Method and system for preventing phishing in unified login system

Abstract

The invention relates to the technical field of computer communication, in particular to a phishing prevention method and system for a unified login system, and the method comprises the following steps: 1, when a subsystem of a company detects that a user does not log in, automatically skipping to an address of the unified login system, and attaching a return address parameter, the return address parameter points to a login success address of the subsystem of the company; 2, after the user successfully logs in the unified login system, the unified login system sets a login cookie under a first-level domain name; then, the unified login system extracts a domain name A from the return address parameter, reads a corresponding value from Redis by taking the domain name A as a key, and indicates that the domain name is unauthorized if the value does not exist; according to the invention, by introducing a dynamic verification mechanism and an intelligent jump strategy, the access of the new subsystem becomes simpler, more convenient and faster, the tamper-proof capability of the system is enhanced, and the security and flexibility of the unified login system are significantly improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer communication, and in particular to a method and system for preventing phishing in a unified login system. Background Art

[0002] In order to achieve unified login, many companies have established a unified login system to simplify the authentication process when users access multiple subsystems. However, this mechanism has also exposed some security risks in actual applications, especially criminals use the jump mechanism after successful login to induce users to jump to illegal websites for phishing attacks. In order to solve this problem, the original technical solution adopted a fixed jump method, that is, the jump target after successful login is determined by preset fixed parameters, for example, if the parameter is X, it will jump to domain name X, and if the parameter is Y, it will jump to domain name Y. Although this method effectively prevents phishing attacks, it also brings inconvenience in maintenance. Whenever a new subsystem is connected, the unified login system needs to update the fixed parameter list and add corresponding judgment and jump logic, resulting in a large increase in system maintenance workload and reduced flexibility. Therefore, a more flexible and secure solution is needed to adapt to changing business needs while ensuring user safety. Summary of the invention

[0003] In order to solve the above technical problems, the present invention provides a method and system for preventing phishing in a unified login system. By introducing a dynamic verification mechanism and an intelligent jump strategy, the access to new subsystems becomes easier and faster, the system's anti-tampering capability is enhanced, and the security and flexibility of the unified login system are significantly improved.

[0004] The present invention is implemented by the following technical solutions:

[0005] A method and system for preventing phishing in a unified login system, the method comprising the following steps:

[0006] Step 1: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem;

[0007] Step 2: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter and reads the corresponding value from Redis using domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized;

[0008] Step 3: The unified login system uses domain name A to concatenate the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned;

[0009] Step 4: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned;

[0010] Step 5: When all verifications are passed, the unified login system will store the domain name A as the key and M as the value in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

[0011] Preferably, step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will attempt to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system, and the return address parameter points to the successful login address of the company's subsystem.

[0012] Preferably, step 2 is further specified as follows: the user jumps to the login page of the unified login system, enters the account number and password and logs in successfully, and the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter; then, using domain name A as the key, reads the corresponding value from Redis. If the value does not exist, it means that the domain name is not authorized.

[0013] Preferably, in step 4, the digest string c is obtained in the following manner:

[0014] The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

[0015] A unified login system to prevent phishing, the system comprising a detection module, an extraction module, a splicing module, a checking module and a jump module;

[0016] Detection module: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem;

[0017] Extraction module: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter and reads the corresponding value from Redis with domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized;

[0018] Splicing module: The unified login system uses domain name A to splice the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned;

[0019] Check module: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned;

[0020] Jump module: When all verifications are passed, the unified login system will use domain name A as the key and M as the value, store it in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

[0021] Preferably, step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will attempt to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system, and the return address parameter points to the successful login address of the company's subsystem.

[0022] Preferably, step 2 is further specified as follows: the user jumps to the login page of the unified login system, enters the account number and password and logs in successfully, and the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter; then, using domain name A as the key, reads the corresponding value from Redis. If the value does not exist, it means that the domain name is not authorized.

[0023] Preferably, in step 4, the digest string c is obtained in the following manner:

[0024] The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

[0025] Beneficial effects of the present invention:

[0026] The present invention provides a method and system for preventing phishing in a unified login system. By introducing a dynamic verification mechanism and an intelligent jump strategy, the access of a new subsystem becomes simpler and faster, the anti-tampering capability of the system is enhanced, and the security and flexibility of the unified login system are significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic flow chart of the method of the present invention.

[0028] Figure 2 It is a system principle block diagram of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described below in conjunction with the accompanying drawings.

[0030] like Figure 1 The present invention provides a method for preventing phishing in a unified login system. 1. The method comprises the following steps:

[0031] Step 1: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem;

[0032] Step 2: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter and reads the corresponding value from Redis using domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized;

[0033] Step 3: The unified login system uses domain name A to concatenate the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned;

[0034] Step 4: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned;

[0035] Step 5: When all verifications are passed, the unified login system will store the domain name A as the key and M as the value in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

[0036] The step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will try to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system. The return address parameter points to the successful login address of the company's subsystem; in this way, it is ensured that the user can smoothly return to the subsystem after a successful login and complete subsequent operations.

[0037] The step 2 is further specified as follows: after the user jumps to the login page of the unified login system and successfully logs in by entering the account and password, the unified login system will set a login cookie under the first-level domain name to ensure that other subsystems with the same first-level domain name can obtain the login cookie; then, the unified login system extracts the domain name A from the return address parameter, and then, using the domain name A as the key, reads the corresponding value from Redis, that is, reads the value stored in key=A in Redis; if the value does not exist, it means that the domain name is not authorized.

[0038] In step 4, the digest string c is obtained in the following manner:

[0039] The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

[0040] The present invention will be further described below in conjunction with a specific embodiment:

[0041] A method and system for preventing phishing in a unified login system, the method comprising the following steps:

[0042] Step 1: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem;

[0043] When a user accesses the company's subsystem, the company's subsystem will try to obtain the unified login cookie; if it detects that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system and attach a return address parameter to the address of the unified login system. The return address parameter points to the successful login address of the company's subsystem; in this way, it is ensured that the user can smoothly return to the subsystem after a successful login and complete subsequent operations.

[0044] Example: When the subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system, with a return address parameter that points to the subsystem's successful login address.

[0045] Assume that the domain name of the subsystem is `aaa.xxx.com`. When the user accesses the subsystem, the subsystem will try to obtain the unified login cookie. If it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the subsystem will automatically jump to the unified login system `login.xxx.com`, and attach a return address parameter in the jump address to point to the subsystem's successful login address. The complete jump address is `https: / / login.xxx.com? back=https: / / aaa.xxx.com / success`. In this way, it is ensured that the user can smoothly return to the subsystem after a successful login and complete subsequent operations.

[0046] Step 2: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter and reads the corresponding value from Redis using domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized;

[0047] The user jumps to the login page of the unified login system. After successfully logging in by entering the account and password, the unified login system will set a login cookie under the first-level domain name to ensure that other subsystems with the same first-level domain name can obtain the login cookie; then, the unified login system extracts domain name A from the return address parameter, and then uses domain name A as the key to read the corresponding value from Redis, that is, read the value stored in key = A in Redis; if the value does not exist, it means that the domain name is not authorized.

[0048] For example, after a user successfully logs in to the unified login system, the system will set a login cookie under the first-level domain name. Subsequently, the unified login system extracts domain name A from the return address parameter and reads data from Redis using domain name A as the key. If no value exists, it indicates that the domain name is not authorized.

[0049] The user jumps to the login page, enters the account and password, and logs in successfully. The system will set a login cookie under the first-level domain name `.xxx.com` to ensure that other subsystems with the same first-level domain name can obtain the login cookie. Then, the system obtains `https: / / aaa.xxx.com / success` from the `back` parameter, and resolves the subsystem domain name `A = https: / / aaa.xxx.com`. Then, using domain name A as the key, read data from Redis. If the corresponding value is not found, it means that the domain name is not authorized.

[0050] Step 3: The unified login system uses domain name A to concatenate the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned;

[0051] For example, the system uses domain name A to concatenate a fixed authorization verification interface address, initiates a request and obtains the return value, and deserializes it into an object, that is, deserializes the JSON string into an object. If the code field in the returned object is not equal to success, a failure message is returned.

[0052] The system uses the domain name A = `https: / / aaa.xxx.com` to concatenate the fixed authorization verification interface address ` / back / check` to obtain the complete interface address `https: / / aaa.xxx.com / back / check`. The system initiates a request to the complete interface address, obtains the return value and executes the code json.Unmarshal() to deserialize into an object to obtain {"code":"success","timestamp":1731591796,"sign":"5b45646e9a35d3e0b77d6e87f462fed4"}. If the `code` field in the object is not equal to `success`, it means that the subdomain is illegal and the system will return a failure message.

[0053] Step 4: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned;

[0054] The digest string c is obtained by:

[0055] The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

[0056] For example, if the code field is verified, the system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is beyond this range, a failure message will be returned. Otherwise, the system will read the sign field and perform MD5 hash calculation with the pre-agreed key of the domain name to generate a summary string c. If the calculated c does not match the sign field value, a failure message will also be returned.

[0057] If the `code` field is verified, the system will continue to read the `timestamp` field to obtain `1731591796`, and check whether the timestamp is within 10 minutes of the current time. If the timestamp is outside this range, the system will return a failure message. Otherwise, the system will concatenate `abcd` according to the key agreed with the subsystem to obtain `1731591796abcd`, and then perform MD5 hash calculation to generate a summary string `c=5b45646e9a35d3e0b77d6e87f462fed4`. The system reads the `sign` field, and if `c` and `sign` do not match, a failure message is returned.

[0058] Step 5: When all verifications are passed, the unified login system will store the domain name A as the key and M as the value in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

[0059] For example: when all verifications are passed, the system will use domain name A as the key and 1 as the value (the purpose of setting 1 here is to determine that this key = A has a value, and the specific number is not affected), store it in Redis, and set the expiration time to 1 day. After that, the system will jump to the address parameter of the return subsystem provided initially. After receiving the request, the login success address of the subsystem will read and verify the login status in the cookie, thereby completing the user's login process.

[0060] When all verifications are passed, the system will store the domain name A = `https: / / aaa.xxx.com` as the key and 1 as the value in Redis, and set an expiration time of 1 day. In this way, the domain name will be regarded as an authorized secure domain name within 1 day. Then, the system will jump to the address pointed to by the initial `back` parameter, that is, jump to the login success address of the subsystem. After receiving the request, the login success address of the subsystem will read and verify the login status in the cookie, thereby completing the user's login process.

[0061] like Figure 2 ,The present invention also provides a unified login system to prevent phishing, the system includes a detection module, an extraction module, a splicing module, a checking module and a jump module;

[0062] Detection module: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem;

[0063] Extraction module: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter and reads the corresponding value from Redis with domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized;

[0064] Splicing module: The unified login system uses domain name A to splice the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned;

[0065] Check module: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned;

[0066] Jump module: When all verifications are passed, the unified login system will use domain name A as the key and M as the value, store it in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

[0067] The step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will try to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system, and the return address parameter points to the successful login address of the company's subsystem.

[0068] The step 2 is further specified as follows: the user jumps to the login page of the unified login system, enters the account number and password and logs in successfully, and the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter; then, using domain name A as the key, reads the corresponding value from Redis. If the value does not exist, it means that the domain name is not authorized.

[0069] In step 4, the digest string c is obtained in the following manner:

[0070] The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

[0071] In summary, the present invention can make the access of new subsystems easier and faster by introducing dynamic verification mechanisms and intelligent jump strategies, enhance the system's anti-tampering capabilities, and significantly improve the security and flexibility of the unified login system.

[0072] The above description is only a preferred embodiment of the present invention and should not be construed as limiting the present application. All equivalent changes and modifications made within the scope of the patent application of the present invention should fall within the scope of the present invention.

Claims

1. A method for preventing phishing in a unified login system, characterized in that: The method comprises the following steps, Step 1: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem; Step 2: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; Subsequently, the unified login system extracts domain name A from the returned address parameter and reads the corresponding value from Redis using domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized. Step 3: The unified login system uses domain name A to concatenate the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned; Step 4: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned; Step 5: When all verifications are passed, the unified login system will store the domain name A as the key and M as the value in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

2. A method for preventing phishing in a unified login system according to claim 1, characterized in that: The step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will try to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system, and the return address parameter points to the successful login address of the company's subsystem.

3. A method for preventing phishing in a unified login system according to claim 1, characterized in that: The step 2 is further specified as follows: the user jumps to the login page of the unified login system, enters the account number and password and logs in successfully, and the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter; then, using domain name A as the key, reads the corresponding value from Redis. If the value does not exist, it means that the domain name is not authorized.

4. A method for preventing phishing in a unified login system according to claim 1, characterized in that: In step 4, the digest string c is obtained in the following manner: The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

5. A unified login system to prevent phishing, characterized in that: The system includes a detection module, an extraction module, a splicing module, a checking module and a jump module; Detection module: When the company's subsystem detects that the user is not logged in, it will automatically jump to the address of the unified login system with a return address parameter, which points to the successful login address of the company's subsystem; Extraction module: After the user successfully logs in to the unified login system, the unified login system will set a login cookie under the first-level domain name; Subsequently, the unified login system extracts domain name A from the returned address parameter and reads the corresponding value from Redis using domain name A as the key. If the value does not exist, it indicates that the domain name is not authorized. Splicing module: The unified login system uses domain name A to splice the fixed authorization verification interface address to obtain the complete authorization verification interface address, and initiates a request to the complete authorization verification interface address to obtain the return value and deserialize it into an object; if the code field in the object is not equal to success, a failure message is returned; Check module: If the code field is verified, the unified login system will continue to read the timestamp field to check whether the timestamp is within 10 minutes of the current time. If it is out of this range, a failure message will be returned; otherwise, the unified login system will read the sign field and match it with the summary string c. If it does not match, a failure message will be returned; Jump module: When all verifications are passed, the unified login system will use domain name A as the key and M as the value, store it in Redis, and set the expiration time to N days; after that, the unified login system will jump to the return address parameter; after the company's subsystem login success address receives the request, it will read and verify the login status in the cookie, thereby completing the user's login process.

6. A unified login system to prevent phishing according to claim 5, characterized in that: The step 1 is further specified as follows: when a user accesses the company's subsystem, the company's subsystem will try to obtain the unified login cookie; if it is detected that the cookie does not exist, it is determined that the user is not logged in. At this time, the company's subsystem will automatically jump to the address of the unified login system, and attach a return address parameter to the address of the unified login system, and the return address parameter points to the successful login address of the company's subsystem.

7. A unified login system to prevent phishing according to claim 5, characterized in that: The step 2 is further specified as follows: the user jumps to the login page of the unified login system, enters the account number and password and logs in successfully, and the unified login system will set a login cookie under the first-level domain name; then, the unified login system extracts domain name A from the return address parameter; then, using domain name A as the key, reads the corresponding value from Redis. If the value does not exist, it means that the domain name is not authorized.

8. A unified login system to prevent phishing according to claim 5, characterized in that: In step 4, the digest string c is obtained in the following manner: The unified login system and the company's subsystem have an agreed key. The timestamp is concatenated with the agreed key, and then an MD5 hash calculation is performed to generate a digest string c. If the calculated c does not match the sign field value, a failure message is returned.

Images