication fails, the server closes the connection with the client and terminates the current process.

[0105] This application identifies timeouts by delivering a notification message in a specific format containing a session lock instruction, utilizing the existing session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code and the risk of potential errors, significantly improving the stability and reliability of the system and providing more possibilities for future expansion and optimization.

[0106] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to achieve optimal results.

[0107] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware via computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0108] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0109] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a session processing device based on timeout locking, which is similar to the embodiment of the present invention. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0110] like Figure 3 As shown, the session processing device 300 based on timeout locking described in this embodiment includes: an acquisition module 301, a message generation module 302, a locking module 303, a monitoring module 304, a sending module 305, an encryption module 306, an authentication module 307 and an execution module 308.

[0111] in:

[0112] The acquisition module 301 is used to obtain a session idle time threshold preset by the server and determine whether the idle time of the current session exceeds the session idle time threshold;

[0113] The message generation module 302 is configured to generate a notification message in a specific message format including a session lock instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel;

[0114] The locking module 303 is configured to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction;

[0115] The monitoring module 304 is used to monitor the operation of the user input command. If the user input command is detected, it outputs a password input prompt to obtain the password input by the user;

[0116] The sending module 305 is used to send the password input by the user to the server through the secure channel;

[0117] The encryption module 306 is used to receive the password input by the user, and encrypt the password input by the user using a preset encryption algorithm through the server to obtain an encrypted input password;

[0118] The authentication module 307 is used to obtain the pre-stored encrypted storage password of the user and determine whether the authentication is successful based on the encrypted input password and the encrypted storage password;

[0119] The execution module 308 is used to unlock the current session through the client when the authentication is passed; when the authentication is not passed, output an authentication failure prompt and execute an exit session operation.

[0120] It should be emphasized that in order to further ensure the privacy and security of notification information, the above notification information can also be stored in a blockchain node.

[0121] The session processing device 300 based on timeout lock of the present application identifies the timeout by transmitting a notification message in a specific format containing a session lock instruction, utilizing the original session timeout message processing mechanism. It only needs to process the message content and integrate it into the original process, rather than adding or modifying the existing process. This reduces the amount of code, reduces the risk of potential errors, and significantly improves the stability and reliability of the system, while also providing more possibilities for future expansion and optimization.

[0122] In some optional implementations of this embodiment, the message generation module 302 includes a generation submodule configured to:

[0123] Obtain a specific message format corresponding to the session lock from a preset message format library;

[0124] Determining, according to the specific message format, the session lock instruction content that needs to be included in the notification message;

[0125] Automatically generate notification message text that conforms to the specific message format by using a natural language generation model and combining the content of the session lock instruction;

[0126] The notification message text is associated with the session lock status to form a complete locked session notification message.

[0127] By generating a notification message and sending it to the client, the success rate of message sending is improved, and a real-time and reliable session lock prompt service can be provided.

[0128] In some optional implementations of this embodiment, the message generating module 302 further includes a message sending submodule configured to:

[0129] Obtaining the message content of the notification message, performing sensitive information identification and desensitization processing on the message content, and obtaining desensitized message content;

[0130] Using an asymmetric encryption algorithm, based on a pre-generated public key and private key pair, the public key is used to encrypt the desensitized message content to obtain an encrypted ciphertext message;

[0131] Performing hash calculation on the ciphertext message using a secure hash algorithm to obtain a message hash digest;

[0132] Encapsulating the ciphertext message and the message hash digest into a secure message package, and adding security attributes to obtain an encapsulated message package;

[0133] Querying a pre-established secure channel information table to obtain a secure channel identifier corresponding to the client;

[0134] Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if available, send the encapsulated message packet to the client through the secure channel;

[0135] If the secure channel is currently unavailable, a currently available secure channel is selected from preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

[0136] By encrypting notification messages and transmitting them through a secure channel, the security and reliability of message transmission can be improved, privacy data leakage can be avoided, and system security can be improved.

[0137] In some optional implementations, the message generation module 302 further includes a feedback submodule configured to:

[0138] Obtaining reception status information of the client, and determining whether the client has successfully received the notification message based on the reception status information;

[0139] If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered, and the notification message is resent according to the preset retransmission number and time interval until the client successfully receives the message or the maximum retransmission number is reached.

[0140] By confirming the receipt status after the message is sent, the notification message can be delivered safely and reliably to the greatest extent possible.

[0141] In this embodiment, the locking module 303 includes:

[0142] A parsing submodule, configured to parse the notification message through the client to obtain session locking instruction information;

[0143] A judgment submodule, configured to judge whether the current session needs to be locked according to the session locking instruction information, and if so, perform a session locking operation;

[0144] A search submodule, configured to obtain the session identification information of the current session when performing a session lock operation, and search for a corresponding session management record according to the session identification information;

[0145] The locking submodule is used to determine whether the locking state field of the session management record is in the unlocked state, and if so, set the locking state field to the locked state.

[0146] Locking the current session by parsing the session lock instruction obtained from the notification message can improve session security and protect user sensitive information. By locking the session, corresponding resources can be released and resource usage can be reduced. At the same time, after locking the session, the system can identify and process new session requests more quickly, thereby improving the system's response speed and overall performance.

[0147] In some optional implementations of this embodiment, the monitoring module 304 is further configured to:

[0148] Detecting a user input command, obtaining a pre-configured command list, and storing each command item in the command list as a string type;

[0149] Obtaining a command string of the command input by the user, and using a string similarity algorithm to calculate the command similarity between the command string and each command item in the command list;

[0150] When the command similarity is greater than or equal to a preset similarity threshold, the user input command is determined to be legal, and the password input prompt is popped up.

[0151] By monitoring the user input commands and obtaining the user input password, the password input security can be improved and other potential risks caused by misoperation can be prevented.

[0152] In some optional implementations of this embodiment, the authentication module 307 includes:

[0153] a comparison submodule, configured to compare the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent;

[0154] The result generation submodule is used to generate an authentication result indicating that the authentication is passed if the two are consistent, and to generate an authentication result indicating that the authentication is failed if the two are inconsistent, and return the authentication result to the client.

[0155] The authentication result is determined by password comparison, which effectively protects the security and privacy of user data and improves authentication efficiency.

[0156] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0157] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with a memory 41, a processor 42, and a network interface 43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0158] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0159] The memory 41 includes at least one type of readable storage medium, including flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, a magnetic disk, an optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash memory card, etc. equipped on the computer device 4. Of course, the memory 41 may also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions for a session processing method based on timeout locking. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0160] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute computer-readable instructions or process data stored in the memory 41, such as executing computer-readable instructions for the timeout-lock-based session processing method.

[0161] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0162] By transmitting a notification message in a specific format containing a session lock instruction to indicate a timeout, the existing session timeout message processing mechanism is utilized. Only the message content needs to be processed and integrated into the original process, rather than adding or modifying the existing process. This reduces the amount of code and the risk of potential errors. It also significantly improves the stability and reliability of the system, and provides more possibilities for future expansion and optimization.

[0163] The present application also provides another embodiment, namely, providing a computer-readable storage medium, which stores computer-readable instructions. The computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the session processing method based on timeout locking as described above.

[0164] By transmitting a notification message in a specific format containing a session lock instruction to indicate a timeout, the existing session timeout message processing mechanism is utilized. Only the message content needs to be processed and integrated into the original process, rather than adding or modifying the existing process. This reduces the amount of code and the risk of potential errors. It also significantly improves the stability and reliability of the system, and provides more possibilities for future expansion and optimization.

[0165] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0166] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A session processing method based on timeout locking, characterized in that: The steps include: Obtaining a session idle time threshold preset by the server, and determining whether the idle time of the current session exceeds the session idle time threshold; When the idle time of the current session exceeds the session idle time threshold, a notification message in a specific message format including a session lock instruction is generated, and the notification message is sent to the client through a preset secure channel; receiving the notification message, parsing the notification message through the client to obtain the session locking instruction, and locking the current session according to the session locking instruction; Monitor the user input command operation, if the user input command is detected, output a password input prompt and obtain the user input password; Sending the password input by the user to the server through the secure channel; Receiving the password input by the user, and encrypting the password input by the user using a preset encryption algorithm by the server to obtain an encrypted input password; Obtaining a pre-stored encrypted storage password of the user, and determining whether authentication is successful based on the encrypted input password and the encrypted storage password; When the authentication is successful, unlocking the current session through the client; If the authentication fails, an authentication failure prompt will be output and the session exit operation will be executed.

2. The session processing method based on timeout locking according to claim 1, characterized in that: The step of generating a notification message in a specific message format including a session lock instruction comprises: Obtain a specific message format corresponding to the session lock from a preset message format library; Determining, according to the specific message format, the session lock instruction content that needs to be included in the notification message; Automatically generate notification message text that conforms to the specific message format by using a natural language generation model and combining the content of the session lock instruction; The notification message text is associated with the session lock status to form a complete locked session notification message.

3. The session processing method based on timeout locking according to claim 1, characterized in that: The step of sending the notification message to the client through a preset secure channel includes: Obtaining the message content of the notification message, performing sensitive information identification and desensitization processing on the message content, and obtaining desensitized message content; Using an asymmetric encryption algorithm, based on a pre-generated public key and private key pair, the public key is used to encrypt the desensitized message content to obtain an encrypted ciphertext message; Performing hash calculation on the ciphertext message using a secure hash algorithm to obtain a message hash digest; Encapsulating the ciphertext message and the message hash digest into a secure message package, and adding security attributes to obtain an encapsulated message package; Querying a pre-established secure channel information table to obtain a secure channel identifier corresponding to the client; Determine whether the secure channel corresponding to the secure channel identifier is currently available, and if available, send the encapsulated message packet to the client through the secure channel; If the secure channel is currently unavailable, a currently available secure channel is selected from preset backup secure channels, and the encapsulated message packet is sent to the client through the secure channel.

4. The session processing method based on timeout locking according to claim 1, characterized in that: After the step of sending the notification message to the client through the preset secure channel, the method further includes: Obtaining reception status information of the client, and determining whether the client has successfully received the notification message based on the reception status information; If the judgment result is that the client has not successfully received the message, the preset message retransmission mechanism is triggered, and the notification message is resent according to the preset retransmission number and time interval until the client successfully receives the message or the maximum retransmission number is reached.

5. The session processing method based on timeout locking according to claim 1, characterized in that: The step of parsing the notification message by the client to obtain the session locking instruction and locking the current session according to the session locking instruction includes: Parsing the notification message by the client to obtain session locking instruction information; Determining whether the current session needs to be locked according to the session locking instruction information, and if locking is required, executing the session locking operation; When performing a session locking operation, obtaining the session identification information of the current session, and searching for the corresponding session management record according to the session identification information; It is determined whether the lock state field of the session management record is in an unlocked state; if it is in an unlocked state, the lock state field is set to a locked state.

6. The session processing method based on timeout locking according to claim 1, characterized in that: If a user input command is detected, a password input prompt is output, and the steps of obtaining the user input password include: Detecting a user input command, obtaining a pre-configured command list, and storing each command item in the command list as a string type; Obtaining a command string of the command input by the user, and using a string similarity algorithm to calculate the command similarity between the command string and each command item in the command list; When the command similarity is greater than or equal to a preset similarity threshold, the user input command is determined to be legal, and the password input prompt is popped up.

7. The session processing method based on timeout locking according to claim 1, characterized in that: The step of determining whether the authentication is successful based on the encrypted input password and the encrypted stored password includes: Comparing the encrypted input password with the encrypted stored password to determine whether the encrypted input password and the encrypted stored password are consistent; If they are consistent, an authentication result indicating that the authentication is passed is generated; if they are inconsistent, an authentication result indicating that the authentication is failed is generated and the authentication result is returned to the client.

8. A session processing device based on timeout locking, characterized in that: include: An acquisition module is used to obtain a session idle time threshold preset by the server and determine whether the idle time of the current session exceeds the session idle time threshold; a message generating module, configured to generate a notification message in a specific message format including a session lock instruction when the idle time of the current session exceeds the session idle time threshold, and send the notification message to the client through a preset secure channel; a locking module, configured to receive the notification message, parse the notification message through the client, obtain the session locking instruction, and lock the current session according to the session locking instruction; The monitoring module is used to monitor the operation of user input commands. If a user input command is detected, a password input prompt is output to obtain the password input by the user; A sending module, configured to send the password input by the user to the server through the secure channel; An encryption module is used to receive the password input by the user, and encrypt the password input by the user using a preset encryption algorithm through the server to obtain an encrypted input password; An authentication module, configured to obtain a pre-stored encrypted stored password of the user, and determine whether the authentication is successful based on the encrypted input password and the encrypted stored password; An execution module, configured to unlock the current session through the client when the authentication is passed; If the authentication fails, an authentication failure prompt will be output and the session exit operation will be executed.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the session processing method based on timeout locking are implemented as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the session processing method based on timeout locking according to any one of claims 1 to 7.

Images