A dynamic login security control method and device

Abstract

The application relates to the technical field of computer network security, and particularly provides a dynamic login security control method and device, which is based on a double-system cooperative mechanism, and the double systems are an intranet deployment and an internet deployment; the intranet deployment uses an RSA public key to encrypt a current timestamp to generate a loginCode; a jump link / jump / {loginCode} is generated based on an environment configuration of the internet deployment and is returned to a user; the loginCode in the URL is parsed in the internet deployment, an original timestamp is obtained by using an RSA private key for decryption, and whether a difference between the timestamp and a current time is within a preset threshold value is checked; if the check is passed, a username and password login page is rendered; and if the check fails, a 404 error page is returned. Compared with the prior art, the application can effectively resist malicious scanning, replay attacks and brute force cracking, and can balance operation and maintenance safety and operation convenience.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network security, and specifically provides a dynamic login security control method and device. BACKGROUND

[0002] In a traditional Internet system, an operation and maintenance personnel usually performs identity verification through a fixed login page (such as / login), but such a page is directly exposed in an Internet environment, which has a high security risk, for example:

[0003] (1) Malicious attack risk: an attacker can attempt to invade the system through brute force cracking, password collision, etc.

[0004] (2) Path exposure risk: the fixed login path is easy to be detected by a scanning tool, which increases the possibility of being attacked in a targeted manner;

[0005] (3) Single-point protection deficiency: only relying on username and password authentication, lacking a dynamic verification mechanism, and difficult to resist advanced persistent threats (APTs).

[0006] In the prior art, some solutions use IP white lists or VPNs to limit access permissions, but have the following defects:

[0007] (1) Limited operation and maintenance flexibility, which cannot adapt to the operation and maintenance requirements of multiple locations and multiple networks;

[0008] (2) High maintenance cost of white lists, and difficult to cope with internal network penetration attacks;

[0009] (3) Static protection mechanism cannot dynamically respond to time-sensitive security requirements.

[0010] Therefore, there is an urgent need for a login control method combining dynamic encryption verification and path hiding to ensure operation and maintenance convenience while improving system security. SUMMARY

[0011] The present application is aimed at the deficiencies of the prior art, and provides a dynamic login security control method with strong practicability.

[0012] The further technical task of the present application is to provide a dynamic login security control device with reasonable design and safety.

[0013] The technical solution adopted by the present application to solve the technical problems is:

[0014] A dynamic login security control method based on a dual-system cooperation mechanism, wherein the dual-systems are an internal network deployment and an Internet deployment.

[0015] The clock synchronization module in the intranet deployment keeps time synchronization with the Internet deployment, the dynamic credential generation module provides an applyLoginCode interface, receives an operation and maintenance personnel login request, encrypts a current timestamp using an RSA public key, generates a loginCode, and generates a jump link / jump / {loginCode} based on the environment configuration of the Internet deployment and returns the link to the user.

[0016] In the Internet deployment, the route is dynamically modified, the static / login path in the Vue2 front-end route is removed, and a dynamic route / jump / :loginCode is added to receive an encrypted login credential. The credential verification module parses the loginCode in the URL, decrypts the original timestamp using the RSA private key, checks whether the difference between the timestamp and the current time is within a preset threshold, and if the check passes, renders a username and password login page; if the check fails, returns a 404 error page.

[0017] Further, the RSA key management includes key generation and storage, key life cycle management, and access control and auditing.

[0018] In the key generation and storage, a 2048-bit and RSA algorithm is used to generate a public and private key pair, the key length supports dynamic upgrade, the private key of the Internet deployment is stored in an encrypted hardware module or a key management service, and clear text persistent storage is prohibited; private key calling needs to pass double authentication and is limited to the decryption module of the Internet deployment;

[0019] The public key of the intranet deployment is pre-configured through a secure channel and is periodically rotated.

[0020] Further, in the key life cycle management, when the public key is rotated, the intranet generates a new key pair, and the old public key is retained until all associated loginCodes expire; private key rotation requires Internet deployment downtime;

[0021] If the private key is leaked, the Internet deployment immediately enables a backup key pair and discards the original private key, and the intranet deployment synchronously updates the public key.

[0022] Further, in the access control and auditing, private key operation logs are recorded in real time, including decryption time, request IP, and decryption result, and are synchronized to a security audit platform. The intranet deployment sets a rate limit on the public key calling interface.

[0023] Further, the Internet deployment and the intranet deployment synchronize with the same authoritative time server through the NTP protocol. If the intranet deployment cannot connect to the time server, it refuses to generate a loginCode and issues an alarm. If the Internet deployment fails to synchronize, it still decrypts using the local clock, and the decryption time is set to 1-3 minutes.

[0024] Further, in the timestamp processing, the timestamp precision is second level, the internal network deployment is automatically rounded to whole second when generating, the clock drift of the decrypted timestamp and the current time of the Internet deployment is allowed to be ±5 seconds, the actual effective window is [T-5 seconds, T+55 seconds], and the total time length is still limited to 1 minute.

[0025] The Internet deployment checks the clock deviation from the internal network deployment every minute, if the deviation is greater than 1 second for 3 times in succession, a high-risk alarm is triggered and the login verification is suspended;

[0026] The operation and maintenance personnel manually calibrate the clock through the management interface of the internal network deployment or switch to a backup time server.

[0027] Further, in the dynamic routing, the Internet deployment sets the access frequency limit of the / jump / :loginCode route, temporarily bans the IP if the access frequency limit is exceeded, injects a one-time CSRF token when the login form is rendered on the front-end page, and prevents cross-site forgery requests.

[0028] Further, the internal network deployment records the loginCode generation log, the Internet deployment records the decryption verification log, the log files are stored in an encrypted manner, the retention period is greater than or equal to 180 days, and the generation link can be reversely searched through the loginCode.

[0029] A dynamic login security control device comprises at least one memory and at least one processor.

[0030] The at least one memory is used for storing a machine-readable program.

[0031] The at least one processor is used for calling the machine-readable program and executing a dynamic login security control method.

[0032] Compared with the prior art, the dynamic login security control method and device have the following outstanding beneficial effects:

[0033] (1) Anti-malicious scanning and brute force cracking:

[0034] By deleting the static login path (such as / login) of the Internet system, the risk that an attacker locates the login entrance through path scanning is completely eliminated;

[0035] The dynamically generated loginCode is unique and time-limited (such as valid for 1 minute), so that even if it is intercepted, it cannot be reused, and the replay attack is effectively prevented.

[0036] (2) Security boundary reinforcement:

[0037] Intranet deployment is only deployed in intranet, and / applyLoginCode interface is not exposed to the Internet, which isolates the key encryption logic from the physical layer;

[0038] RSA public and private key separation storage avoids system security collapse caused by key leakage.

[0039] (3) Legal operation personnel can quickly generate dynamic links through intranet deployment, without additional hardware or complex operations, balancing safety and efficiency;

[0040] The timestamp verification mechanism allows multiple attempts within a short time window, avoiding false interception due to clock errors.

[0041] (4) System compatibility and scalability:

[0042] Support seamless integration with existing SpringBoot, Vue2 systems, with low transformation cost; time difference threshold, key length and other parameters can be dynamically configured to adapt to different security level scenarios.

[0043] (5) Enhanced attack tracing capability:

[0044] Decrypt failed requests for illegal loginCode are automatically logged, providing data support for subsequent security analysis;

[0045] Combined with the timestamp, the attack time window can be accurately located to assist in tracing and evidence collection. DETAILED DESCRIPTION

[0046] In order to make the person skilled in the art better understand the scheme of the present application, the present application will be further described in detail below in combination with specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0047] A best embodiment is given below:

[0048] A dynamic login security control method in this embodiment is based on a dual-system cooperative mechanism, which includes intranet deployment and Internet deployment;

[0049] The clock synchronization module in intranet deployment maintains time synchronization with Internet deployment, with an error controlled within milliseconds;

[0050] The dynamic credential generation module provides the / applyLoginCode interface, which receives login requests from operations and maintenance personnel, encrypts the current timestamp (format: yyyyMMddHHmmss) using the RSA public key in RSA key management, and generates a loginCode; based on the environment configuration deployed on the Internet, it generates a redirect link / jump / {loginCode} and returns it to the user.

[0051] In internet deployment, dynamic routing is implemented by removing the static / login path from the Vue2 frontend route and adding a dynamic route / jump / :loginCode to receive encrypted login credentials. The credential verification module parses the loginCode in the URL, decrypts it using an RSA private key to obtain the original timestamp, and verifies whether the difference between the timestamp and the current time is within a preset threshold (e.g., 1 minute).

[0052] If the verification passes, the username and password login page will be rendered; if it fails, a 404 error page will be returned.

[0053] The RSA key management strategies include:

[0054] (1) Key generation and storage;

[0055] Public and private key pairs are generated using 2048 bits and the RSA algorithm, and the key length supports dynamic upgrades (such as switching to 3072 bits to meet future security needs).

[0056] Private keys deployed on the Internet are stored in a hardware encryption module (HSM) or a key management service (KMS). Plaintext persistent storage is prohibited. Private key access requires two authentications (such as API token + IP whitelist) and is only accessible to the decryption module of system B.

[0057] The public key deployed on the intranet is pre-configured through a secure channel (such as intranet HTTPS) and rotated periodically (such as updated every 90 days).

[0058] (2) Key lifecycle management;

[0059] When the public key is rotated, a new key pair is generated on the internal network, and the old public key is retained until all associated loginCodes expire (e.g., it becomes invalid after 1 minute).

[0060] Private key rotation requires internet-based deployment and downtime maintenance to ensure a seamless transition between old and new keys;

[0061] If the private key is leaked, the internet deployment will immediately activate the backup key pair and discard the original private key, while the internal network deployment will synchronously update the public key.

[0062] (3) Access control and auditing;

[0063] Private key operation log records in real time, including decryption time, request IP, decryption result, and synchronization to the security audit platform.

[0064] The public key calling interface of the intranet deployment is set to have a rate limit (e.g., 10 times per minute) to prevent malicious batch generation of loginCode.

[0065] The internet deployment and the intranet deployment are synchronized with the same authoritative time server (e.g., the national time service center) through the NTP protocol, ensuring that the clock error is ≤ 50 milliseconds.

[0066] If the intranet deployment cannot connect to the time server, it will refuse to generate loginCode and issue an alarm. If the synchronization fails in the internet deployment, it will still decrypt using the local clock, and the decryption time is set to 2 minutes (which needs to be manually confirmed by the operation and maintenance personnel).

[0067] The timestamp processing logic is as follows:

[0068] The timestamp precision is second-level (format yyyyMMddHHmmss), and the intranet deployment automatically rounds to the nearest second when generating;

[0069] The decrypted timestamp and the current time of the internet deployment can have a clock drift of ±5 seconds;

[0070] The actual effective window is [T-5 seconds, T+55 seconds], and the total duration is still limited to 1 minute.

[0071] The internet deployment checks the clock deviation from the intranet deployment every minute. If the deviation is > 1 second for 3 consecutive times, a high-risk alarm is triggered and login verification is suspended;

[0072] The operation and maintenance personnel can manually calibrate the clock through the management interface of the intranet deployment or switch to the backup time server.

[0073] For dynamic route security reinforcement:

[0074] The / jump / :loginCode route of the internet deployment is set to have an access frequency limit (e.g., 3 times per minute), and the IP is temporarily banned if it exceeds the limit;

[0075] When the front-end page renders the login form, a one-time CSRF token is injected to prevent cross-site forgery requests.

[0076] The intranet deployment records loginCode generation logs (including timestamp, generator IP), and the internet deployment records decryption verification logs (including decryption result, request IP); log files are stored in encrypted form, with a retention period of ≥ 180 days, and support for reverse lookup of generation links through loginCode.

[0077] Support multiple groups of RSA key pairs coexist, through loginCode version number to identify encryption algorithm (such as v1 represents RSA-2048, v2 represents RSA-3072); Time difference threshold can be dynamically configured through the Internet deployment environment variable (such as LOGIN_CODE_TTL=60), without re-deploying the code.

[0078] Based on the above method, the dynamic login security control device in the embodiment comprises at least one memory and at least one processor;

[0079] The at least one memory is used for storing machine readable programs;

[0080] The at least one processor is used for calling the machine readable programs and executing a dynamic login security control method.

[0081] The above specific embodiments are only specific cases of the present application, and the patent protection scope of the present application includes but is not limited to the above specific embodiments. Any technical solution meeting the above specific embodiments of the present application and any appropriate changes or replacements made by ordinary technical personnel in the art shall fall within the patent protection scope of the present application.

[0082] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A dynamic login security control method, characterized in that, Based on the dual-system collaborative mechanism, the dual systems are deployed on the intranet and on the Internet; In the intranet deployment, the clock synchronization module keeps time synchronized with the internet deployment. The dynamic credential generation module provides the / applyLoginCode interface to receive login requests from operations and maintenance personnel, encrypts the current timestamp using the public key in RSA key management, generates loginCode, generates a redirect link / jump / {loginCode} based on the environment configuration of the internet deployment, and returns it to the operations and maintenance personnel. In the internet deployment, the routing was dynamically modified by removing the static / login path from the Vue2 front-end route and adding a dynamic route / jump / :loginCode to receive encrypted login credentials. The credential verification module parses the loginCode in the URL, decrypts it using an RSA private key to obtain the original timestamp, and verifies whether the difference between the timestamp and the current time is within a preset threshold. If the verification passes, the username and password login page is rendered. If it fails, a 404 error page will be returned.

2. The dynamic login security control method according to claim 1, characterized in that, The RSA key management includes key generation and storage, key lifecycle management and access control and auditing; In the key generation and storage process, a 2048-bit RSA algorithm is used to generate public and private key pairs. The key length supports dynamic upgrades. Private keys deployed on the Internet are stored in encryption hardware modules or key management services, and plaintext persistent storage is prohibited. Private key access requires dual authentication and is limited to decryption modules deployed on the Internet. The public key deployed on the internal network is pre-configured through a secure channel and rotated periodically.

3. The dynamic login security control method according to claim 2, characterized in that, In the key lifecycle management, when the public key is rotated, a new key pair is generated on the intranet and the old public key is retained until all associated loginCodes expire. The private key rotation requires internet deployment and downtime maintenance. If the private key is leaked, the internet deployment will immediately activate the backup key pair and discard the original private key, while the internal network deployment will synchronously update the public key.

4. The dynamic login security control method according to claim 3, characterized in that, In the access control and auditing process, private key operation logs are recorded in real time, including decryption time, request IP, and decryption result, and synchronized to the security auditing platform. In the intranet deployment, rate limits are set for public key call interfaces.

5. The dynamic login security control method according to claim 4, characterized in that, Internet deployment and intranet deployment synchronize with the same authoritative time server via the NTP protocol. If the intranet deployment cannot connect to the time server, it will refuse to generate loginCode and issue an alarm. If internet deployment synchronization fails, decryption will still be performed using the local clock, with the decryption time set to 1-3 minutes.

6. The dynamic login security control method according to claim 5, characterized in that, In the timestamp processing, the timestamp precision is at the second level. When generated during intranet deployment, it is automatically rounded to the whole second. A clock drift of ±5 seconds between the decrypted timestamp and the current time of internet deployment is allowed. The actual effective window is [T-5 seconds, T+55 seconds], and the total duration is still limited to 1 minute. The internet deployment checks the clock deviation from the intranet deployment every minute. If a deviation greater than 1 second is detected three times in a row, a high-risk alarm is triggered and login verification is suspended. Maintenance personnel can manually calibrate the clock through the management interface deployed on the intranet, or switch to a backup time server.

7. The dynamic login security control method according to claim 6, characterized in that, The dynamic routing is security-enhanced by setting access frequency limits for the / jump / :loginCode route deployed on the Internet. If the access frequency is exceeded, the IP will be temporarily blocked. When the front-end page renders the login form, a one-time CSRF token is injected to prevent cross-site request forgery.

8. The dynamic login security control method according to claim 7, characterized in that, The intranet deployment records loginCode generation logs, and the internet deployment records decryption verification logs. The log files are encrypted and stored, with a retention period of ≥180 days. It supports reverse lookup of the generated link through loginCode.

9. A dynamic login security control device, characterized in that, include: At least one memory and at least one processor; The at least one memory is used to store a machine-readable program; The at least one processor is configured to invoke the machine-readable program to perform the method according to any one of claims 1 to 8.