Two-section login method and system

Abstract

The embodiment of the invention provides a two-section type login method and system. The method comprises the following steps: firstly, receiving an encrypted random number acquisition request which is sent by a user side and comprises an account name, a user side public key and a timestamp through a server side, immediately acquiring a source random number of a corresponding account from a user center, and encrypting the source random number by using the user side public key to generate an encrypted random number; and dynamically acquiring a server-side public key with timeliness from the key center, returning the server-side public key to the user side, and when an external login request is received, generating a unique login identifier based on the server-side private key, the encrypted ciphertext and the timestamp, and storing the unique login identifier to process login authentication. In the service request stage, the legality of the request and the data integrity are ensured through the verification identifier, the timestamp and the message entity MD5 calculation value. Through the processing process, on the premise that an original system permission system is not changed, repeated input of the login certificate is avoided, a safe and efficient login solution is provided for small applications, and therefore the safety of the system is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a two-stage login method and system. Background Art

[0002] With the increasing complexity of modern network applications and the surge in enterprise system integration needs, user login mechanisms have become a core link in ensuring system security and user data privacy.

[0003] Currently, the traditional login mechanism is a single-stage login mechanism. When dealing with cross-domain integration or multi-system collaboration scenarios, it often requires users to repeatedly enter login credentials when accessing different systems.

[0004] However, the traditional login mechanism requires repeated entry of login credentials when accessing different systems, which not only reduces the user experience but also increases the risk of information leakage, resulting in lower system security. Summary of the Invention

[0005] The embodiment of the present invention provides a two-stage login method and system, which can improve system security.

[0006] In a first aspect, an embodiment of the present invention provides a two-stage login method, the method comprising: A1: receiving an encrypted random number acquisition request from a user terminal, wherein the encrypted random number acquisition request includes: an account name, a user terminal public key, and a timestamp;

[0007] A2: Obtain a source random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server-side public key obtained from the key center to the user;

[0008] A3: Upon receiving a login request from an external party including the account name, encrypted ciphertext, and timestamp, generating a login ID based on the server-side private key and the encrypted ciphertext and storing the generated ID in a login ID management service, wherein the server-side private key and the server-side public key are in a one-to-one correspondence;

[0009] A4: When receiving a service request from an external party, perform a service authentication operation based on the service request, and verify the identifier, timestamp, message entity MD5 calculation value, and authorization signature in the service request header field.

[0010] Preferably,

[0011] After A1 and before A2, further comprising:

[0012] Performing a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

[0013] Preferably,

[0014] The A3 includes:

[0015] D1: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5;

[0016] D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext;

[0017] D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm;

[0018] D4: When the first user-end ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication;

[0019] D5: Reject the random number acquisition request from the user terminal.

[0020] Preferably,

[0021] Before D4 and after D5, further comprising:

[0022] When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext;

[0023] Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm;

[0024] When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

[0025] In a second aspect, an embodiment of the present invention provides a two-stage login system, the system comprising: a receiving module configured to receive an encrypted random number acquisition request from a user terminal, wherein the encrypted random number acquisition request includes an account name, a user terminal public key, and a timestamp;

[0026] Acquisition module: used to obtain the source random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server-side public key obtained from the key center to the user;

[0027] Authentication module: upon receiving a login request from an external party including the account name, encrypted ciphertext, and timestamp, generates a login ID based on the server-side private key and the encrypted ciphertext and stores the generated ID in a login ID management service, wherein the server-side private key and the server-side public key are in a one-to-one correspondence;

[0028] Authentication module: When receiving a service request from an external party, it performs a service authentication operation based on the service request and verifies the identifier, timestamp, message entity MD5 calculation value and authorization signature in the service request header field.

[0029] Preferably,

[0030] After the receiving module and before the acquiring module, it further includes: a verification module;

[0031] The verification module is used to perform a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

[0032] Preferably,

[0033] The authentication module is further configured to execute:

[0034] D1: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5;

[0035] D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext;

[0036] D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm;

[0037] D4: When the first user-end ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication;

[0038] D5: Reject the user's request for obtaining the encrypted random number.

[0039] Preferably,

[0040] The authentication module is further configured to execute, before D4 and after D5, the following steps:

[0041] When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext;

[0042] Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm;

[0043] When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

[0044] In a third aspect, an embodiment of the present invention provides a two-stage login system, comprising: at least one memory and at least one processor;

[0045] The at least one memory is configured to store a machine-readable program;

[0046] The at least one processor is configured to call the machine-readable program to execute any one of the methods described in the first aspect.

[0047] In a fourth aspect, an embodiment of the present invention provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor is caused to execute any of the methods described in the first aspect.

[0048] The embodiment of the present invention provides a two-stage login method and system. The method first receives an encrypted random number acquisition request sent by the user end through the server end, which includes an account name, a user end public key and a timestamp. Then, the method obtains the source random number of the corresponding account from the user center, encrypts the source random number using the user end public key to generate an encrypted random number, and dynamically obtains a server end public key with time validity from the key center and returns it to the user end. At the same time, when an external login request is received, a unique login identifier is generated based on the server end private key, encrypted ciphertext and timestamp and stored to process login authentication. In the business request stage, by verifying the identifier and timestamp, and combining the message entity MD5 calculation value anti-tampering verification and authorization signature, a dynamic authentication system including a custom header field is constructed to ensure the legitimacy of the request and the integrity of the data. Through the above processing process, without changing the original system authority system, the cross-domain restriction problem of traditional login in system integration is solved, and repeated input of login credentials is avoided, providing a safe and efficient login solution for small applications, thereby significantly improving the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 This is a flow chart of a two-stage login method provided by one embodiment of the present invention;

[0051] Figure 2 is a flow chart of another two-stage login method provided by one embodiment of the present invention;

[0052] Figure 3 is a schematic diagram of a two-stage login system provided by one embodiment of the present invention;

[0053] Figure 4 2 is a schematic diagram of another two-stage login system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0055] like Figure 1 As shown, an embodiment of the present invention provides a two-stage login method, which may include the following steps:

[0056] Step 101: Receive an encrypted random number acquisition request from a user, wherein the encrypted random number acquisition request includes: account name, user public key and timestamp;

[0057] Step 102: Obtain a source random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server's public key obtained from the key center to the user.

[0058] Step 103: Upon receiving a login request from an external party, including the account name, encrypted ciphertext, and timestamp, a login identifier is generated based on the server-side private key and the encrypted ciphertext, and stored in the login identifier management service. The server-side private key corresponds to the server-side public key in a one-to-one relationship.

[0059] Step 104: When receiving a service request from an external party, perform a service authentication operation based on the service request, and verify the identifier, timestamp, message entity MD5 calculation value, and authorization signature in the service request header field.

[0060] In an embodiment of the present invention, a two-stage login method is provided. The method first receives an encrypted random number acquisition request sent by the user end, which includes an account name, a user end public key, and a timestamp, through the server end, then obtains the encrypted random number of the corresponding account from the user center, encrypts the encrypted random number using the user end public key to generate an encrypted random number, and dynamically obtains a server end public key with a time limit from the key center and returns it to the user end. At the same time, when an external login request is received, a unique login identifier is generated based on the server end private key, the encrypted random number, and the timestamp and stored to process the login authentication. In the business request stage, by verifying the identifier and timestamp, and combining the message entity MD5 calculation value tamper-proof verification and authorization signature, a dynamic authentication system including a custom header field is constructed to ensure the legitimacy of the request and the integrity of the data. Through the above processing process, without changing the original system permission system, the cross-domain restriction problem of traditional login in system integration is solved, and repeated input of login credentials is avoided, providing a safe and efficient login solution for small applications, thereby significantly improving the security of the system.

[0061] To ensure login security, in one embodiment of the present invention, the above embodiment further includes, after step 101 and before step 102:

[0062] Performing a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

[0063] In an embodiment of the present invention, when the server receives a request for obtaining an encrypted random number (e.g., salt) from the user, which includes an account name, a user public key, and a timestamp, it performs the following checks: First, verify the validity of the timestamp; Second, verify the legitimacy of the account name, by interacting with the user center database to confirm whether the account exists, is in an activated state, or is disabled, to avoid login attempts by illegal accounts; Third, verify the validity of the user public key, relying on the dynamic key pool mechanism of the key center to check whether the user public key belongs to the current valid key pair, and ensure the compliance of the public key structure through the format check of the RSA encryption algorithm. If any check item fails, the server will directly reject the request; if all verifications pass, it will continue to obtain the source random number (e.g., srcsalt) of the corresponding account from the user center, and apply for a valid public-private key pair on the server side from the key center, thereby completing the subsequent encryption and return process of the encrypted random number. The above data verification operation ensures login security through multi-layer protection of timestamp timeliness control, account legitimacy verification, and public key validity management.

[0064] Specifically, the key center manages the key lifecycle. Multiple sets of keys are active in the key center's key pool at any given time. When a user application's login service requests a key pair, the key center randomly selects a pair from the current key pool and returns it. During login verification, any key pair in the key pool that can be paired and decrypted is sufficient. Each key pair in the key pool has a time limit; after the time limit expires, it is removed from the key pool and replaced with a new key pair. This key pool mechanism effectively protects against hacker attacks such as hijacking, database manipulation, and brute force attacks.

[0065] To implement the direct login process, in one embodiment of the present invention, step 103 in the above embodiment may specifically include the following steps:

[0066] D1: upon receiving a login request from an external party including the account name, the first encrypted random number, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5;

[0067] D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext;

[0068] D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm;

[0069] D4: When the first user-end ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication;

[0070] D5: Reject the user's request for obtaining the encrypted random number.

[0071] In an embodiment of the present invention, during the login execution phase, when the server receives a login request from an external party, it will first verify the legitimacy, which includes timestamp validity verification, account name legitimacy verification, and request format compliance verification. If the verification is passed, different processing paths will be entered according to the login request type: for direct login requests (e.g., POST), the server uses the server-side private key to decrypt the first encrypted ciphertext (e.g., cryptsalt) and generate the first user-side ciphertext (e.g., ClientPsalt); then, the server obtains the first password hash value (e.g., Hpassword) and the first source random number (e.g., srcsalt, i.e., salt1) corresponding to the account from the user center, and combines the two through an encryption algorithm (e.g., bcrypt) to generate a first calculated ciphertext (e.g., Psalt). The system compares the consistency of the first user-side ciphertext with the first calculated ciphertext. If they match, a first login login identifier (e.g., session) is generated and stored in the login identifier management service to complete the authentication process in the same domain environment. The above process builds a complete security authentication system in the same domain scenario through the irreversible cryptographic mechanism of dynamic key decryption and dual-algorithm dual-factor encryption.

[0072] Specifically, the first password hash value HPassword is generated by encrypting the original password using the SHA512 algorithm, where the encryption random number 1 = the BCrypt random number. Applications within the same business system all belong to the same domain, sharing the same domain name or IP address and port number. Direct login is used for logging into applications within the business system, including but not limited to PC web applications, desktop applications, and mobile applications. It is also suitable for scenarios where third-party applications integrate the application system SDK as a background service. Third-party applications and the system interact only through interfaces, eliminating cross-domain issues.

[0073] For example, the login interface (direct login POST method): http(s): / / domain name / login

[0074] Pass parameters: UserName, Cryptsalt, Timestamp

[0075] The Body in the request example is as follows:

[0076] {"UserName":"test","Crypsalt":"CuLWuT2wccLYbyfbLRphUnA5y6jhWwLIrUMm0lsHxKjbzPphF45vhoD7fx 136+ReHNn2BtlxB7r+5iM79hI6IyHHyx93R5AdWqWDGLIKE2nHc60kRAbHReoYI+yWK9QQ6Vm4JyTqZoBd933W5dqk UZ59PJdG8XAZOaXlVMZ5EJs=","Timestamp":1723098834097}

[0077] In order to implement the proxy login process, in one embodiment of the present invention, after step D5 in the above embodiment, the method further includes:

[0078] When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext;

[0079] Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm;

[0080] When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

[0081] In an embodiment of the present invention, when a login request is initiated through a proxy server in an indirect login (for example, GET method), first, the proxy server receives a login request containing an account name, a second calculated ciphertext, a second encrypted ciphertext and a timestamp, and at the same time needs to verify the legitimacy of the timestamp and account name contained in the login request. After the verification is passed, the proxy server forwards the request to the server, and the server uses the server-side private key to decrypt the second encrypted ciphertext to generate a second user-side ciphertext. Then, the server obtains the second password hash value and the second source random number corresponding to the account from the user center, and combines the two through an encryption algorithm to generate a second calculated ciphertext. Subsequently, the system compares the consistency of the second user-side ciphertext with the second calculated ciphertext, and generates a second login identifier if they match. The login identifier is stored locally by the proxy server, and the corresponding authentication credentials are generated according to the cross-domain scenario requirements, and forwarded to the user side through the proxy to complete the identity authentication in the cross-domain environment.

[0082] Specifically, the second password hash value, HPassword, is a hash value generated from the original password using the SHA512 algorithm. The proxy login method is designed to address cross-domain login scenarios from the browser side, such as switching from a third-party browser-side web system to the local system's web system, or from a third-party mobile application to the local system's mobile interface. Regardless of the development language used by the third-party business system, proxy login can be performed via the HTTP(S) protocol.

[0083] For example, proxy login interface (indirect login GET method): http(s): / / domain name / proxyloginQuery parameters: UserName, Psalt, Cryptsalt, TimeStamp

[0084] The complete request example is as follows:

[0085] http: / / test.com / proxylogin? Psalt=$2a$05$6q5Rsa1PpEr.MDmsi5G9XOX5VghbyRaF / .nyh / aSvl832mCqXhffm&Cryptsalt=YaxeFvTZUTZEpQchSIyMbYGb Q0WyPomg1QvLEgpIypNClkgXT5RVFNKVYOMS%2bi3%2bIw6GEIuhLpOj%2buKZ7gd3cUY1swRI1tPj0glXZxEHwD8GVXQpWBM6ecs9EIMJK7y2MWd WQgwCQp6n4wYPUp%2byiqoHQUjXUpAK3U / UuW6C9sk=&UserName=test&TimeStamp=1721725592966

[0086] like Figure 2 To more clearly illustrate the technical solutions and advantages of the present invention, a two-stage login method is provided below in detail for an embodiment of the present invention, which may include the following steps:

[0087] Step 201: Receive an encrypted random number acquisition request from a user, wherein the encrypted random number acquisition request includes: account name, user public key and timestamp;

[0088] Step 202: Performing a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and the validity of the user's public key;

[0089] Step 203: Obtain the src encrypted random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server-side public key obtained from the key center to the user;

[0090] Step 204: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate. If so, execute step 205; otherwise, execute step 212.

[0091] Step 205: When the login request is a direct login method, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext;

[0092] Step 206: Obtain a first password hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm;

[0093] Step 207: When the first user terminal ciphertext and the first calculated ciphertext are the same, a first login identifier is generated and stored in the login identifier management service to complete the same-domain authentication;

[0094] Step 208: When the login request interface is an indirect login mode, the proxy server receives the login request including the second calculated ciphertext and the second encrypted ciphertext, and uses the server-side private key to decrypt the second encrypted ciphertext to generate a second user-side ciphertext;

[0095] Step 209: Obtain a second password hash value and a second source random number from the user center, and generate a second calculated ciphertext using an encryption algorithm;

[0096] Step 210: When the second user terminal ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication;

[0097] Step 211: Upon receiving a service request from an external party, perform a service authentication operation based on the service request, verifying the identifier, timestamp, message entity MD5 calculation value, and authorization signature in the service request header field;

[0098] Specifically, the purpose of logging into the system is to perform business operations. After completing the login, subsequent business call interfaces must have authentication logic. This is achieved by using authorization header authentication information and custom header information. This not only meets the timeliness of the HTTP protocol security requirements to prevent hotlinking, but also prevents interface data tampering. The HTTP protocol includes headers and message entities. The following standard headers must be included: Content-MD5 (MD5 calculation value of the message entity), Content-Type (message entity type), Content-length (message entity length), Authorization (authorization authentication information). At the same time, custom headers are added to the HTTP header. The custom header names are all prefixed with X-TAG- and are called TAGHeaders: X-TAG-session (login identifier obtained by account login), X-TAG-User-Agent (user information issuing the request, used to distinguish the type of sender), and X-TAG-Date (timestamp of the request).

[0099] Step 212: Reject the user's request for obtaining the encrypted random number.

[0100] like Figure 3 As shown, an embodiment of the present invention provides a two-stage login system, which includes: a receiving module 301: configured to receive an encrypted random number acquisition request from a user terminal, wherein the encrypted random number acquisition request includes: an account name, a user terminal public key, and a timestamp;

[0101] Acquisition module 302: used to obtain a source random number corresponding to the current account name from the user center, encrypt the source random number using the user public key received by the receiving module 301 to generate an encrypted random number, and return the encrypted random number and the server public key obtained from the key center to the user;

[0102] Authentication module 303: upon receiving a login request from an external party including the account name, encrypted ciphertext, and timestamp, generates a login ID based on the server-side private key and the encrypted ciphertext and stores the generated ID in a login ID management service, wherein the server-side private key and the server-side public key are in a one-to-one correspondence;

[0103] Authentication module 304: When receiving a service request from an external party, it performs a service authentication operation based on the service request, and verifies the identifier, timestamp, message entity MD5 calculation value, and authorization signature in the service request header field.

[0104] based on Figure 3 A two-stage login system as shown in Figure 4As shown, after the receiving module 301 and before the obtaining module 302, it further includes: a verification module 305;

[0105] The verification module 305 is used to perform a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

[0106] like Figure 4 As shown, the authentication module 303 is further configured to execute:

[0107] D1: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5;

[0108] D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext;

[0109] D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm;

[0110] D4: When the first user-end ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication;

[0111] D5: Reject the user's request for obtaining the encrypted random number.

[0112] like Figure 4 As shown, the authentication module 303 is further configured to execute, after D4 and before D5, the following steps:

[0113] When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext;

[0114] Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm;

[0115] When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

[0116] It should be understood that the illustrated structure of the embodiment of the present invention does not constitute a specific limitation on a two-stage login system. In other embodiments of the present invention, a two-stage login system may include more or fewer components than illustrated, or may combine or separate certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0117] The information interaction, execution process, etc. between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention and will not be repeated here.

[0118] An embodiment of the present invention further provides a two-stage login system, comprising: at least one memory and at least one processor;

[0119] at least one memory for storing a machine-readable program;

[0120] At least one processor is configured to call a machine-readable program to execute a two-stage login method according to any embodiment of the present invention.

[0121] An embodiment of the present invention further provides a computer-readable medium having computer instructions stored thereon. When the computer instructions are executed by a processor, the processor executes a two-stage login method according to any embodiment of the present invention.

[0122] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0123] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute part of the present invention.

[0124] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0125] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0126] In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion unit connected to the computer, and then based on the instructions of the program code, the CPU installed on the expansion board or expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0127] Each embodiment of the present invention has at least the following beneficial effects:

[0128] 1. In an embodiment of the present invention, a two-stage login method is provided. The method first receives an encrypted random number acquisition request sent by the user end through the server end, which includes the account name, the user end public key and the timestamp, and then obtains the source random number of the corresponding account from the user center, encrypts the source random number with the user end public key to generate an encrypted random number, and dynamically obtains the server end public key with time validity from the key center and returns it to the user end. At the same time, when an external login request is received, a unique login login identifier is generated based on the server end private key, the encrypted ciphertext and the timestamp and stored to process the login authentication. In the business request stage, by verifying the identifier and timestamp, and combining the message entity MD5 calculation value anti-tampering verification and authorization signature, a dynamic authentication system including a custom header field is constructed to ensure the legitimacy of the request and the integrity of the data. Through the above processing process, without changing the original system authority system, the cross-domain restriction problem of traditional login in system integration is solved, and repeated input of login credentials is avoided, providing a safe and efficient login solution for small applications, thereby significantly improving the security of the system;

[0129] 2. In an embodiment of the present invention, when the server receives an encrypted random number acquisition request sent by the user including the account name, the user public key and the timestamp, it will perform the following checks: First, verify the validity of the timestamp; second, verify the legitimacy of the account name, and confirm whether the account exists, is in an activated state and is disabled by interacting with the user center database, to avoid login attempts by illegal accounts; third, verify the validity of the user public key, and rely on the dynamic key pool mechanism of the key center to check whether the user public key belongs to the current valid key pair, and ensure the compliance of the public key structure through the format verification of the RSA encryption algorithm. If any of the check items fails, the server will directly reject the request; if all the verifications pass, it will continue to obtain the source random number of the corresponding account from the user center, and apply for a valid public and private key pair on the server side from the key center, and then complete the subsequent encryption and return process of the encrypted random number. The above data verification operation ensures login security through multi-layer protection of timestamp timeliness control, account legitimacy verification and public key validity management;

[0130] 3. In an embodiment of the present invention, during the login execution phase, when the server receives a login request from the outside, it will first verify the legitimacy, which covers timestamp validity verification, account name legitimacy verification, and request format compliance verification. If the verification is passed, different processing paths will be entered according to the login request type: for direct login requests, the server uses the server-side private key to decrypt the first encrypted ciphertext and generate the first user-side ciphertext; then, the server obtains the first password hash value and the first source random number corresponding to the account from the user center, and combines the two through an encryption algorithm to generate a first calculated ciphertext. The system compares the consistency of the first user-side ciphertext with the first calculated ciphertext. If they match, a first login login identifier is generated and stored in the login identifier management service to complete the authentication process in the same domain environment. The above process builds a complete security authentication system in the same domain scenario through a dynamic key decryption and irreversible cryptographic mechanism of dual-algorithm dual-factor encryption.

[0131] It should be noted that not all steps and modules in the above processes and system structure diagrams are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0132] In the above embodiments, the hardware unit can be realized by mechanical means or electrical means. For example, a hardware unit can include permanent dedicated circuits or logic (such as special processors, FPGA or ASIC) to complete the corresponding operations. The hardware unit can also include programmable logic or circuits (such as general-purpose processors or other programmable processors), which can be temporarily set up by software to complete the corresponding operations. Concrete implementation (mechanical means or dedicated permanent circuits or temporarily set circuits) can be determined based on the consideration on cost and time.

[0133] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A two-stage login method, characterized in that: The method includes: A1: Receive an encrypted random number acquisition request from a user, wherein the encrypted random number acquisition request includes: an account name, a user public key, and a timestamp; A2: Obtain a source random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server-side public key obtained from the key center to the user; A3: Upon receiving a login request from an external party including the account name, encrypted ciphertext, and timestamp, generating a login ID based on the server-side private key and the encrypted ciphertext and storing the generated ID in a login ID management service, wherein the server-side private key and the server-side public key are in a one-to-one correspondence; A4: When receiving a service request from an external party, perform a service authentication operation based on the service request, and verify the identifier, timestamp, message entity MD5 calculation value, and authorization signature in the service request header field.

2. The method according to claim 1, characterized in that After A1 and before A2, further comprising: Performing a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

3. The method according to claim 1, characterized in that The A3 includes: D1: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5; D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext; D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm; D4: When the first user-side ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication; D5: Reject the random number acquisition request from the user terminal.

4. The method according to claim 3, characterized in that Before D4 and after D5, further comprising: When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext; Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm; When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

5. A two-stage login system, characterized in that: The system includes: Receiving module: used to receive an encrypted random number acquisition request from a user terminal, wherein the encrypted random number acquisition request includes: account name, user terminal public key and timestamp; Acquisition module: used to obtain the source random number corresponding to the current account name from the user center, encrypt the source random number using the user's public key to generate an encrypted random number, and return the encrypted random number and the server-side public key obtained from the key center to the user; Authentication module: upon receiving a login request from an external party including the account name, encrypted ciphertext, and timestamp, generates a login ID based on the server-side private key and the encrypted ciphertext and stores the generated ID in a login ID management service, wherein the server-side private key and the server-side public key are in a one-to-one correspondence; Authentication module: When receiving a service request from an external party, it performs a service authentication operation based on the service request and verifies the identifier, timestamp, message entity MD5 calculation value and authorization signature in the service request header field.

6. The system according to claim 5, characterized in that After the receiving module and before the acquiring module, it further includes: a verification module; The verification module is used to perform a data verification operation on the encrypted random number acquisition request, wherein the data verification operation includes: verifying the validity of the timestamp, the legitimacy of the account name, and verifying the validity of the user's public key.

7. The system according to claim 5, characterized in that The authentication module is further configured to execute: D1: upon receiving a login request from an external party including the account name, the first encrypted ciphertext, and the timestamp, verify whether the login request is legitimate; if so, execute step D2; otherwise, execute step D5; D2: When the login request is a direct login, decrypt the first encrypted ciphertext using the server-side private key to generate a first user-side ciphertext; D3: Obtain a first cryptographic hash value and a first source random number from the user center, and generate a first calculated ciphertext using an encryption algorithm; D4: When the first user-side ciphertext and the first calculated ciphertext are the same, generate a first login identifier and store it in the login identifier management service to complete the same-domain authentication; D5: Reject the user's request for obtaining the encrypted random number.

8. The system according to claim 7, characterized in that The authentication module is further configured to execute, before D4 and after D5, the following steps: When the login request interface is an indirect login mode, receiving the login request including the second calculated ciphertext and the second encrypted ciphertext through the proxy server, and decrypting the second encrypted ciphertext using the server-side private key to generate a second user-side ciphertext; Obtaining a second cryptographic hash value and a second source random number from the user center, and generating a second calculated ciphertext using an encryption algorithm; When the second user-side ciphertext and the second calculated ciphertext are the same, a second login identifier is generated and stored in the local storage of the proxy server to complete the cross-domain authentication.

9. A two-stage login system, characterized in that: include: at least one memory and at least one processor; The at least one memory is configured to store a machine-readable program; The at least one processor is configured to call the machine-readable program to execute the method according to any one of claims 1 to 4.

10. A computer-readable medium, characterized in that The computer-readable medium stores computer instructions, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 4.

Images