A browser distributed verification processing method and system

Abstract

The application discloses a kind of browser distributed authentication processing method and system, comprising: when user accesses webpage by browser, browser judges whether the user is in login state;When it is determined that the user is not in login state, start the access white list of pre-setting, and when the network target visited by user is not in access white list, prompt user to use username and password to log in;When user is registered user and directly logs in, browser receives the username and password input by user, and carries out distributed authentication based on the password;When distributed authentication succeeds, successfully log in, and allow user to access the network target.The application can enhance the security of system, ensure the security of user information and the stability of service;At the same time, the design of distributed password storage can also reduce the overall system risk caused by the failure or attack of a browser, improve the overall robustness and reliability of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security verification, and more particularly, to a browser distributed verification processing method and system. BACKGROUND

[0002] With the rapid development of the Internet, the requirement for network security is also increasing. The patent application CN1349163A discloses a web page security publishing system, which is characterized in that the publishing file detection module in the primary monitoring terminal is improved to set a web page publishing file tamper-proof module in the operating system of the web page publishing server, to take over the read and write operations of the file system, and the original publishing file uploading and recovery protocol module connecting the primary and secondary monitoring terminals is improved to a publishing file uploading module to execute the signing of normal files. The file filtering driver module takes over the read and write operations of the file system. When a user accesses the web page file system, the file filtering driver module obtains the operation information before the operation, and calls the operation legality identification module to obtain the information of whether the operation is legal. For legal operations, the corresponding operation rights are given according to the permission settings, and for illegal operations, the access rights to the web page file system are controlled to forcibly block the illegal operations of the user on the file system. The application has strong timeliness in preventing the tampering of the published pages, prevents the file tampering attacks in advance, eliminates the adverse effects caused by the destruction of the publishing files, and reduces the cost and time required for recovery.

[0003] The existing browser restricts the URL, for example, the URL can be restricted by a blacklist: the URL blacklist function helps to block access requests from specified URL addresses; the URL whitelist function allows all access requests of the specified URL; and the URL content is not allowed to contain special characters such as spaces, tabs, and line breaks. However, the restriction by the blacklist can only be applied to the same browser, and it is impossible to distinguish users if the same browser is used by different users.

[0004] Therefore, there is a need for a browser distributed verification processing method. SUMMARY

[0005] The present application provides a browser distributed verification processing method and system to solve the problem of how to implement the distributed authentication of the browser and improve the security of the system.

[0006] In order to solve the above problems, according to one aspect of the present application, a browser distributed verification processing method is provided, which comprises:

[0007] When a user accesses a webpage through a browser, the browser determines whether the user is in a login state;

[0008] When it is determined that the user is not in the login state, a pre-set access whitelist is started, and when the user accesses a network target not in the access whitelist, the user is prompted to log in using a username and a password;

[0009] When the user directly logs in as a registered user, the browser receives a username and a password input by the user, and performs distributed verification based on the password;

[0010] When the distributed verification is successful, the user is successfully logged in and allowed to access the network target.

[0011] Preferably, wherein the distributed verification based on the password comprises:

[0012] The browser generates the first string according to a preset algorithm based on the password;

[0013] The browser obtains a unique identifier corresponding to the username input by the user, and sends password request information to other browsers based on the unique identifier to obtain M saved by other browsers and the MAC address of the terminal device where other browsers are located, and splices M based on the order of the MAC address of the terminal device where other browsers are located to obtain a second string;

[0014] The browser divides the first string into N segments, obtains N string segments, takes the remainder of the Nth segment based on the last two digits of the MAC address of the terminal device where other browsers are located to obtain M', and splices M' based on the order of the MAC address of the terminal device where other browsers are located to obtain a third string;

[0015] Determine whether the second character and the third character are consistent, if consistent, the verification is successful; if not consistent, the verification fails.

[0016] Preferably, wherein the method further comprises:

[0017] If the browser cannot obtain all N segments of characters within a preset time, the browser sends a password acquisition request to a server, obtains a character corresponding to the identifier of the username from the server, and takes the obtained character as the second character; wherein, when the user registers, the browser sends the username to the server, and the server generates a globally unique identifier for the username.

[0018] Preferably, wherein the method further comprises:

[0019] When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username and returns to the browser;

[0020] The browser generates a first string according to a preset algorithm based on the password, sends the first string to the server, and divides the first string into N segments to obtain N string segments;

[0021] The browser sends the N string segments to different other browsers for saving, so that for any other browser receiving any string segment, M is obtained by taking the remainder of the last two digits of the MAC address of the terminal device where the any other browser is located, and the unique identifier of the browser and M are saved.

[0022] Preferably, the method further comprises:

[0023] When the user registers, the security level of the new username is set to the lowest level.

[0024] Preferably, the method further comprises:

[0025] When the user is in a login state, a security level improvement request is sent to the server, so that the administrator judges whether the requirements are met based on the application information carried in the security level improvement request, and when the requirements are met, the security level of the user is improved.

[0026] Preferably, the method further comprises:

[0027] According to the security level corresponding to the username, a record rule of the behavior of using the browser under the username is configured, and when the recorded behavior of the username meets the downgrade condition corresponding to the username, the security level corresponding to the username is downgraded.

[0028] According to another aspect of the application, a browser distributed verification processing system is provided, the system comprising:

[0029] A login state judgment unit is configured to determine whether the user is in a login state when the user accesses a webpage through the browser.

[0030] An access judgment unit is configured to start a pre-set access whitelist when it is determined that the user is not in a login state, and prompt the user to log in using a username and a password when the network target accessed by the user is not in the access whitelist.

[0031] A distributed verification unit is configured to receive a username and a password input by a user when the user is a registered user and directly log in, and perform distributed verification based on the password.

[0032] A login unit is configured to log in successfully when the distributed verification is successful, and allow the user to access the network target.

[0033] Preferably, the distributed verification unit performs distributed verification based on the password, including:

[0034] The browser generates the first string according to a preset algorithm based on the password;

[0035] The browser acquires a unique identifier corresponding to the username input by the user, and sends a password request message to other browsers based on the unique identifier to acquire M saved by other browsers and MAC addresses of terminal devices where other browsers are located, and splices M based on the order of the MAC addresses of the terminal devices where other browsers are located to acquire a second string;

[0036] The browser divides the first string into N segments, acquires N string segments, takes M' by taking the remainder of the Nth segment based on the last two digits of the MAC addresses of the terminal devices where other browsers are located, and splices M' based on the order of the MAC addresses of the terminal devices where other browsers are located to acquire a third string;

[0037] It is determined whether the second character and the third character are consistent, if yes, the verification is successful, and if not, the verification fails.

[0038] Preferably, the distributed verification unit further includes:

[0039] If the browser cannot acquire characters of all N segments within a preset time, the browser sends a password acquisition request to a server, acquires characters corresponding to the identifier of the username from the server, and takes the acquired characters as the second characters; when the user registers, the browser sends the username to the server, and the server generates a globally unique identifier for the username.

[0040] Preferably, the system further includes a registration unit configured to:

[0041] When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username, and returns to the browser;

[0042] The browser generates a first string according to a preset algorithm based on the password, sends the first string to the server, divides the first string into N segments, and acquires N string segments;

[0043] The browser sends the N string segments to different other browsers for storage, so that for any other browser receiving any string segment, M is obtained by taking the remainder of the last two digits of the MAC address of the terminal device where the any other browser is located, and the unique identifier of the browser and M are stored.

[0044] Preferably, the registration unit is further configured to:

[0045] When a user registers, the security level of a new username is set to the lowest level.

[0046] Preferably, the system further comprises a security level adjustment unit configured to:

[0047] When the user is in a login state, a security level improvement request is sent to the server, so that an administrator judges whether the application information carried in the security level improvement request meets the requirements, and when the requirements are met, the security level of the user is improved.

[0048] Preferably, the system further comprises:

[0049] A configuration unit is configured to configure a record rule of a behavior of using the browser under the username according to the security level corresponding to the username.

[0050] A security level adjustment unit is configured to downgrade the security level corresponding to the username when the behavior recorded under the username meets the downgrade condition corresponding to the username.

[0051] The application provides a browser distributed authentication processing method and system, comprising: when a user accesses a webpage through a browser, the browser judges whether the user is in a login state; when it is determined that the user is not in the login state, a pre-set access whitelist is started, and when a network target accessed by the user is not in the access whitelist, the user is prompted to log in by using a username and a password; when the user directly logs in as a registered user, the browser receives the username and the password input by the user, and performs distributed authentication based on the password; when the distributed authentication succeeds, the user is successfully logged in and is allowed to access the network target. The application can enhance the security of the system, and also considers user friendliness and operation continuity. By implementing multi-level fault tolerance and alternative strategies in the password storage and login authentication process, the system can effectively deal with various unpredictable situations, ensure the security of user information and the stability of services; meanwhile, the design of the distributed password storage can also reduce the overall system risk caused by the failure or attack of a certain browser, and improve the overall robustness and reliability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0052] The exemplary embodiments of the present application can be more fully understood with reference to the following drawings in which:

[0053] Figure 1 A flow chart of a browser distributed authentication processing method 100 according to an embodiment of the application;

[0054] Figure 2 A structure schematic diagram of a browser distributed authentication processing system 200 according to an embodiment of the application. DETAILED DESCRIPTION

[0055] The exemplary embodiments of the present application will now be described with reference to the accompanying drawings. The present application can, however, be carried out in many different ways, and is not limited to the embodiments described herein. These embodiments are provided so that this disclosure will be thorough and complete, and fully convey the scope of the application to those skilled in the art. The terminology used in the description of the exemplary embodiments herein is not intended to be limiting of the present application. Same reference numerals in different drawings denote the same elements.

[0056] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

[0057] Figure 1 A flow chart of a browser distributed authentication processing method 100 according to an embodiment of the application. As shown in FIG. 1, the method comprises the following steps. Figure 1As shown, the browser distributed verification processing method provided by the embodiment of the application can enhance the security of the system, and also considers user friendliness and operation continuity. By implementing multi-level fault tolerance and alternative strategies in the password storage and login verification process, the system can effectively deal with various unpredictable situations, ensure the security of user information and the stability of services. Meanwhile, the design of distributed password storage can reduce the overall system risk caused by the failure or attack of a browser, and improve the overall robustness and reliability of the system. The browser distributed verification processing method 100 provided by the embodiment of the application starts from step 101. In step 101, when a user accesses a webpage through a browser, the browser determines whether the user is in a login state.

[0058] In step 102, when it is determined that the user is not in the login state, a pre-set access whitelist is started, and when the network target accessed by the user is not in the access whitelist, the user is prompted to log in by using a username and a password.

[0059] In the application, when a user accesses a webpage through a browser, the browser determines whether the user logs into the browser by using a predetermined username and password. If the user does not log in by using the predetermined username and password, a pre-set whitelist is started, wherein the whitelist pre-sets network targets that can be accessed by the user. If the network target that the user wants to access is not in the whitelist, the access of the user is rejected, and the user is prompted to log in by using a username and a password.

[0060] In step 103, when the user directly logs in as a registered user, the browser receives a username and a password input by the user, and performs distributed verification based on the password.

[0061] Preferably, the distributed verification based on the password comprises:

[0062] The browser generates the first string according to a preset algorithm based on the password.

[0063] The browser acquires a unique identifier corresponding to the username input by the user, and sends password request information to other browsers based on the unique identifier, to acquire M saved by other browsers storing the unique identifier and the MAC address of the terminal device where the other browsers are located, and splice M based on the order of the MAC address of the terminal device where the other browsers are located, to acquire the second string.

[0064] The browser divides the first string into N segments, obtains N string segments, performs modulo operation on the Nth segment based on the last two digits of the MAC address of the terminal device where the other browser is located to obtain M', and splices M' based on the order of the MAC address of the terminal device where the other browser is located to obtain a third string.

[0065] It is judged whether the second character and the third character are consistent. If consistent, the verification is successful; if not consistent, the verification fails.

[0066] Preferably, the method further comprises:

[0067] If the browser cannot obtain all the characters of the N segments within a preset time, the browser sends a password obtaining request to the server, obtains the characters corresponding to the identifier of the username from the server, and takes the obtained characters as the second characters; wherein, when the user registers, the browser sends the username to the server, and the server generates a globally unique identifier for the username.

[0068] Preferably, the method further comprises:

[0069] When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username, and returns to the browser;

[0070] The browser generates a first string based on the password according to a preset algorithm, sends the first string to the server, and divides the first string into N segments to obtain N string segments.

[0071] The browser sends the N string segments to different other browsers for saving, so that for any other browser receiving any string segment, the last two digits of the MAC address of the terminal device where the other browser is located are taken as M, and the unique identifier of the browser and M are saved.

[0072] In the present application, when a user registers a username, the browser sends the username to the server, which generates a globally unique identification (ID) for the username. The server sends the identification to the browser, which generates a string of characters using a predetermined algorithm and divides the string into N parts. The browser sends the characters to the server and each of the N parts to a different browser for storage. The browser that receives N parts takes the remainder of N when divided by the last two digits of its own network card's MAC address to obtain M, and then saves the identification of the browser that sent the characters and M. In this way, distributed browser password storage can be achieved.

[0073] When the username logs in, the password input by the user is received and a first character is generated according to a predetermined algorithm. Then, on the one hand, the browser sends a password request to other browsers, which send their saved M characters to the browser. After receiving all M, the browser combines them into a second character. On the other hand, the browser divides the first character string into N segments, obtains N character segments, and takes the remainder of the Nth segment when divided by the last two digits of the MAC address of the terminal device where the other browser is located to obtain M'. Then, based on the order of the MAC addresses of the terminal devices where the other browsers are located, M' is spliced to obtain a third character string. Finally, the browser determines whether the second character and the third character are consistent. If they are consistent, the verification is successful; if they are not consistent, the verification fails.

[0074] In addition, if the browser cannot obtain all N part characters within a predetermined time, the browser obtains the corresponding character of the username's identification from the server and uses the obtained character as the second character.

[0075] The present application provides an intelligent alternative solution when the browser cannot obtain all distributed password parts in time during user login, to ensure that the user can successfully complete the login operation. This alternative solution takes into account various situations such as network delay, unavailability or failure of some browsers, and secure transmission and storage of password parts.

[0076] In step 104, when the distributed verification is successful, the user is successfully logged in and allowed to access the network target.

[0077] In the present invention, when a browser performs distributed verification, first, when the user inputs the password and submits a login request, the browser generates an initial character as the first step of verification for login. Then, it sends a request to other browsers, each of which responds with a corresponding password part according to a pre-assigned rule (usually based on the last two digits of its network card's MAC address). These parts are stored in different browsers, aiming to enhance the security and confidentiality of the password. The browser needs to collect all N parts of the password character responses before it can splice them into the second character for the final login verification.

[0078] However, due to network conditions or other factors, some browsers may fail to respond to the request in time, so the system sets a predetermined waiting period to wait for the arrival of all password parts. If within this time, the browser fails to obtain all N part character responses, it will immediately initiate an alternative solution. At this time, the browser sends a request to the server to request the password character associated with the current login user identification.

[0079] The server side is ready to respond to these requests, and it will retrieve the corresponding password character according to the user identification. These characters are usually sent back to the browser in encrypted or secure transmission. After receiving the password characters obtained from the server, the browser uses them as the second character for the second step of login verification. This process ensures that even in the case of partial failure or delayed response in the distributed password storage scheme, the user can still successfully log in, and the normal operation experience of the user will not be affected by the single point of failure in the system.

[0080] This design not only enhances the security of the system, but also considers user friendliness and operational continuity. By implementing multi-level fault tolerance and alternative strategies in password storage and login verification processes, the system can effectively deal with various unforeseen situations, ensuring the security of user information and the stability of services. At the same time, this distributed password storage scheme can reduce the overall system risk caused by the failure or attack of a browser, improving the overall robustness and reliability of the system.

[0081] When the browser cannot obtain all distributed password parts in time during the user login process (such as in the case of some browsers being unable to be online in time), the following strategies can be taken to ensure that the user can log in normally:

[0082] 1. Backup storage: In addition to splitting and storing passwords on multiple browsers, the entire encrypted password or a part of it can be backed up and stored on one or more reliable servers. When logging in is required, if some browsers fail to respond, the complete password data can be restored from the server. In a specific embodiment, in addition to separately sending each of the N parts to different browsers for saving, each of the N parts can also be separately sent to multiple different servers, and multiple different browsers are bound to multiple servers. For example, when the logged-in browser receives the (N - 1)th part of characters from browser A among other browsers, the browser notifies server A bound to this browser A to send the corresponding part of characters over.

[0083] 2. Threshold signature technology: The threshold signature technology in cryptography is adopted, that is, the password is divided into N parts, but only T parts of them are required to reconstruct the password (T < N). In this way, even if not all parts can be obtained, as long as there are enough parts, the login verification can be completed. Thus, even if other browsers are not online simultaneously, it can be ensured that the browser can log in securely based on the obtained parts. [[ID=]]

[0084] 3. Offline recovery mechanism: It allows users to restore access rights in an offline situation through pre-set security questions, backup email, mobile phone SMS verification codes, etc., but this is relatively conventional.

[0085] 4. Temporary credentials: When a user initially sets up an account, some temporary credentials (such as recovery codes) can be provided. The user can save these credentials in a safe place and use them for temporary authentication when the online part is missing.

[0086] 5. Using a centralized authentication service: A centralized authentication server can be established to store and manage authentication data. When a user attempts to log in, all requests are sent to this central server for verification, which can reduce the situation of relying on multiple browsers being online simultaneously.

[0087] 6. Introducing a session replication or sharing mechanism: If still relying on multiple browser nodes, a session replication or sharing mechanism can be considered. For example, the session information of the user can be stored on all online browser nodes, or a shared storage system can be used to synchronize the session information.

[0088] 7. Use Token-based authentication mechanism: Token-based authentication mechanisms such as JWT (JSON Web Tokens) can be used. After a successful user login, a Token is generated and sent to the user. The user carries this Token in subsequent requests for authentication, and the server verifies the user's identity by parsing the Token. This approach does not rely on the online status of browser nodes, as Tokens are usually stored on the client side and can be set to have a long validity period.

[0089] 8. Set timeout mechanism and retry logic: During the user login process, if some browser nodes are not online and cannot obtain all identity verification information, a timeout mechanism can be set, and after the timeout, the information is reacquired or data is obtained from the central server.

[0090] 9. Use blockchain technology: Blockchain technology can provide a distributed identity verification solution by generating globally unique identifiers (DIDs) and verifiable data credentials (VCs), enabling cross-system and cross-border trusted digital identity management. This approach ensures the consistency and verifiability of identity verification information without a centralized server.

[0091] 10. Use event-driven synchronization mechanism: Through message queues and event-driven architecture, asynchronous synchronization of data can be achieved. When a user logs in, relevant events are published to the message queue, and each browser node can subscribe to these events and update its own state, achieving eventual consistency of data.

[0092] Through the combination of one or more of the above strategies, a robust identity verification mechanism can be implemented in a distributed system to ensure that users can log in normally even if some browser nodes are not online.

[0093] Preferably, the method further comprises:

[0094] When a user registers, set the security level of the new username to the lowest level.

[0095] In the present application, a user can register a new username through a browser, where registering a new username requires filling in predetermined information, and the security level of the new username obtained by registration is the most restrictive level. If the user wants to improve the security level of the username, send a security level adjustment request to the server, and the administrator checks whether the information carried in the security level adjustment request meets the requirements through the server. If it meets the requirements, the username is adjusted to a new security level according to the security level adjustment request.

[0096] Preferably, the method further comprises:

[0097] When the user is in a login state, a security level improvement request is sent to a server, so that an administrator judges whether it meets the requirements based on application information carried in the security level improvement request, and when it meets the requirements, the security level of the user is improved.

[0098] Preferably, the method further comprises:

[0099] According to the security level corresponding to the username, a recording rule of the behavior of using the browser under the username is configured, and when the recorded behavior of the username meets the downgrade condition corresponding to the username, the security level corresponding to the username is downgraded.

[0100] In the present application, after the user logs in using a predetermined username and password, the browser judges the security level corresponding to the username, wherein the accessible network targets corresponding to different security levels are different, for example, different security levels can correspond to different domain name suffixes, the first level username can access all domain names with suffixes, the second level username can access domain names with.com / .net / .cn / .org suffixes, and the third level username can access.net / .cn / .org, etc. Different security levels can also correspond to different blacklists.

[0101] The browser can judge whether the accessed webpage meets the requirements of the security level according to the security level of the username, if it meets, access the webpage, if it does not meet, refuse the access request of the webpage.

[0102] For different levels of usernames, after logging into the browser, the behavior of using the browser under the username can also be recorded according to the security level corresponding to the username. For example, the first level username only records the behavior of the username attempting to access the blacklist; the second level username records the behavior of the username attempting to access the blacklist and attempting to access the pre-configured domain name suffix (which is outside the domain name suffix allowed to be accessed by the username); the third level user records all access behaviors under the username. If the recorded behavior of the username meets the downgrade condition corresponding to the username, the level corresponding to the username is downgraded, and the access behavior of the username after the downgrade is more strictly limited than before the downgrade. For example, the access behavior of the first level username is downgraded when the behavior of attempting to access the blacklist domain name exceeds a predetermined number of times within a predetermined time period.

[0103] In the present invention, after the user logs in, the system controls access and monitors behavior according to their security level, with specific effects as follows:

[0104] Precise access control: Users of different security levels can access different network resources. For example, first-level users can freely access all domain name suffix websites, while second-level users are limited to accessing common suffixes such as.com,.net,.cn, and.org, and third-level users are limited to even fewer suffixes such as.net,.cn, and.org. This precise access control effectively prevents users from accessing sensitive resources beyond their authority.

[0105] Intelligent blacklist management: Users of each security level can configure different blacklists. For example, first-level users' system only records their behavior of attempting to access websites in the blacklist, second-level users record both blacklist access and attempts to access unauthorized domain name suffixes, and third-level users record all access behavior. This flexible blacklist management helps the system discover and respond to potential security threats in a timely manner.

[0106] Behavior recording and security level adjustment: The system dynamically adjusts the security level of users based on their behavior records. For example, if a first-level user repeatedly attempts to access domain names in the blacklist within a certain period of time, the system may lower their security level to the second level or lower to increase restrictions on their access behavior. This automated security level adjustment ensures that the system responds and controls potential risks in a timely manner.

[0107] Based on the method of the present invention, rules can be formulated for different users, involving the URLs they can access, and their access behavior can be recorded to adjust their security level based on their access behavior.

[0108] The above technology makes the method of the present invention not only provide efficient access control and security management, but also dynamically adjust security policies according to user behavior, effectively protecting user data and system security.

[0109] Figure 2 The structure diagram of the browser distributed verification processing system 200 according to the embodiment of the present invention. As shown in Figure 2 The browser distributed verification processing system 200 provided by the embodiment of the present invention includes: a login state judgment unit 201, an access judgment unit 202, a distributed verification unit 203, and a login unit 204.

[0110] Preferably, the login state judgment unit 201 is configured to determine whether the user is in a login state when the user accesses a webpage through a browser.

[0111] Preferably, the access judging unit 202 is configured to, when determining that the user is not in the login state, start a pre-set access white list, and when the network target accessed by the user is not in the access white list, prompt the user to log in using a user name and a password.

[0112] Preferably, the distributed verification unit 203 is configured to, when the user is a registered user and directly logs in, receive, by the browser, a user name and a password input by the user, and perform distributed verification based on the password.

[0113] Preferably, the distributed verification unit 203 performs distributed verification based on the password, including:

[0114] the browser generates the first string according to a preset algorithm based on the password;

[0115] the browser acquires a unique identifier corresponding to the user name input by the user, and sends, based on the unique identifier, a password request information to other browsers to acquire M saved by other browsers and MAC addresses of terminal devices where the other browsers are located, and splices M based on the order of the MAC addresses of the terminal devices where the other browsers are located to acquire a second string;

[0116] the browser divides the first string into N segments, acquires N string segments, takes M' by performing modulo operation on the Nth segment based on the last two bits of the MAC addresses of the terminal devices where the other browsers are located, and splices M' based on the order of the MAC addresses of the terminal devices where the other browsers are located to acquire a third string;

[0117] determines whether the second character and the third character are consistent, and if yes, the verification is successful, and if not, the verification fails.

[0118] Preferably, the distributed verification unit 203 further includes:

[0119] if the browser cannot acquire all the N segments of characters within a preset time, the browser sends a password acquisition request to a server, acquires a character corresponding to the identifier of the user name from the server, and takes the acquired character as the second character; when the user registers, the browser sends the user name to the server, and the server generates a globally unique identifier for the user name.

[0120] Preferably, the login unit 204 is configured to, when the distributed verification is successful, successfully log in and allow the user to access the network target.

[0121] Preferably, the system further includes a registration unit configured to:

[0122] When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username and returns to the browser;

[0123] The browser generates a first string according to a preset algorithm based on the password, sends the first string to the server, and divides the first string into N segments to obtain N string segments;

[0124] The browser sends the N string segments to different other browsers for storage, so that for any other browser receiving any string segment, M is obtained by taking the remainder of the last two digits of the MAC address of the terminal device where the any other browser is located, and the unique identifier of the browser and M are stored.

[0125] Preferably, the registration unit is further configured to:

[0126] When the user registers, the security level of the new username is set to the lowest level.

[0127] Preferably, the system further comprises a security level adjustment unit configured to:

[0128] When the user is in a login state, a security level improvement request is sent to the server, so that the administrator judges whether the application information carried in the security level improvement request meets the requirements, and when the requirements are met, the security level of the user is improved.

[0129] Preferably, the system further comprises:

[0130] A configuration unit is configured to configure a record rule of a behavior of using the browser under the username according to the security level corresponding to the username.

[0131] A security level adjustment unit is configured to downgrade the security level corresponding to the username when the behavior recorded under the username meets the downgrade condition corresponding to the username.

[0132] The browser distributed verification processing system 200 of the embodiment of the application corresponds to the browser distributed verification processing method 100 of another embodiment of the application, and will not be described here.

[0133] The application has been described by referring to a few embodiments. However, it is well known to those skilled in the art that, as defined in the attached patent claims, other embodiments equivalent to the above disclosure of the application fall within the scope of the application.

[0134] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined in the patent or patent application to which this disclosure pertains. All references to "a" or "an" means "at least one", unless otherwise clearly indicated by the context of the disclosure. The steps of any methods disclosed herein need not be performed in the precise order disclosed unless explicitly stated.

[0135] As will be appreciated by one skilled in the art, embodiments of the present application can be comprised of a method, a system, or a computer program product. Accordingly, the present application can be embodied in a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0136] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0137] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0139] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit it. Although the present application has been described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the specific embodiments of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and any modification or equivalent replacement without departing from the spirit and scope of the present application should be covered in the protection scope of the claims of the present application.

Claims

1. A browser-based distributed authentication processing method, characterized in that, The method comprises: When a user accesses a webpage through a browser, the browser determines whether the user is in a login state; When it is determined that the user is not in the login state, a pre-set access whitelist is started, and when a network target accessed by the user is not in the access whitelist, the user is prompted to log in using a username and a password; When the user directly logs in as a registered user, the browser receives the username and the password input by the user, and performs distributed verification based on the password; When the distributed verification is successful, the user is successfully logged in and allowed to access the network target; The distributed verification based on the password comprises: The browser generates a first string according to a preset algorithm based on the password; The browser acquires a unique identifier corresponding to the username input by the user, and sends password request information based on the unique identifier to other browsers to acquire M saved by other browsers and MAC addresses of terminal devices where the other browsers are located, and splices M based on the order of the MAC addresses of the terminal devices where the other browsers are located to acquire a second string; The browser divides the first string into N segments, acquires N string segments, takes M' by taking the remainder of the Nth segment based on the last two bits of the MAC addresses of the terminal devices where the other browsers are located, and splices M' based on the order of the MAC addresses of the terminal devices where the other browsers are located to acquire a third string; It is determined whether the second character and the third character are consistent, and if so, the verification is successful; if not, the verification fails; The method further comprises: If the browser cannot acquire characters of all N segments within a preset time, the browser sends a password acquisition request to a server, acquires characters corresponding to the identifier of the username from the server, and takes the acquired characters as the second characters; wherein when the user registers, the browser sends the username to the server, and the server generates a globally unique identifier for the username.

2. The method of claim 1, wherein, The method further comprises: When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username, and returns to the browser; The browser generates a first string based on the password according to a preset algorithm, sends the first string to the server, and divides the first string into N segments to acquire N string segments; The browser sends the N string segments to different other browsers for saving, so that for any other browser receiving any string segment, M is taken by taking the remainder of the any string segment based on the last two bits of the MAC address of the terminal device where the any other browser is located, and the unique identifier of the browser and M are saved.

3. The method of claim 2, wherein, The method further comprises: When the user registers, the security level of the new username is set to the lowest level.

4. The method of claim 3, wherein, The method further comprises: When the user is in a login state, a security level improvement request is sent to a server, so that an administrator judges whether the user meets the requirements based on application information carried in the security level improvement request, and when the user meets the requirements, the security level of the user is improved.

5. The method of claim 3, wherein, The method further comprises: According to the security level corresponding to the username, a recording rule of the behavior of using the browser under the username is configured, and when the recorded behavior of the username meets the downgrade condition corresponding to the username, the security level corresponding to the username is downgraded.

6. A browser distributed verification processing system, characterized by, The system comprises: A login state judgment unit is configured to judge whether the user is in a login state when the user accesses a webpage through a browser; An access judgment unit is configured to start a pre-set access whitelist when it is determined that the user is not in a login state, and prompt the user to log in using a username and a password when the network target accessed by the user is not in the access whitelist; A distributed verification unit is configured to receive the username and the password input by the user based on the password when the user directly logs in as a registered user; A login unit is configured to successfully log in when the distributed verification is successful, and allow the user to access the network target; The distributed verification unit based on the password comprises: The browser generates a first string according to a preset algorithm based on the password; The browser acquires a unique identifier corresponding to the username input by the user, and sends password request information to other browsers based on the unique identifier to acquire M saved by other browsers and the MAC address of the terminal device where other browsers are located, and splice M based on the order of the MAC address of the terminal device where other browsers are located to acquire a second string; The browser divides the first string into N segments, acquires N string segments, takes the remainder of the Nth segment based on the last two bits of the MAC address of the terminal device where other browsers are located to obtain M', and splices M' based on the order of the MAC address of the terminal device where other browsers are located to acquire a third string; It is judged whether the second character and the third character are consistent, if yes, the verification is successful; if not, the verification fails; The distributed verification unit further comprises: If the browser cannot acquire all the characters of the N segments within a preset time, the browser sends a password acquisition request to the server, acquires the characters corresponding to the identifier of the username from the server, and takes the acquired characters as the second characters; when the user registers, the browser sends the username to the server, and the server generates a globally unique identifier for the username.

7. The system of claim 6, wherein, The system further comprises a registration unit configured to: When the user is a non-registered user, the browser sends a new username to the server, so that the server generates a globally unique identifier for the new username, and returns the identifier to the browser. The browser generates a first string according to a preset algorithm based on the password, sends the first string to the server, divides the first string into N segments, and acquires N string segments; The browser sends the N string segments to different other browsers for storage, so that for any other browser receiving any string segment, M is obtained by taking the remainder of the last two digits of the MAC address of the terminal device where the any other browser is located, and the unique identifier of the browser and M are stored.

8. The system of claim 7, wherein, The registration unit is further configured to: When a user registers, set the security level of a new username to the lowest level.

9. The system of claim 8, wherein, The system further comprises a security level adjustment unit configured to: When the user is in a login state, send a security level improvement request to the server, so that the administrator judges whether the application information carried in the security level improvement request meets the requirements, and when the requirements are met, the security level of the user is improved.

10. The system of claim 8, wherein, The system further comprises: A configuration unit configured to configure a record rule of a behavior of using the browser under the username according to the security level corresponding to the username; A security level adjustment unit configured to downgrade the security level corresponding to the username when the recorded behavior of the username meets the downgrade condition corresponding to the username.

Images