Equipment login method and device

Abstract

The invention provides an equipment login method, which is applied to first server-side equipment and comprises the following steps: receiving indication information sent by client-side equipment, the indication information being used for indicating the client-side equipment to request to jump to log in second server-side equipment from the first server-side equipment. And the client device successfully logs in the first server device by adopting the first login credential. And according to the indication information, encrypting the first login credential by adopting encryption information to obtain a second login credential. The encrypted information is obtained by negotiating the first server-side equipment and the second server-side equipment. And sending the second login credential and the address information of the second server device to the client device, so that the client device can log in the second server device by using the second login credential and the address information. Therefore, by means of the scheme, the client device can conveniently log in the second server device without deploying an additional SSO server.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a method and apparatus for device login. Background Technology

[0002] In some scenarios, client devices need to log in to multiple server devices. These server devices, for example, are devices that integrate applications. After logging into a server device that integrates an application, the client device can access that application and use its functionalities.

[0003] Client devices can log in to server devices by inputting login credentials. Currently, for multiple server devices with certain relationships, in order to simplify user operations and facilitate quick login of client devices to these multiple related server devices, a single sign-on (SSO) solution has been developed. SSO is an authentication scheme that allows client devices to perform user authentication once based on login credentials, thereby logging into multiple related server devices.

[0004] However, current SSO solutions are relatively complex to deploy, requiring the deployment of a separate SSO server. How to simplify the deployment while ensuring that client devices can quickly log in to multiple related server devices is a problem that still needs to be solved. Summary of the Invention

[0005] This application provides a method and apparatus for device login that can ensure that client devices can quickly log in to multiple server devices with related relationships without deploying an additional SSO server.

[0006] Firstly, this application provides a method for device login. This method is applied to a first server device. The first server device receives an instruction from a client device, instructing the client device to request a redirection from the first server device to a second server device. The client device successfully logs into the first server device using a first login credential. After receiving the instruction, the first server device encrypts the first login credential using encrypted information to obtain a second login credential. This encrypted information is negotiated between the first and second server devices. After calculating the second login credential, the first server device sends the second login credential and the address information of the second server device to the client device. Thus, the client device can log into the second server device using the second login credential and the address information. Therefore, using this solution, no additional SSO server needs to be deployed. When the client device successfully logs into the first server device, it can automatically log into the second server device using the aforementioned address information and the second login credential calculated based on the first login credential, eliminating the need for the user to manually enter login credentials for the second server device, allowing for convenient login.

[0007] In one possible implementation, the encrypted information includes an encryption key, which the first server device uses to encrypt the first login credential to obtain the second login credential. In addition to the encryption key, the encrypted information also includes additional encryption parameters. These additional encryption parameters are used to prevent identical plaintext from being encrypted into unique ciphertext, thereby increasing the difficulty of cracking the ciphertext. The additional encryption parameters may be, for example, a random value. By using the encryption key and additional encryption parameters to encrypt the first login credential, the first server device increases the risk of the first login credential being cracked, thus increasing the security of the interaction between the client device and the second server device.

[0008] In one possible implementation, to ensure the accuracy and security of the second login credential and prevent its tampering during transmission, after receiving the aforementioned instruction information, the first server device, in addition to determining the aforementioned address information and encryption information, can also determine an integrity calculation key. Furthermore, it uses the integrity calculation key to perform an integrity calculation on the second login credential to obtain integrity verification information. This integrity calculation key is negotiated between the first and second server devices, and both devices store it separately. The first server device also sends the integrity verification information to the client device. The integrity verification information, the second login credential, and the address information are used together by the client device to log in to the second server device.

[0009] In one possible implementation, the first server device can also establish a transport layer security (TLS) protocol channel with the second server device, and perform key negotiation with the second server device based on the TLS protocol channel to obtain the encrypted information and the integrity calculation key, so as to encrypt the first login credential based on the encrypted information to obtain the second login credential, and perform integrity calculation on the second login credential based on the integrity calculation key.

[0010] In one possible implementation, once the TLS protocol channel between the first server device and the second server device is established, it indicates that both the first server device and the second server device have completed identity authentication. That is, the first server device confirms that the second server device's identity authentication is successful, and the second server device also confirms that the first server device's identity authentication is successful. In other words, in this application, the first server device and the second server device negotiate the encrypted information (or encrypted information and integrity calculation key) after confirming the legitimacy of each other's identities, effectively avoiding man-in-the-middle attacks.

[0011] In one possible implementation, the first server device and the second server device use a key exchange protocol to negotiate keys to obtain the encrypted information and the integrity calculation key, so that the first login credential can be encrypted based on the encrypted information to obtain the second login credential, and the integrity calculation key can be used to perform integrity calculation on the second login credential.

[0012] In one possible implementation, before the first server device and the second server device negotiate keys using a key exchange protocol, they first perform identity authentication. After each server device confirms that the other has passed authentication, they then negotiate the keys to obtain the aforementioned encrypted information, or the aforementioned encrypted information and an integrity calculation key. That is, in this application, the first server device and the second server device negotiate the encrypted information (or the encrypted information and the integrity calculation key) after confirming the other's legitimacy, effectively preventing man-in-the-middle attacks.

[0013] In one possible implementation, the first server device and the second server device negotiate a key exchange protocol to obtain the encrypted information and the integrity calculation key. This facilitates subsequent encryption of the first login credential based on the encrypted information to obtain the second login credential, and the performance of integrity calculation on the second login credential based on the integrity calculation key. The use of a key exchange protocol for key negotiation between the first and second server devices allows for simultaneous authentication of each other. In other words, in this application, the first and second server devices negotiate the encrypted information (or the encrypted information and the integrity calculation key) after confirming the legitimacy of each other's identities, effectively preventing man-in-the-middle attacks.

[0014] In one example, if the first server device and the second server device have not negotiated an integrity calculation key, the first server device can ensure the accuracy and security of the second authentication by encrypting the first login credential using a specific encryption algorithm. Specifically, the first server device uses the Authenticated Encryption with Associated Data (AEAD) algorithm to encrypt the first login credential using the aforementioned encryption information. When encrypting the first login credential using the AEAD algorithm, in addition to obtaining the second login credential, an AEAD tag is also obtained. In this scenario, the first server device also sends this AEAD tag to the client device. This AEAD tag, along with the aforementioned second login credential and address information, is used by the client device to log in to the second server device.

[0015] Secondly, this application provides a method for device login, applied to a client device. The client device sends an instruction to a first server device, instructing the client device to request a redirection from the first server device to log in to a second server device. After sending the instruction to the first server device, the client device receives a second login credential and the address information of the second server device returned by the first server device in response to the instruction. The second login credential is obtained by encrypting a first login credential using encryption information negotiated between the first and second server devices. The first login credential is the login credential for the client device to successfully log in to the first server device. After receiving the second login credential and the address information of the second server device, the client device sends a login request including the second login credential and the address information to the second server device to request login to the second server device. Therefore, it can be seen that by using this solution, there is no need to deploy an additional SSO server. When the client device successfully logs in to the first server device, the client device can also automatically log in to the second server device using the aforementioned address information and the second login credentials calculated based on the first login credentials. Users do not need to manually enter login credentials for logging into the second server device, which makes it convenient for users to log in to the second server device.

[0016] In one possible implementation, the encrypted information includes: an encryption key; or, an encryption key and additional encryption parameters.

[0017] In one possible implementation, the method further includes: receiving integrity verification information sent by the first server device, wherein the integrity verification information is obtained by the first server device performing integrity calculation on the second login credential using an integrity calculation key, and the integrity calculation key is negotiated between the first server device and the second server device. Accordingly, in this scenario, the login request also includes the integrity calculation information, so that the second server device can perform integrity verification on the second login credential based on the integrity calculation information.

[0018] In one possible implementation, the method further includes: receiving an authentication encryption AEAD tag with additional data sent by the first server device. Correspondingly, the login request also includes the AEAD tag, wherein the second login credential and the AEAD tag are obtained by the first server device encrypting the first login credential using the AEAD algorithm and the encryption information. In this scenario, the login request also includes the AEAD tag so that the second server device can verify the second login credential based on the AEAD tag and the second login credential.

[0019] Thirdly, this application provides a device login apparatus applied to a first server device. The apparatus includes: a receiving unit for receiving indication information sent by a client device, the indication information instructing the client device to request a jump from the first server device to log in to a second server device; a processing unit for encrypting a first login credential using encryption information according to the indication information to obtain a second login credential, the first login credential being a login credential for the client device to successfully log in to the first server device, the encryption information being negotiated between the first server device and the second server device; and a sending unit for sending the second login credential and the address information of the second server device to the client device, the second login credential and the address information of the second server device being used by the client device to log in to the second server device.

[0020] In one possible implementation, the encrypted information includes: an encryption key; or, an encryption key and additional encryption parameters.

[0021] In one possible implementation, the processing unit is further configured to perform integrity calculation on the second login credential using an integrity calculation key according to the instruction information to obtain integrity verification information, wherein the integrity calculation key is negotiated between the first server device and the second server device; the sending unit is further configured to send the integrity verification information to the client device, wherein the integrity verification information, the second login credential, and the address information are used together by the client device to log in to the second server device.

[0022] In one possible implementation, the processing unit is further configured to: establish a Transport Layer Security (TLS) protocol channel with the second server device; and perform key negotiation with the second server device based on the TLS protocol channel to obtain the encrypted information and the integrity calculation key.

[0023] In one possible implementation, the processing unit is further configured to: determine that the second server device has passed authentication in response to the completion of the TLS protocol channel establishment.

[0024] In one possible implementation, the processing unit is further configured to: perform key negotiation with the second server device using a key exchange protocol to obtain the encrypted information and the integrity calculation key.

[0025] In one possible implementation, the processing unit is further configured to: determine that the second server device has passed authentication before engaging in key negotiation with the second server device using a key exchange protocol.

[0026] In one possible implementation, encrypting the first login credential with encrypted information to obtain the second login credential includes: using the Authentication Encryption Algorithm (AEAD) with additional data, and encrypting the first login credential with the encrypted information to obtain the second login credential and an AEAD tag; the sending unit is further configured to: send the AEAD tag to the client device, wherein the AEAD tag, the second login credential, and the address information are used together by the client device to log in to the second server device.

[0027] In one possible implementation, the processing unit is further configured to: perform key negotiation with the second server device using an authentication key exchange protocol to obtain the encrypted information.

[0028] Fourthly, this application provides a device login apparatus applied to a client device. The apparatus includes: a sending unit, configured to send indication information to a first server device, the indication information instructing the client device to request a jump from the first server device to log in to a second server device; a receiving unit, configured to receive a second login credential and address information of the second server device sent by the first server device, wherein the second login credential is obtained by encrypting a first login credential using encryption information, the encryption information being negotiated between the first server device and the second server device, and the first login credential is a login credential for the client device to successfully log in to the first server device; the sending unit is further configured to send a login request to the second server device to request login to the second server device, the login request including the second login credential and the address information.

[0029] In one possible implementation, the encrypted information includes: an encryption key; or, an encryption key and additional encryption parameters.

[0030] In one possible implementation, the receiving unit is further configured to: receive integrity verification information sent by the first server device, wherein the integrity verification information is obtained by the first server device using an integrity calculation key to perform integrity calculation on the second login credential, and the integrity calculation key is negotiated between the first server device and the second server device; correspondingly, the login request also includes the integrity calculation information.

[0031] In one possible implementation, the receiving unit is further configured to: receive an authentication encryption AEAD tag with additional data sent by the first server device, and correspondingly, the login request also includes the AEAD tag, wherein: the second login credential and the AEAD tag are obtained by the first server device encrypting the first login credential using the AEAD algorithm and the encryption information.

[0032] Fifthly, this application provides an apparatus. The apparatus includes a processor and a memory. The memory is used to store instructions or computer programs. The processor is used to execute the instructions or computer programs in the memory to perform the methods described in the first aspect and any one thereof. Alternatively, the processor is used to execute the instructions or computer programs in the memory to perform the methods described in the second aspect and any one thereof.

[0033] Sixthly, this application provides a computer-readable storage medium including instructions or a computer program that, when run on a computer, causes the computer to perform the methods described in the first aspect and any one of the first aspects above, or causes the computer to perform the methods described in the second aspect and any one of the second aspects above.

[0034] In a seventh aspect, this application provides a computer program product comprising instructions or a computer program, which, when run on a computer, causes the computer to perform the method described in any one of the first aspects above, or causes the computer to perform the method described in the second aspect above and any one of the second aspects above.

[0035] Eighthly, this application provides a device login system, the system comprising: a first server device and a client device, wherein the first server device is configured to execute the method described in the first aspect above and any one of the first aspects above, and the client device is configured to execute the method described in the second aspect above and any one of the second aspects above.

[0036] In one possible implementation, the system further includes a second server device. After the client device sends a login request to the second server device, the second server device receives the login request from the client device and further verifies the second login credential. The login request includes the second login credential and the address information of the second server device. The result of the second server device's authentication of the second login credential determines whether the client device can successfully log in to the second server device. Specifically, if the second server device determines that the second login credential is authenticated, the client device can successfully log in to the second server device; if the second server device determines that the second login credential is not authenticated, the client device cannot successfully log in to the second server device.

[0037] In one possible implementation, the second server device pre-stores a first hash value, which is obtained by the second server device using a first hash algorithm to hash the first login credential. In this case, the verification of the second login credential by the second server device specifically includes: firstly, decrypting the second login credential to obtain a third login credential; then, further using the first hash algorithm to hash the third login credential to obtain a second hash value; finally, performing a consistency check on the first hash value and the second hash value. If the first hash value and the second hash value pass the consistency check, the second server device determines that the second login credential has been authenticated; if the first hash value and the second hash value fail the consistency check, the second server device determines that the second login credential has failed authentication. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1a This is a schematic diagram illustrating an exemplary application scenario provided in an embodiment of this application;

[0040] Figure 1b This is a schematic diagram illustrating another exemplary application scenario provided in the embodiments of this application;

[0041] Figure 2 A schematic diagram of an SSO scheme is shown;

[0042] Figure 3aA schematic diagram of a DH key exchange protocol is shown.

[0043] Figure 3b A schematic diagram of the TBPEE protocol is shown.

[0044] Figure 4 A schematic diagram of the signaling interaction of the device login method provided in the embodiments of this application;

[0045] Figure 5 A signaling interaction diagram illustrating a device login method provided in an embodiment of this application;

[0046] Figure 6 A signaling interaction diagram illustrating another device login method provided in this application embodiment;

[0047] Figure 7 A signaling interaction diagram illustrating another device login method provided in this application embodiment;

[0048] Figure 8 This is a schematic diagram of a device login apparatus provided in an embodiment of this application;

[0049] Figure 9 A schematic diagram of another device login apparatus provided in this application embodiment;

[0050] Figure 10 This is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0051] This application provides a method and apparatus for device login, which can ensure that client devices can quickly log in to multiple related server devices without deploying additional SSO servers.

[0052] See Figure 1a This figure is a schematic diagram of an exemplary application scenario provided by an embodiment of this application. Figure 1a The application scenario shown is a scenario where the same client device wants to log in to multiple server devices that have a relationship.

[0053] In one example, if the client device and the server device use a browser / server (B / S) architecture, then the client device is a browser.

[0054] In another example, if a client / server (C / S) architecture is used between the client device and the server device, then the client device is the client.

[0055] The embodiments of this application do not specifically limit the relationships between server-side devices. In one example, the relationship between server-side devices is that the functions provided by the server-side devices are related. In another example, the relationship between server-side devices is a management relationship; for example, one server-side device acts as a device manager, managing the other server-side devices.

[0056] exist Figure 1a The diagram shows a client device 110 and two server devices, namely server device 120 and server device 130. In practice, the number of server devices is not limited to the two shown in Figure 1. For example, see [reference needed]. Figure 1b As shown, the server-side equipment also includes at least one server-side equipment 140 that is associated with server-side equipment 120, which will not be described again here.

[0057] Currently, the SSO solution enables client device 110 to quickly log in to multiple server devices.

[0058] Next, the combination Figure 2 This paper introduces how the SSO solution enables client device 110 to quickly log in to server device 120 and server device 130. Figure 2 A schematic diagram of an SSO scheme is shown.

[0059] like Figure 2 As shown, the unified entry point for SSO is displayed on the client device 110. Users enter login credentials through this entry point, and the client device 110 sends the entered login credentials to the server device 120. The server device 120 then sends the login credentials to the SSO server 210, which authenticates the login credentials.

[0060] After the SSO server 210 confirms that the received login credentials have been verified, it sends the authentication result back to the server device 120. Accordingly, the client device 110 can successfully log in to the server device 120.

[0061] When client device 110 requests to jump from server device 120 to log in to server device 130, SSO server 210 generates a token and sends the token to server device 120. Server device 120 then returns the token to client device 110, and client device 110 logs in to server device 130 using the token.

[0062] Therefore, users only need to enter their login credentials once to log in to the associated server device 120 and server device 130.

[0063] However, adopting the SSO solution requires deploying an additional SSO server, as well as a unified entry point for SSO, making the deployment complex.

[0064] In view of this, this application provides a method and apparatus for device login, which can ensure that client devices can quickly log in to multiple related server devices without deploying additional SSO servers and a unified SSO entry point.

[0065] Before introducing the solutions provided in the embodiments of this application, the relevant technologies involved in this application will be introduced first.

[0066] 1. TLS secure channel

[0067] TLS secure channels are designed to provide authentication, confidentiality, and integrity to both communicating parties. They use public-key cryptography to complete symmetric key negotiation between the two parties and employ a random number generation mechanism to defend against replay attacks. Certificate authentication and digital signatures are used to provide the ability for both parties to verify the other's identity. In one example, a TLS secure channel uses symmetric encryption and message authentication codes to provide data confidentiality and integrity. In another example, a TLS secure channel uses symmetric encryption and the AEAD algorithm to provide data confidentiality and integrity.

[0068] 2. Key exchange protocol

[0069] A key exchange protocol is a protocol used over a network to exchange key materials and negotiate a common key. Key exchange protocols allow two communicating parties to negotiate a shared key in an insecure network environment. This shared key is used by both parties to encrypt transmitted data. A common key exchange protocol is the Diffie-Hellman (DH) key exchange protocol. Among DH key exchange protocols, there is the elliptic-curve Diffie–Hellman (ECDH) key exchange protocol. ECDH is also known as the DH key exchange protocol based on elliptic curve cryptography.

[0070] Next, combined Figure 3a The principles of the DH key exchange protocol will be explained. Figure 3a A schematic diagram of a DH key exchange protocol is shown.

[0071] exist Figure 3a In this context, Alice and Bob represent the two parties communicating. The process by which Alice and Bob negotiate their keys using the DH key exchange protocol is as follows:

[0072] 1. First, Alice selects a multiplicative group with a prime number p as its field and an order n generator g. Then, Alice generates a random number a and calculates A = g. a mod p. Alice sends g, p, and A to Bob.

[0073] 2. After Bob obtains g and p, he generates a random number b and calculates B = g. b mod p. Bob then sends B to Alice.

[0074] Through steps 1 and 2 above, Alice and Bob completed their information exchange. Each of them calculated the negotiation key based on the information they received using a "power-law addition modulo division" method. Specifically, Alice can calculate B... a Bob obtains the negotiation key K by mod p, and then calculates A... b Mod p yields the negotiation key K.

[0075] Among them, "exponentiation, addition, and modulo division" is a one-way operation that ensures that even if an attacker obtains A, it is difficult to crack and obtain a based on A. Similarly, it ensures that even if an attacker obtains B, it is difficult to crack and obtain b based on B.

[0076] While key exchange protocols can negotiate keys, they cannot defend against counterfeiting and are vulnerable to man-in-the-middle attacks.

[0077] 3. Authentication Key Exchange Protocol

[0078] Authentication key exchange protocols add authentication functionality to key exchange protocols, ensuring the trustworthiness of both communicating parties and preventing man-in-the-middle attacks. Common authentication key exchange protocols include password-authenticated key exchange (PAKE) protocols. Among them, the twin-base password encrypted key exchange (TBPEKE) protocol is a type of PAKE protocol. The following explanation uses the TBPEKE protocol as an example to illustrate the principles of the PAKE protocol. Figure 3b A schematic diagram of the TBPEE protocol is shown.

[0079] exist Figure 3b middle:

[0080] Alice and Bob represent the two parties in the communication.

[0081] pw is information that Alice and Bob pre-share, such as password information or password hash information, where the password hash information is the information obtained by hashing the password.

[0082] p is a prime number.

[0083] Z P * Represents the field of positive integers modulo p.

[0084] G is a cyclic group of order p.

[0085] g is a new generator of the cyclic group G.

[0086] U and V are two elements randomly selected from the cyclic group G.

[0087] sk represents encrypted information, such as an encryption key, or an encryption key plus additional encrypted information.

[0088] T represents the result calculated based on HMAC, where T A T represents the result obtained by Alice through HMAC-based calculations. B This indicates the result Bob calculated based on HMAC. HMAC stands for Hash Authentication Code Function.

[0089] The interaction process between Alice and Bob via the TBPEE protocol is as follows:

[0090] 1. First, Alice and Bob need to pre-select bigenizers U and V in the cyclic group G. For example, they can select bigenizers in the cyclic group G by hard-coding or by temporarily generating swaps.

[0091] 2. Alice calculates a new generator g based on pw and U, V, in the positive integer field Z. P * Generate a random number x, and calculate the public key X = g based on g and x. x And send X and A to Bob, where A is Alice's identifier.

[0092] 3. Bob computes the new generator g in the same way, in the positive integer field Z. P * Generate a random number y in g, and calculate the public key Y = g based on g and y. y Z = X y The encrypted information sk is calculated based on A, B, g, X, Y, and Z. The message authentication code T is calculated based on sk, the character "hmac1", A, and B. B Furthermore, Bob sends B, Y, and T to Alice. B .

[0093] 4. Alice calculates Z = Y xBased on A, B, g, X, Y, and Z, the encrypted information sk is calculated. Additionally, Alice processes the received T... B Verification is performed. After determining T... B After verification, T is calculated based on sk, the character "hmac2", A, and B. A Send T to Bob A .

[0094] 5. Bob received T A Verification is required.

[0095] exist Figure 3b The interaction process shown requires both Alice and Bob to simultaneously possess the pw for the TBPEE protocol to function correctly. Figure 3b During the interaction shown, Alice and Bob not only negotiated the key but also performed authentication based on the pre-shared information (pw). Furthermore, compared to key exchange protocols, the TBPEE protocol introduces HMAC to ensure the integrity of the session interaction.

[0096] Next, with reference to the accompanying drawings, the device login method provided in the embodiments of this application will be described.

[0097] See Figure 4 This figure is a signaling interaction diagram of the device login method provided in an embodiment of this application. Figure 4 The method shown can be applied to Figure 1a or Figure 1b The application scenarios shown.

[0098] In one example, when Figure 4 The method shown is applied to Figure 1a In the application scenarios shown, Figure 4 The client device in the middle, corresponding Figure 1a Client device 110 in the middle, Figure 4 The first server device in the middle, corresponding to Figure 1a Server-side device 120, Figure 4 The second server device in the middle corresponds to Figure 1a The server-side device is 130.

[0099] In another example, when Figure 4 The method shown is applied to Figure 1b In the application scenarios shown, Figure 4 The client device in the middle, corresponding Figure 1b Client device 110 in the middle, Figure 4 The first server device in the middle, corresponding to Figure 1b Server-side device 120, Figure 4 The second server device in the middle corresponds to Figure 1bAnother server device that differs from server device 120, for example, Figure 4 The second server device in the middle corresponds to Figure 1b For example, server-side device 130 in the middle, Figure 4 The second server device in the middle corresponds to Figure 1b The server-side device is 140.

[0100] Figure 4 The method shown includes the following steps S101-S105.

[0101] S101: The client device sends an instruction message to the first server device, the instruction message instructing the client device to request to jump from the first server device to log in to the second server device.

[0102] In one example, after a user triggers a request to log in to a second server device from the first server device, the client device generates the indication information in response to this operation and further sends the indication information to the first server device. After successfully logging into the first server device, the client device displays a page corresponding to the first server device, which includes at least one redirect link, including a link to the page corresponding to the second server device. In this scenario, the user-triggered request to log in to the second server device is, for example, when the user clicks a link to the page corresponding to the second server device. As an example, the indication information includes information about the link clicked by the user to redirect to the page corresponding to the second server device.

[0103] S102: The first server device receives the instruction information sent by the client device, and encrypts the first login credential using encryption information according to the instruction information to obtain the second login credential. The first login credential is the login credential for the client device to successfully log in to the first server device, and the encryption information is negotiated between the first server device and the second server device.

[0104] After the client device sends the instruction information to the first server device, the first server device receives the instruction information sent by the client device. Furthermore, the first server device parses the instruction information to determine that the instruction information is used to request a redirect to log in to the second server device.

[0105] In one example, the first server device determines the address information of the second server device based on the indication information. For example, the first server device queries and obtains the address information of the second server device based on the information of the aforementioned link included in the indication information. The address information of the second server device may be, for example, its Uniform Resource Locator (URL).

[0106] In another example, based on this instruction information, the first server device further generates a second login credential for the client device to log in to the second server device. Specifically, the first server device encrypts the first login credential using encryption information negotiated between itself and the second server device to obtain the second login credential. Since the encryption information is negotiated between the first and second server devices, in one example, the first and second server devices store the encryption information separately.

[0107] In this embodiment, the encrypted information is used to encrypt the first login credential. In this application, the first server device encrypts the first login credential using an encryption algorithm and encrypted information. This application does not specifically limit the encryption algorithm; the encryption algorithm can be any symmetric encryption algorithm, such as the Data Encryption Standard (DES) algorithm or the Advanced Encryption Standard (AES) algorithm, etc., which will not be listed here.

[0108] As an example, the encrypted information includes an encryption key. That is, the first server device uses the encryption key to encrypt the first login credential to obtain the second login credential. As another example, the encrypted information includes an encryption key and additional encryption parameters, wherein the additional encryption parameters are used to prevent the same plaintext from being encrypted into unique ciphertext, thereby increasing the difficulty of cracking the ciphertext. The additional encryption parameters are, for example, a random value.

[0109] For example, regarding the first login credential (i.e., plaintext), if the encryption algorithm remains unchanged, and the credential is encrypted using only the encryption key without additional encryption parameters, the ciphertext obtained each time will be the same regardless of how many times the credential is encrypted. Once the encryption key is cracked, an attacker can decrypt the credential using only the encryption key and the ciphertext. However, if the credential is encrypted using both the encryption key and additional encryption parameters, and the additional encryption parameters are different each time the credential is encrypted, even if the encryption algorithm is the same, the ciphertext obtained each time will be different. Even if an attacker cracks the encryption key, they cannot decrypt the credential using only the encryption key, thus ensuring the security of the first login credential.

[0110] In one example, the additional encryption parameter is the initial vector (IV), and in another example, the additional encryption parameter is the salt value.

[0111] In this application, the first server device stores a first login credential, which is the login credential used by the client device to successfully log in to the first server device. In one example, the user enters the first login credential on the login page displayed on the client device, thereby enabling the client device to successfully log in to the first server device using the first login credential. The first login credential mentioned here may include, for example, a username and a password; in some scenarios, the "password" may also be referred to as a "password".

[0112] S103: The first server device sends the second login credential and the address information of the second server device to the client device. The second login credential and the address information of the second server device are used by the client device to log in to the second server device.

[0113] S104: The client device receives the second login credential and the address information sent by the first server device.

[0114] After the first server device determines the second login credential and the address information of the second server device, it sends the second login credential and the address information of the second server device to the client device. Correspondingly, the client device receives the second login credential and address information sent by the first server device so that it can log in to the second server device based on the second login credential and address information.

[0115] S105: The client device sends a login request to the second server device to request to log in to the second server device. The login request includes the second login credential and the address information.

[0116] In a specific implementation, the client device logging into the second server device based on the second login credential and address information includes: sending a login request to the second server device, comprising the second login credential and the address information, to request login to the second server device. The address information in the login request is used by the client device to locate the second server device; in other words, the address information indicates the recipient of the login request, enabling the login request to be sent to the second server device. The second login credential in the login request is used by the second server device to authenticate the client device.

[0117] In one example, after the client device sends a login request to the second server device, the second server device receives the login request and further executes S106: verifying the second login credential.

[0118] In one example, the second server device pre-stores the aforementioned first login credential. Upon receiving a login request, the second server device parses the second login credential from the request and decrypts it using the encrypted information negotiated with the first server device, obtaining a third login credential. The second server device then performs a consistency check between the third and first login credentials. If the third and first login credentials are identical, the second server device determines that the second login credential has been verified, and the client device can successfully log in to the second server device. After successful login, the client device is redirected to the corresponding page on the second server device. If the third and first login credentials are different, the second server device determines that the second login credential has failed verification and sends a notification to the client device indicating that the login to the second server device has failed.

[0119] In another example, the second server device pre-stores a first hash value, which is obtained by the second server device using a first hash algorithm to hash the first login credential. In this scenario, after receiving a login request, the second server device parses the second login credential from the request and decrypts it using the encrypted information negotiated with the first server device, obtaining a third login credential. After obtaining the third credential, the second server device further hashes the third login credential using the aforementioned first hash algorithm to obtain a second hash value, and performs a consistency check between the first and second hash values. If the first and second hash values ​​are the same, the second server device determines that the second login credential has been verified, and the client device can successfully log in to the second server device. If the first and second hash values ​​are different, the second server device determines that the second login credential has failed verification, and sends a notification message to the client device indicating that the login to the second server device has failed.

[0120] As can be seen from the above description, using the solution provided in the embodiments of this application, there is no need to deploy an additional SSO server. When the client device successfully logs in to the first server device, the client device can also automatically log in to the second server device using the address information of the second server device and the second login credential calculated based on the first login credential. Users do not need to manually enter the login credential for logging in to the second server device, which makes it convenient for users to log in to the second server device.

[0121] In one example, to ensure the accuracy and security of the second login credential and prevent it from being tampered with during transmission, after receiving the aforementioned instruction information, the first server device, in addition to determining the aforementioned address information and encryption information, can also determine an integrity calculation key. Furthermore, it uses the integrity calculation key to perform an integrity calculation on the second login credential to obtain integrity verification information. This integrity calculation key is negotiated between the first server device and the second server device, and both devices store the integrity calculation key separately.

[0122] After calculating the integrity verification information, the first server device also sends the integrity verification information to the client device. In this scenario, the integrity verification information, along with the aforementioned second login credential and address information, is used by the client device to log in to the second server device. Specifically, the aforementioned login request includes the integrity verification information in addition to the second login credential and address information.

[0123] In this situation:

[0124] After receiving the login request, the second server device parses the request to obtain the second login credential and the integrity verification information. Accordingly, the second server device first verifies the integrity verification information. If the integrity verification information passes the verification, it determines that the second login credential has not been tampered with, and then further verifies the second login credential. If the second server device determines that the integrity verification information fails the verification, it does not need to further verify the second login credential, but directly sends a prompt message to the client device to indicate that the client device failed to log in to the second server device.

[0125] In this application, the verification of the integrity verification information by the second server device specifically includes: the second server device performing integrity calculation on the second login credential parsed from it using the integrity calculation key to obtain a calculation result. Then, a consistency check is performed between the calculation result and the integrity verification information. If the calculation result and the integrity verification information are the same, the integrity verification information is determined to have passed the verification; if the calculation result and the integrity verification information are different, the integrity verification information is determined to have failed the verification.

[0126] In one example, if the first server device and the second server device have the capability to establish a TLS protocol channel, the first server device establishes a TLS protocol channel with the second server device before performing key negotiation. After the TLS protocol channel is established, the first server device and the second server device perform key negotiation based on the TLS protocol channel to obtain the aforementioned encrypted information, or to obtain the aforementioned encrypted information and an integrity calculation key. Specifically, in the implementation of key negotiation based on the TLS protocol channel, the first server device generates the encrypted information and sends it to the second server device, or the first server device generates the encrypted information and an integrity calculation key and sends it to the second server device.

[0127] As described above regarding TLS protocol channels, TLS secure channels aim to provide both communicating parties with the capabilities of authentication, confidentiality, and integrity. Once the TLS protocol channel between the first server device and the second server device is established, it indicates that both the first server device and the second server device have completed identity authentication; that is, the first server device confirms that the second server device's identity authentication is successful, and the second server device also confirms that the first server device's identity authentication is successful.

[0128] In another example, if the first and second server devices lack the capability to establish a TLS protocol channel, but can authenticate each other—for example, through certificate authentication or with the assistance of a human administrator—then the first and second server devices will first authenticate each other. After each server device confirms the other's authentication, they will then negotiate a key to obtain the aforementioned encrypted information, or the aforementioned encrypted information and the integrity calculation key. In this scenario, the first and second server devices will negotiate the key based on a key exchange protocol.

[0129] In another example, if the first server device and the second server device do not have the capability to establish a TLS protocol channel, nor do they have the capability to authenticate each other using methods such as certificate authentication, then the first server device and the second server device will negotiate keys based on an authentication key exchange protocol to obtain the aforementioned encrypted information, or to obtain the aforementioned encrypted information and an integrity calculation key, thereby authenticating each other's identities while negotiating keys.

[0130] As can be seen from the above description, in this application, the first server device and the second server device negotiate and obtain encrypted information (or encrypted information and integrity calculation key) after verifying the legitimacy of each other's identities, which effectively avoids man-in-the-middle attacks.

[0131] As described above, the integrity calculation key is used to ensure the accuracy and security of the second authentication, preventing the second login credential from being tampered with during transmission. In one example, if the first server device and the second server device have not negotiated the integrity calculation key, the first server device can ensure the accuracy and security of the second authentication by encrypting the first login credential using a specific encryption algorithm. Specifically, the first server device uses the AEAD algorithm and the aforementioned encryption information to encrypt the first login credential. When encrypting the first login credential using the AEAD algorithm, in addition to obtaining the ciphertext of the first login credential (i.e., the second login credential), an AEAD tag is also obtained. In this scenario, the first server device also sends the AEAD tag to the client device. This AEAD tag, along with the aforementioned second login credential and address information, is used by the client device to log in to the second server device. In this case, the aforementioned login request includes the AEAD tag in addition to the second login credential and address information. In this case:

[0132] After receiving the login request, the second server device parses the request to obtain the second login credential and the AEAD tag. Further, using the encrypted information, the second login credential, and the AEAD tag as parameters for the AEAD algorithm, it decrypts the request to obtain the third login credential, and determines whether the second login credential has passed verification based on the third login credential. For example, if the second server device stores the first login credential, a consistency check is performed between the third login credential and the first login credential. Alternatively, if the second server device stores the aforementioned first hash value, the first hash algorithm is used to perform a hash calculation on the third login credential to obtain the second hash value, and a consistency check is performed between the first hash value and the second hash value.

[0133] The solutions provided by the embodiments of this application have been described above. Next, in combination with specific scenarios, several possible implementation methods of the embodiments of this application will be introduced.

[0134] Scenario 1: The first server device and the second server device have the ability to establish a TLS protocol channel.

[0135] See Figure 5 The figure is a signaling interaction diagram of a device login method provided in an embodiment of this application. Figure 5 The method shown includes the following steps S500-S507.

[0136] S500: Establish a TLS protocol channel between the first server device and the second server device.

[0137] S501: The client device sends an instruction to the first server device to request a redirect to log in to the second server device.

[0138] S502: The first server device obtains the address information of the second server device; generates encryption information and an integrity calculation key; encrypts the first login credential based on the encryption information to obtain the second login credential; calculates the integrity verification information based on the integrity calculation key for the second login credential.

[0139] S503: The first server device sends integrity verification information, the second login credential, and the address information of the second server device to the client device.

[0140] S504: The first server device sends encrypted information and integrity calculation key to the second server device.

[0141] S505: The client device sends a login request to the second server device, including integrity verification information, second login credentials, and the address information of the second server device.

[0142] After receiving the integrity verification information, the second login credential, and the address information of the second server device from the first server device, the client device executes S505.

[0143] S506: The second server device verifies the integrity verification information; it decrypts the second login credential using encrypted information to obtain the third login credential, and performs a consistency check between the third login credential and the first login credential.

[0144] S507: The client device has successfully logged into the second server device.

[0145] In one example, if the second server device determines that the third login credential and the first login credential pass the consistency check, the client successfully logs into the second server device.

[0146] For the specific implementation details of S501-S507 above, please refer to the previous section. Figure 4 The relevant descriptions of the methods shown will not be repeated here.

[0147] Scenario 2: The first server device and the second server device do not have the ability to establish a TLS protocol channel, but they can perform identity authentication.

[0148] See Figure 6 This figure is a signaling interaction diagram of another device login method provided in an embodiment of this application. Figure 6 The method shown includes the following steps S601-S609.

[0149] S601: The client device sends a request to the second server device to redirect to the second server device for login.

[0150] S602: The first server device and the second server device perform identity authentication and execute... Figure 3a As shown in the process, both the first server device and the second server device obtain the negotiation key K.

[0151] First server device and second server device execute Figure 3a In the process shown, the first server device corresponds to Figure 3a Alice in the middle, the second server device corresponds to Figure 3a Bob in the story.

[0152] S603: The first server device obtains encrypted information and integrity verification information based on K derivation.

[0153] S604: The second server device obtains encrypted information and integrity verification information based on K derivation.

[0154] The execution order of S603 and S604 is not limited in this application. S603 and S604 may be executed simultaneously, S603 may be executed after S604, or S603 may be executed before S604.

[0155] S605: The first server device obtains the address information of the second server device; encrypts the first login credential based on the encryption information to obtain the second login credential; calculates the second login credential based on the integrity calculation key to obtain integrity verification information.

[0156] The step of the first server device obtaining the address information of the second server device can be executed between S601 and S606, and is not limited to being executed after S604.

[0157] S606: The first server device sends integrity verification information, the second login credential, and the address information of the second server device to the client device.

[0158] S607: The client device sends a login request to the second server device, including integrity verification information, second login credentials, and the address information of the second server device.

[0159] After receiving the integrity verification information, the second login credential, and the address information of the second server device from the first server device, the client device executes S607.

[0160] S608: The second server device verifies the integrity verification information; it decrypts the second login credential using encrypted information to obtain the third login credential, and performs a consistency check between the third login credential and the first login credential.

[0161] S609: The client device has successfully logged into the second server device.

[0162] In one example, if the second server device determines that the third login credential and the first login credential pass the consistency check, the client successfully logs into the second server device.

[0163] For the specific implementation details of S601-S609 above, please refer to the previous section. Figure 4 The method shown, and about Figure 3a The relevant descriptions will not be repeated here.

[0164] Scenario 3: The first server device and the second server device do not have the ability to establish a TLS protocol channel, nor do they have the ability to perform identity authentication using methods such as certificate authentication.

[0165] See Figure 7This figure is a signaling interaction diagram of another device login method provided in an embodiment of this application. Figure 7 The method shown includes the following steps S701-S707.

[0166] S701: The client device sends a request to the second server device to redirect to the second server device for login.

[0167] S702: The first server device and the second server device execute Figure 3b As shown in the process, both the first server device and the second server device obtain the encrypted information sk.

[0168] First server device and second server device execute Figure 3b In the process shown, the first server device corresponds to Figure 3b Alice in the middle, the second server device corresponds to Figure 3b Bob in the story.

[0169] Regarding S702, in one example, the first server device stores a first ciphertext of the first login credential. The first server device can decrypt the first ciphertext to obtain the first login credential. The first ciphertext mentioned here is different from the second login credential. Accordingly, after obtaining the first login credential, the first server device uses a first hash algorithm to perform a hash calculation on the first login credential to obtain a first hash value. Furthermore, when generating a new generator, a new generator g is generated using the first hash value.

[0170] S703: The first server device obtains the address information of the second server device; it uses the AEAD authentication encryption algorithm with additional data and encrypts the first login credential using sk to obtain the second login credential and AEAD tag.

[0171] S704: The first server device sends the AEAD tag, the second login credential, and the address information of the second server device to the second server device.

[0172] S705: The client device sends a login request to the second server device, including the AEAD tag, the second login credential, and the address information of the second server device.

[0173] S706: The second server device uses the sk, the second login credential, and the AEAD tag as parameters of the AEAD algorithm to decrypt and obtain the third login credential. It then uses the first hash algorithm to calculate the third login credential to obtain the second hash value and performs a consistency check between the second hash value and the first hash value.

[0174] S707: The client device has successfully logged into the second server device.

[0175] In one example, the client successfully logs into the second server device after the second server device determines that the second hash value and the first hash value pass the consistency check.

[0176] For the specific implementation details of S701-S707 above, please refer to the previous section. Figure 4 The method shown, and about Figure 3b The relevant descriptions will not be repeated here.

[0177] Based on the device login method provided in the above embodiments, this application also provides a corresponding apparatus. The apparatus provided in this application will be described below with reference to the accompanying drawings.

[0178] See Figure 8 The figure is a schematic diagram of a device login apparatus provided in an embodiment of this application. Figure 8 The device login apparatus 800 shown is applied to a first server device and is used to execute the steps provided by the above method embodiments and performed by the first server device, for example, executing... Figures 4 to 7 The steps performed by the first server device as shown in any of the accompanying figures.

[0179] like Figure 8 As shown, the device 800 includes: a receiving unit 801, a processing unit 802, and a sending unit 803.

[0180] The receiving unit 801 is used to receive indication information sent by the client device, the indication information indicating that the client device requests to jump from the first server device to log in to the second server device.

[0181] The processing unit 802 is configured to encrypt the first login credential using encryption information according to the instruction information to obtain the second login credential. The first login credential is the login credential for the client device to successfully log in to the first server device. The encryption information is obtained through negotiation between the first server device and the second server device.

[0182] The sending unit 803 is used to send the second login credential and the address information of the second server device to the client device. The second login credential and the address information of the second server device are used by the client device to log in to the second server device.

[0183] In one possible implementation, the encrypted information includes: an encryption key; or, an encryption key and additional encryption parameters.

[0184] In one possible implementation, the processing unit 802 is further configured to perform integrity calculation on the second login credential using an integrity calculation key according to the instruction information to obtain integrity verification information, wherein the integrity calculation key is negotiated between the first server device and the second server device; the sending unit 803 is further configured to send the integrity verification information to the client device, wherein the integrity verification information, the second login credential, and the address information are used together by the client device to log in to the second server device.

[0185] In one possible implementation, the processing unit 802 is further configured to: establish a Transport Layer Security (TLS) protocol channel with the second server device; and perform key negotiation with the second server device based on the TLS protocol channel to obtain the encrypted information and the integrity calculation key.

[0186] In one possible implementation, the processing unit 802 is further configured to: determine that the second server device has passed authentication in response to the completion of the TLS protocol channel establishment.

[0187] In one possible implementation, the processing unit 802 is further configured to: perform key negotiation with the second server device using a key exchange protocol to obtain the encrypted information and the integrity calculation key.

[0188] In one possible implementation, the processing unit 802 is further configured to: determine that the second server device has passed authentication before engaging in key negotiation with the second server device using a key exchange protocol.

[0189] In one possible implementation, encrypting the first login credential with encrypted information to obtain the second login credential includes: using the AEAD (Authentication Encryption Algorithm) with additional data, and encrypting the first login credential with the encrypted information to obtain the second login credential and the AEAD tag; the sending unit 803 is further configured to: send the AEAD tag to the client device, wherein the AEAD tag, the second login credential, and the address information are used together by the client device to log in to the second server device.

[0190] In one possible implementation, the processing unit 802 is further configured to: perform key negotiation with the second server device using an authentication key exchange protocol to obtain the encrypted information.

[0191] See Figure 9 The figure is a schematic diagram of another device login device provided in an embodiment of this application. Figure 9The device login apparatus 900 shown is applied to a client device and is used to perform the steps provided by the client device in the above method embodiments, such as executing... Figures 4 to 7 The steps performed by the client device as shown in any of the accompanying figures.

[0192] like Figure 9 As shown, the device 900 includes a transmitting unit 901 and a receiving unit 902.

[0193] The sending unit 901 is used to send indication information to the first server device, the indication information instructing the client device to request to jump from the first server device to log in to the second server device.

[0194] The receiving unit 902 is used to receive the second login credential and the address information of the second server device sent by the first server device. The second login credential is obtained by encrypting the first login credential with encryption information by the first server device. The encryption information is negotiated between the first server device and the second server device. The first login credential is the login credential for the client device to successfully log in to the first server device.

[0195] The sending unit 901 is further configured to send a login request to the second server device to request login to the second server device, wherein the login request includes the second login credential and the address information.

[0196] In one possible implementation, the encrypted information includes: an encryption key; or, an encryption key and additional encryption parameters.

[0197] In one possible implementation, the receiving unit 902 is further configured to: receive integrity verification information sent by the first server device, wherein the integrity verification information is obtained by the first server device using an integrity calculation key to perform integrity calculation on the second login credential, and the integrity calculation key is negotiated between the first server device and the second server device; correspondingly, the login request also includes the integrity calculation information.

[0198] In one possible implementation, the receiving unit 902 is further configured to: receive an authentication encryption AEAD tag with additional data sent by the first server device, and correspondingly, the login request also includes the AEAD tag, wherein: the second login credential and the AEAD tag are obtained by the first server device encrypting the first login credential using the AEAD algorithm and the encryption information.

[0199] For the specific implementation of each unit of the devices 800 and 900, please refer to the relevant descriptions in the above embodiments; they will not be repeated here.

[0200] It should be noted that the hardware structure of the aforementioned device login devices 800 and 900 can be as follows: Figure 10 The structure shown, Figure 10 This is a schematic diagram of the structure of a device provided in an embodiment of this application.

[0201] Please see Figure 10 As shown, device 1000 includes: a processor 1010, a communication interface 1020, and a memory 1030. The number of processors 1010 in device 1000 may be one or more. Figure 10 Taking a processor as an example. In this embodiment, the processor 1010, communication interface 1020, and memory 1030 can be connected via a bus system or other means, wherein, Figure 10 Taking the connection between China and Israel via the 1040 bus system as an example.

[0202] Processor 1010 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. Processor 1010 may further include hardware chips. These hardware chips may be application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0203] The memory 1030 may include volatile memory, such as random-access memory (RAM); the memory 1030 may also include non-volatile memory, such as flash memory, hard disk drive (HDD), or solid-state drive (SSD); the memory 1030 may also include combinations of the above types of memory. The memory 1030 may, for example, store the aforementioned encrypted information, or store encrypted information and an integrity calculation key.

[0204] Optionally, the memory 1030 stores an operating system and programs, executable modules, or data structures, or subsets thereof, or extended sets thereof. The programs may include various operation instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and handling hardware-based tasks. The processor 1010 can read the programs in the memory 1030 to implement the device login method provided in this embodiment.

[0205] The bus system 1040 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus system 1040 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 10 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0206] This application also provides a computer-readable storage medium, including instructions or a computer program, which, when run on a computer, causes the computer to execute the device login method provided in the above embodiments.

[0207] This application also provides a computer program product containing instructions or computer programs, which, when run on a computer, causes the computer to execute the device login method provided in the above embodiments.

[0208] This application also provides a device login system, which includes a first server device and a client device mentioned in the above embodiments. The first server device is used to perform the operations performed by the first server device provided in the above embodiments, and the client device is used to perform the operations performed by the client device provided in the above embodiments.

[0209] Optionally, the system further includes a second server device, which is used to perform the operations provided in the above embodiments by the second server device.

[0210] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0211] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0212] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical business division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0213] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0214] Furthermore, the various business units in the embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software business unit.

[0215] If the integrated unit is implemented as a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0216] Those skilled in the art will recognize that, in one or more of the examples above, the services described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these services can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium accessible to general-purpose or special-purpose computers.

[0217] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention.

[0218] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for device login, characterized in that, Applied to a first server device, the method includes: Receive indication information sent by the client device, the indication information instructing the client device to request to jump from the first server device to log in to the second server device; According to the instruction information, the first login credential is encrypted with encryption information to obtain the second login credential. The first login credential is the login credential for the client device to successfully log in to the first server device. The encryption information is obtained through negotiation between the first server device and the second server device. The client device sends the second login credential and the address information of the second server device to the client device. The second login credential and the address information of the second server device are used by the client device to log in to the second server device.

2. The method according to claim 1, characterized in that, The encrypted information includes: Encryption key; or, Encryption key and additional encryption parameters.

3. The method according to claim 1 or 2, characterized in that, The method further includes: According to the instruction information, the integrity calculation key is used to perform integrity calculation on the second login credential to obtain integrity verification information. The integrity calculation key is negotiated between the first server device and the second server device. The integrity verification information is sent to the client device. The integrity verification information, the second login credential, and the address information are used together by the client device to log in to the second server device.

4. The method according to claim 3, characterized in that, The method further includes: Establish a Transport Layer Security (TLS) protocol channel with the second server device; Based on the TLS protocol channel, a key negotiation is performed with the second server device to obtain the encrypted information and the integrity calculation key.

5. The method according to claim 4, characterized in that, The method further includes: Upon completion of the TLS protocol channel establishment, the identity authentication of the second server device is confirmed to be successful.

6. The method according to claim 3, characterized in that, The method further includes: A key exchange protocol is used to negotiate a key with the second server device to obtain the encrypted information and the integrity calculation key.

7. The method according to claim 6, characterized in that, Before engaging in key negotiation with the second server device using a key exchange protocol, the method further includes: The identity authentication of the second server device has been confirmed to be successful.

8. The method according to claim 1 or 2, characterized in that, The step of encrypting the first login credential with encrypted information to obtain the second login credential includes: The AEAD (Authorization and Encryption Algorithm) with additional data is used to encrypt the first login credential, thereby obtaining the second login credential and the AEAD tag. The method further includes: The AEAD tag is sent to the client device, and the AEAD tag, the second login credential, and the address information are used together by the client device to log in to the second server device.

9. The method according to claim 1, 2, or 8, characterized in that, The method further includes: The encrypted information is obtained by negotiating a key with the second server device using an authentication key exchange protocol.

10. A method for device login, characterized in that, Applied to a client device, the method includes: Send an instruction message to the first server device, the instruction message instructing the client device to request to jump from the first server device to log in to the second server device; The client device receives a second login credential and the address information of the second server device sent by the first server device. The second login credential is obtained by encrypting the first login credential with encryption information. The encryption information is negotiated between the first server device and the second server device. The first login credential is the login credential for the client device to successfully log in to the first server device. A login request is sent to the second server device to request login to the second server device. The login request includes the second login credential and the address information.

11. The method according to claim 10, characterized in that, The encrypted information includes: Encryption key; or, Encryption key and additional encryption parameters.

12. The method according to claim 10 or 11, characterized in that, The method further includes: The system receives integrity verification information sent by the first server device. The integrity verification information is obtained by the first server device using an integrity calculation key to perform integrity calculation on the second login credential. The integrity calculation key is negotiated between the first server device and the second server device. Accordingly, the login request also includes the integrity calculation information.

13. The method according to claim 10 or 11, characterized in that, The method further includes: The login request includes an authentication encryption AEAD tag with additional data sent by the first server device. The second login credential and the AEAD tag are obtained by the first server device encrypting the first login credential using the AEAD algorithm and the encryption information.

14. A device login system, characterized in that, The system includes: a first server device and a client device; wherein: The first server device is used to execute the method according to any one of claims 1-9; The client device is used to perform the method according to any one of claims 10-13.

15. The system according to claim 14, characterized in that, The system also includes a second server device; The second server device is configured to: receive a login request sent by the client device, the login request being used to request login to the second server device, the login request including a second login credential and the address information of the second server device; The second server device is also used to: verify the second login credential.

16. The system according to claim 15, characterized in that, The second server device pre-stores a first hash value, which is obtained by the second server device using a first hash algorithm to perform a hash calculation on the first login credential. The verification of the second login credential includes: Decrypt the second login credential to obtain the third login credential; The third login credential is hashed using the first hash algorithm to obtain a second hash value; Perform a consistency check on the first hash value and the second hash value.

17. A device for device registration, characterized in that, The device includes multiple functional modules that interact with each other to implement the method as described in any one of claims 1-13.

18. A device for device login, comprising a processor and a memory, the memory for storing program code, the processor for calling the program code in the memory to cause the communication device to perform the method as claimed in any one of claims 1-13.

19. A computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-13.

20. A computer program product, characterized in that, Includes program code that, when a computer runs the computer program product, causes the computer to perform the method as described in any one of claims 1-13.

Images