Browser distributed verification processing method and system

Abstract

The invention discloses a browser distributed verification processing method and system, and the method comprises the steps: enabling a browser to judge whether a user is in a login state or not when the user accesses a webpage through the browser; when it is determined that the user is not in the login state, a preset access white list is started, and when a network target accessed by the user is not in the access white list, the user is prompted to log in by using a user name and a password; when the user is a registered user and directly logs in, the browser receives a user name and a password input by the user, and distributed verification is carried out based on the password; and when the distributed verification is successful, successfully logging in, and allowing the user to access the network target. According to the invention, the security of the system can be enhanced, and the security of user information and the stability of service are ensured; meanwhile, due to the design of distributed password storage, the overall system risk caused by faults or attacks of a certain browser can be reduced, and the overall robustness and reliability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the field of security verification technology, and more specifically, to a browser distributed verification processing method and system. Background Art

[0002] With the rapid development of the Internet, the requirements for network security are getting higher and higher. Invention patent application CN1349163A discloses a web page security publishing system based on the existing web page security publishing system. The characteristics are that the publishing file detection module in the first-level monitoring terminal is improved to a web page publishing file anti-tampering module set at the bottom of the web page publishing server operating system, which fully takes over the read and write operations of the file system, and the original publishing file upload and recovery protocol module connecting the first and second-level monitoring terminals is improved to a publishing file upload module, which executes the issuance of normal files. The file filter driver module is used to take over the read and write operations of the file system. When the user accesses the web page file system, the file filter driver module is used to obtain the operation information before the operation occurs, and the operation legality identification module is called at the same time to obtain the information on whether the operation is legal or not. For legal operations, the corresponding operation rights are granted according to their authority settings; and for illegal operations, the access rights to the web page file system are controlled to forcibly block the user's illegal operations on the file system. The invention has a strong timeliness for the anti-tampering of the published page, and the file tampering attack is prevented in advance, which eliminates the various adverse effects caused by the destruction of the published file and reduces the cost and time required for recovery.

[0003] The disadvantage of the existing technology is that the existing browsers are all restricted by URL. For example, you can restrict the browsing of URLs by blacklisting: the URL blacklist function helps you block access requests from the specified URL address; the URL whitelist function will allow all access requests of the specified URL; the URL content is not allowed to contain special characters such as spaces, tabs, and line breaks. If you restrict by blacklisting, you can only restrict the same browser. If different users use the same browser, there is no way to distinguish users.

[0004] Therefore, a browser distributed authentication processing method is needed. Summary of the invention

[0005] The present invention proposes a browser distributed authentication processing method and system to solve the problem of how to implement distributed authentication of browsers and improve system security.

[0006] In order to solve the above problem, according to one aspect of the present invention, a browser distributed verification processing method is provided, the method comprising:

[0007] When a user accesses a web page through a browser, the browser determines whether the user is logged in;

[0008] When it is determined that the user is not in a logged-in state, a preset access whitelist is started, and when the network target accessed by the user is not in the access whitelist, the user is prompted to log in using a user name and password;

[0009] When the user is a registered user and logs in directly, the browser receives the user name and password entered by the user and performs distributed verification based on the password;

[0010] When the distributed authentication succeeds, the login is successful and the user is allowed to access the network destination.

[0011] Preferably, the distributed verification based on the password comprises:

[0012] The browser generates the first character string based on the password according to a preset algorithm;

[0013] The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string;

[0014] The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string;

[0015] It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0016] Preferably, the method further comprises:

[0017] If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

[0018] Preferably, the method further comprises:

[0019] When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser;

[0020] The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments;

[0021] The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

[0022] Preferably, the method further comprises:

[0023] When a user registers, the security level of the new username is set to the lowest level.

[0024] Preferably, the method further comprises:

[0025] When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

[0026] Preferably, the method further comprises:

[0027] According to the security level corresponding to the user name, the recording rules of the behavior of using the browser under the user name are configured, and when the behavior recorded by the user name meets the downgrade condition corresponding to the user name, the security level corresponding to the user name is downgraded.

[0028] According to another aspect of the present invention, a browser distributed verification processing system is provided, the system comprising:

[0029] A login status determination unit, used for determining whether the user is in a login state when the user accesses a web page through a browser;

[0030] An access judgment unit, for starting a preset access whitelist when it is determined that the user is not in a logged-in state, and prompting the user to log in using a user name and password when the network target accessed by the user is not in the access whitelist;

[0031] A distributed verification unit, used for when a user is a registered user and logs in directly, the browser receives the user name and password input by the user, and performs distributed verification based on the password;

[0032] The login unit is used to successfully log in and allow the user to access the network target when the distributed authentication succeeds.

[0033] Preferably, the distributed verification unit performs distributed verification based on the password, including:

[0034] The browser generates the first character string based on the password according to a preset algorithm;

[0035] The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string;

[0036] The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string;

[0037] It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0038] Preferably, the distributed verification unit further comprises:

[0039] If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

[0040] Preferably, the system further comprises: a registration unit, configured to:

[0041] When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser;

[0042] The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments;

[0043] The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

[0044] Preferably, the registration unit is further used for:

[0045] When a user registers, the security level of the new username is set to the lowest level.

[0046] Preferably, the system further comprises: a security level adjustment unit, configured to:

[0047] When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

[0048] Preferably, the system further comprises:

[0049] A configuration unit, configured to configure a recording rule of the behavior of using the browser under the user name according to the security level corresponding to the user name;

[0050] The security level adjustment unit is used to downgrade the security level corresponding to the user name when the behavior recorded by the user name meets the downgrade condition corresponding to the user name.

[0051] The present invention provides a browser distributed verification processing method and system, including: when a user accesses a web page through a browser, the browser determines whether the user is in a logged-in state; when it is determined that the user is not in a logged-in state, a pre-set access whitelist is started, and when the network target accessed by the user is not in the access whitelist, the user is prompted to log in using a user name and password; when the user is a registered user and logs in directly, the browser receives the user name and password entered by the user, and performs distributed verification based on the password; when the distributed verification succeeds, the login is successful, and the user is allowed to access the network target. The present invention can enhance the security of the system, and also considers user friendliness and operational consistency. By implementing multi-level fault tolerance and alternative strategies in the password storage and login verification process, the system can effectively cope with various unforeseen situations, ensure the security of user information and the stability of services; at the same time, the design of distributed password storage can also reduce the overall system risk caused by a certain browser failure or attack, and improve the overall robustness and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] A more complete understanding of exemplary embodiments of the present invention may be obtained by referring to the following drawings:

[0053] Figure 1 is a flowchart of a browser distributed authentication processing method 100 according to an embodiment of the present invention;

[0054] Figure 2 Schematic diagram of the structure of a browser distributed authentication processing system 200 according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] Now, exemplary embodiments of the present invention are described with reference to the accompanying drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. These embodiments are provided to disclose the present invention in detail and completely and to fully convey the scope of the present invention to those skilled in the art. The terms used in the exemplary embodiments shown in the accompanying drawings are not intended to limit the present invention. In the accompanying drawings, the same units / elements are marked with the same reference numerals.

[0056] Unless otherwise specified, the terms (including technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is understood that the terms defined in commonly used dictionaries should be understood to have the same meanings as those in the context of the relevant fields, and should not be understood as idealized or overly formal meanings.

[0057] Figure 1 FIG. 1 is a flowchart of a browser distributed authentication processing method 100 according to an embodiment of the present invention. Figure 1As shown, the browser distributed verification processing method provided by the embodiment of the present invention can enhance the security of the system, and also considers user friendliness and operation consistency. By implementing multi-level fault tolerance and alternative strategies in the password storage and login verification process, the system can effectively deal with various unforeseen situations and ensure the security of user information and the stability of services; at the same time, the design of distributed password storage can also reduce the overall system risk caused by a certain browser failure or attack, and improve the overall robustness and reliability of the system. The browser distributed verification processing method 100 provided by the embodiment of the present invention starts from step 101. In step 101, when a user accesses a web page through a browser, the browser determines whether the user is in a logged-in state.

[0058] In step 102, when it is determined that the user is not in a logged-in state, a preset access whitelist is started, and when the network target accessed by the user is not in the access whitelist, the user is prompted to log in using a user name and password.

[0059] In the present invention, when a user accesses a web page through a browser, the browser determines whether the user logs in to the browser using a preset username and password. If the user does not log in using the preset username and password, a pre-set whitelist is started, wherein the whitelist pre-sets network targets that can be accessed by the user; if the network target that the user wishes to access is not in the whitelist, the user's access is denied, and the user is prompted to log in using the username and password.

[0060] In step 103, when the user is a registered user and logs in directly, the browser receives the user name and password input by the user and performs distributed authentication based on the password.

[0061] Preferably, the distributed verification based on the password comprises:

[0062] The browser generates the first character string based on the password according to a preset algorithm;

[0063] The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string;

[0064] The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string;

[0065] It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0066] Preferably, the method further comprises:

[0067] If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

[0068] Preferably, the method further comprises:

[0069] When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser;

[0070] The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments;

[0071] The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

[0072] In the present invention, when a user registers a username, the browser sends the username to the server, the server generates a globally unique ID for the username, the server sends the ID to the browser, the browser generates a string of characters using a predetermined algorithm, and divides the string of characters into N parts, the browser sends the characters to the server, and sends each of the N parts to different browsers for storage, wherein the browser receiving the N parts modulo N according to the last two digits of the MAC address of its own network card to obtain M, and the browser saves the ID of the browser that sent the characters and M. In this way, distributed browser password storage can be achieved.

[0073] When the user name is used to log in, the password input by the user is received, and the password is used to generate the first character according to a predetermined algorithm. Then, on the one hand, the browser sends a password request message to other browsers, and the other browsers send the M characters they save to the browser. After receiving all the M characters, the browser combines them into the second character. On the other hand, the browser divides the first string into N segments, obtains N string segments, and modulos the Nth part based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and combines M' based on the order of the MAC address of the terminal device where the other browsers are located to obtain the third string. Finally. The browser determines whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0074] In addition, if the browser cannot obtain all the N characters after a predetermined period of time, the browser obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters.

[0075] The present invention adopts an intelligent alternative solution when the browser cannot obtain all distributed and saved password parts in time during the user login process to ensure that the user can successfully complete the login operation. The design of this alternative solution takes into account various situations, such as network delays, unavailability or failure of certain browsers, and secure transmission and storage of password parts.

[0076] In step 104, when the distributed authentication succeeds, the login is successful and the user is allowed to access the network target.

[0077] In the present invention, when the browser performs distributed verification, first, when the user enters the password and submits the login request, the browser generates an initial character as the first step of login verification. Then, it sends a request to other browsers, and each browser responds to the corresponding password part according to pre-assigned rules (usually based on the last two digits of the MAC address of its network card). These parts are stored in different browsers in a decentralized manner, aiming to enhance the security and confidentiality of the password. The browser needs to collect all N parts of the password character response before it can splice them into the second character for the final login verification.

[0078] However, due to network conditions or other factors, some browsers may not respond to the request in time, so the system sets a predetermined waiting time to wait for all password parts to arrive. If the browser fails to obtain all N parts of the character response during this time, it will immediately start the backup plan. At this time, the browser will send a request to the server to obtain the password characters associated with the currently logged in user ID.

[0079] The server is ready to respond to these requests, and it retrieves the corresponding password characters based on the user ID. These characters are usually sent back to the browser in an encrypted or securely transmitted form. After the browser receives the password characters obtained from the server, it uses them as the second character for the second step of login verification. This process ensures that even if there are partial failures or delayed responses in the distributed password storage solution, the user can still log in smoothly, and the user's normal operation experience will not be affected by a single point of failure in the system.

[0080] This design is not only to enhance the security of the system, but also considers user-friendliness and operational consistency. By implementing multi-level fault tolerance and alternative strategies in the password storage and login verification process, the system can effectively deal with various unforeseen situations, ensuring the security of user information and the stability of services. At the same time, this distributed password storage solution can also reduce the overall system risk caused by a browser failure or attack, and improve the overall robustness and reliability of the system.

[0081] Among them, when the browser cannot obtain all distributed and saved password parts in time during the user login process (such as when some browsers cannot be online in time), in order to ensure that the user can log in normally, the following strategies can also be adopted:

[0082] 1. Backup Storage: In addition to splitting and storing passwords on multiple browsers, the entire encrypted password or a portion thereof can be backed up and stored on one or more reliable servers. When logging in is required, if some browsers fail to respond, the complete password data can be restored from the server. In a specific embodiment, in addition to sending each of the N parts to different browsers for storage respectively, each of the N parts can also be sent to multiple different servers respectively, binding multiple different browsers to multiple servers. For example, when the logged-in browser receives the (N - 1)th part of the characters of browser A from other browsers, the browser notifies server A bound to this browser A to send the corresponding part of the characters.

[0083] 2. Threshold Signature Technology: The threshold signature technology in cryptography is adopted, that is, the password is divided into N parts, but only T parts of them are required to reconstruct the password (T < N). In this way, even if not all parts can be obtained, as long as there are enough parts, the login verification can be completed. Thus, even if other browsers cannot be online simultaneously, it can be ensured that the browser can log in securely based on the obtained parts.

[0084] 3. Offline Recovery Mechanism: Users are allowed to restore access rights in an offline situation through pre-set security questions, backup email addresses, mobile phone SMS verification codes, etc., but this is relatively conventional.

[0085] 4. Temporary Credentials: When a user initially sets up an account, some temporary credentials (such as recovery codes) can be provided. The user can save these credentials in a secure place. When there is a situation where the online part is missing, these credentials can be used for temporary identity verification.

[0086] 5. Using a Centralized Authentication Service: A centralized authentication server can be established to store and manage authentication data. When a user attempts to log in, all requests are sent to this central server for verification, which can reduce the situation of relying on multiple browsers being online simultaneously.

[0087] 6. Introducing a Session Replication or Sharing Mechanism: If still relying on multiple browser nodes, a session replication or sharing mechanism can be considered. For example, the user's session information can be stored on all online browser nodes, or a shared storage system can be used to synchronize session information.

[0088] 7. Use a token-based authentication mechanism: You can use a token-based authentication mechanism, such as JWT (JSON WebTokens), to generate a token after the user successfully logs in and send it to the user. The user carries this token in subsequent requests for identity authentication, and the server confirms the user's identity by parsing the token. This method does not rely on the online status of the browser node, because the token is usually stored on the client and can be set with a longer validity period.

[0089] 8. Set a timeout mechanism and retry logic: During the user login process, if all authentication information cannot be obtained because some browser nodes are offline, you can set a timeout mechanism and try to re-acquire the information or obtain data from the central server after the timeout.

[0090] 9. Use blockchain technology: Blockchain technology can provide a distributed identity authentication solution, which can achieve cross-system and cross-border trusted digital identity management by generating a globally unique identity identifier (D ID) and verifiable digital credentials (VCs). This approach can ensure the consistency and verifiability of identity authentication information without a centralized server.

[0091] 10. Adopt event-driven synchronization mechanism: Through message queue and event-driven architecture, asynchronous synchronization of data can be achieved. When a user logs in, relevant events will be published to the message queue, and each browser node can subscribe to these events and update its own status, thereby achieving final consistency of data.

[0092] Through the combination of one or more of the above strategies, a robust authentication mechanism can be implemented in a distributed system to ensure that users can log in normally even when some browser nodes are not online.

[0093] Preferably, the method further comprises:

[0094] When a user registers, the security level of the new username is set to the lowest level.

[0095] In the present invention, a user can register a new user name through a browser, wherein the registration of a new user name requires filling in predetermined information, and the security level of the new user name obtained by registration is the most strictly restricted level. If the user wishes to increase the security level of the user name, a security level adjustment request is sent to a server, and the administrator checks through the server whether the information carried in the security level adjustment request meets the requirements. If it meets the requirements, the user name is adjusted to a new security level according to the security level adjustment request.

[0096] Preferably, the method further comprises:

[0097] When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

[0098] Preferably, the method further comprises:

[0099] According to the security level corresponding to the user name, the recording rules of the behavior of using the browser under the user name are configured, and when the behavior recorded by the user name meets the downgrade condition corresponding to the user name, the security level corresponding to the user name is downgraded.

[0100] In the present invention, after the user logs in using a predetermined user name and password, the browser determines the security level corresponding to the user name, wherein different security levels correspond to different network targets that can be accessed, for example, different security levels can correspond to different domain name suffixes, a first-level user name can access domain names with all suffixes, a second-level user name can access domain names with .com / .net / .cn / .org as suffixes, a third-level user name can access .net / .cn / .org, etc. Different security levels can also correspond to different blacklists.

[0101] The browser can determine whether the accessed webpage meets the security level requirement according to the security level of the user name, and if so, access the webpage; if not, deny the access request to the webpage.

[0102] For user names of different levels, after logging into the browser, the behaviors of using the browser under the user name can also be configured to be recorded according to the security level corresponding to the user name. For example, for user names of the first level, only the behaviors of the user name attempting to access the blacklist are recorded; for user names of the second level, the behaviors of the user name attempting to access the blacklist and attempting to access the pre-configured domain name suffix (the pre-configured domain name suffix is ​​outside the domain name suffix that the user name is allowed to access) are recorded; for users of the third level, all access behaviors under the user name are recorded. If the recorded behavior of the user name meets the demotion condition corresponding to the user name, the level corresponding to the user name is downgraded, and the access behavior corresponding to the downgraded user name is more strictly restricted than before the downgrade. For example, if the behavior of the user name of the first level in accessing and attempting to access the blacklist domain name exceeds the predetermined number of times within a predetermined time period, the access behavior corresponding to the user name is downgraded.

[0103] In the present invention, after the user logs in, the system performs access control and behavior monitoring according to the user's security level. The specific effects are as follows:

[0104] Precise access control: Users at different security levels can access different network resources. For example, users at the first level can freely access websites with all domain name suffixes, while users at the second level are limited to common suffixes such as .com, .net, .cn, and .org, and users at the third level are limited to fewer suffixes such as .net, .cn, and .org. This precise access control effectively prevents the risk of users unauthorized access to sensitive resources.

[0105] Intelligent blacklist management: Users at each security level can configure different blacklists. For example, for users at the first level, the system only records their attempts to access websites on the blacklist, for users at the second level, the system records blacklist accesses and attempts to access unauthorized domain name suffixes, and for users at the third level, the system records all access behaviors. This flexible blacklist management helps the system detect and respond to potential security threats in a timely manner.

[0106] Behavior records and security level adjustment: The system will dynamically adjust the user's security level based on the user's behavior record. For example, if a user at level 1 attempts to access a blacklisted domain name multiple times over a period of time, the system may reduce its security level to level 2 or lower to increase restrictions on its access behavior. This automated security level adjustment ensures that the system responds to and controls potential risks in a timely manner.

[0107] Based on the method of the present invention, rules can be formulated according to different users. The rules involve URLs that users can access, and users' access behaviors can also be recorded, so that the security level of users can be adjusted according to their access behaviors.

[0108] The above technology enables the method of the present invention to not only provide efficient access control and security management, but also dynamically adjust security policies according to user behavior, thereby effectively protecting user data and system security.

[0109] Figure 2 FIG. 2 is a schematic diagram of the structure of a browser distributed authentication processing system 200 according to an embodiment of the present invention. Figure 2 As shown, the browser distributed verification processing system 200 provided by the embodiment of the present invention includes: a login status judgment unit 201, an access judgment unit 202, a distributed verification unit 203 and a login unit 204.

[0110] Preferably, the login status determination unit 201 is used for the browser to determine whether the user is in a login status when the user accesses a web page through the browser.

[0111] Preferably, the access judgment unit 202 is used to start a preset access whitelist when it is determined that the user is not logged in, and prompt the user to log in using a user name and password when the network target accessed by the user is not in the access whitelist.

[0112] Preferably, the distributed verification unit 203 is used for, when the user is a registered user and logs in directly, the browser receives the user name and password input by the user, and performs distributed verification based on the password.

[0113] Preferably, the distributed verification unit 203 performs distributed verification based on the password, including:

[0114] The browser generates the first character string based on the password according to a preset algorithm;

[0115] The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string;

[0116] The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string;

[0117] It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

[0118] Preferably, the distributed verification unit 203 further includes:

[0119] If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

[0120] Preferably, the login unit 204 is used to successfully log in and allow the user to access the network target when the distributed authentication succeeds.

[0121] Preferably, the system further comprises: a registration unit, configured to:

[0122] When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser;

[0123] The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments;

[0124] The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

[0125] Preferably, the registration unit is further used for:

[0126] When a user registers, the security level of the new username is set to the lowest level.

[0127] Preferably, the system further comprises: a security level adjustment unit, configured to:

[0128] When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

[0129] Preferably, the system further comprises:

[0130] A configuration unit, configured to configure a recording rule of the behavior of using the browser under the user name according to the security level corresponding to the user name;

[0131] The security level adjustment unit is used to downgrade the security level corresponding to the user name when the behavior recorded by the user name meets the downgrade condition corresponding to the user name.

[0132] The browser distributed authentication processing system 200 of the embodiment of the present invention corresponds to the browser distributed authentication processing method 100 of another embodiment of the present invention, and will not be described in detail here.

[0133] The invention has been described above with reference to a few embodiments. However, it is readily apparent to a person skilled in the art that other embodiments than the ones disclosed above are equally within the scope of the invention, as defined by the appended patent claims.

[0134] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise therein. All references to "a / said / the [means, components, etc.]" are to be openly interpreted as at least one instance of said means, components, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not necessarily have to be performed in the exact order disclosed, unless explicitly stated otherwise.

[0135] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0137] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A browser distributed authentication processing method, characterized in that: The method comprises: When a user accesses a web page through a browser, the browser determines whether the user is logged in; When it is determined that the user is not in a logged-in state, a preset access whitelist is started, and when the network target accessed by the user is not in the access whitelist, the user is prompted to log in using a user name and password; When the user is a registered user and logs in directly, the browser receives the user name and password entered by the user and performs distributed verification based on the password; When the distributed authentication succeeds, the login is successful and the user is allowed to access the network destination.

2. The method according to claim 1, characterized in that The distributed verification based on the password includes: The browser generates the first character string based on the password according to a preset algorithm; The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string; The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string; It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

3. The method according to claim 2, characterized in that The method further comprises: If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

4. The method according to claim 1, characterized in that: The method further comprises: When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser; The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments; The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

5. The method according to claim 4, characterized in that The method further comprises: When a user registers, the security level of the new username is set to the lowest level.

6. The method according to claim 5, characterized in that The method further comprises: When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

7. The method according to claim 5, characterized in that The method further comprises: According to the security level corresponding to the user name, the recording rules of the behavior of using the browser under the user name are configured, and when the behavior recorded by the user name meets the downgrade condition corresponding to the user name, the security level corresponding to the user name is downgraded.

8. A browser distributed verification processing system, characterized in that: The system comprises: A login status determination unit, used for determining whether the user is in a login state when the user accesses a web page through a browser; An access judgment unit, for starting a preset access whitelist when it is determined that the user is not in a logged-in state, and prompting the user to log in using a user name and password when the network target accessed by the user is not in the access whitelist; A distributed verification unit, used for when a user is a registered user and logs in directly, the browser receives the user name and password input by the user, and performs distributed verification based on the password; The login unit is used to successfully log in and allow the user to access the network target when the distributed authentication succeeds.

9. The system according to claim 8, characterized in that The distributed verification unit performs distributed verification based on the password, including: The browser generates the first character string based on the password according to a preset algorithm; The browser obtains a unique identifier corresponding to the user name input by the user, and sends a password request message to other browsers based on the unique identifier to obtain M stored by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and concatenates M based on the order of the MAC addresses of the terminal devices where the other browsers are located to obtain a second character string; The browser divides the first string into N segments, obtains N string segments, modulo the Nth segment based on the last two digits of the MAC address of the terminal device where the other browsers are located to obtain M', and concatenates M' in the order based on the MAC address of the terminal device where the other browsers are located to obtain a third string; It is determined whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are inconsistent, the verification fails.

10. The system according to claim 9, characterized in that The distributed verification unit further includes: If the browser cannot obtain all N parts of characters within a preset time, the browser sends a password acquisition request to the server, obtains the characters corresponding to the identifier of the user name from the server, and uses the obtained characters as the second characters; wherein, when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

11. The system according to claim 8, characterized in that The system further comprises: a registration unit, configured to: When the user is an unregistered user, the browser sends the new user name to the server, so that the server generates a global unique identifier for the new user name and returns it to the browser; The browser generates a first character string based on the password according to a preset algorithm, sends the first character string to the server, and divides the first character string into N segments to obtain N character string segments; The browser sends the N string segments to different other browsers for storage, so that for any other browser that receives any string segment, the modulus of the string segment is taken according to the last two digits of the MAC address of the terminal device where the other browser is located to obtain M, and the unique identifier of the browser and M are saved.

12. The system according to claim 11, characterized in that The registration unit is further used for: When a user registers, the security level of the new username is set to the lowest level.

13. The system according to claim 12, characterized in that The system further comprises: a security level adjustment unit, configured to: When the user is logged in, a security level increase request is sent to the server, so that the administrator can determine whether the requirements are met based on the application information carried in the security level increase request, and if the requirements are met, the security level of the user is increased.

14. The system according to claim 12, characterized in that The system further comprises: A configuration unit, configured to configure a recording rule of the behavior of using the browser under the user name according to the security level corresponding to the user name; The security level adjustment unit is used to downgrade the security level corresponding to the user name when the behavior recorded by the user name meets the downgrade condition corresponding to the user name.

Images