A method for managing login of an information system

Abstract

The application provides an information system login management method, belonging to the technical field of computers. It comprises: detecting whether the user is logging in the system for the first time; in the case of detecting that the user is logging in the system for the first time, obtaining an account password to be created and an authorization duration; generating registration information data and saving; generating a dynamic code and saving; encrypting the account password to obtain an encrypted string, comprising: obtaining a quantum state salt value; converting the plaintext characters of the password into a plaintext byte array and recording the total length of the plaintext byte array; converting the salt value into a salt value byte array; traversing each character byte of the plaintext byte array and encrypting to obtain an encrypted byte array; splicing the salt value byte array and the encrypted byte array to obtain an encrypted string; saving the account encrypted string and the authorization duration to an offline login user table. The application adopts quantum random state encryption and uses a dynamic phase angle as the core parameter of character transformation, which significantly improves the frequency analysis resistance.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to an information system login management method. Background Technology

[0002] With the rapid development of information technology, the security of information systems has become a core aspect of ensuring data security, especially the security of password storage and transmission during the login authentication process. Existing information system login management solutions typically use symmetric or asymmetric encryption algorithms to process user credentials, but significant security vulnerabilities still exist in the specific encryption implementation details.

[0003] Traditional encryption operations often use fixed offsets or fixed XOR masks to process plaintext bytes. This fixed offset operation causes the ciphertext to retain obvious statistical characteristics. Attackers can easily deduce the offset patterns of the encryption algorithm by analyzing a large number of ciphertext samples and using differential analysis or frequency analysis, thereby recovering the plaintext data. Summary of the Invention

[0004] The purpose of this invention is to provide an information system login management method that solves the security risks caused by the use of fixed offsets in traditional encryption.

[0005] To achieve the above objectives, embodiments of the present invention provide an information system login management method, the management method including detecting whether a user is logging into the system for the first time; If the system detects that the user is logging in for the first time, obtain the account, password, and authorization duration to be created; Generate and save registration information data; Generate and save dynamic code; The account and password are encrypted to obtain an encrypted string, including: Obtain the quantum state salt value; Convert the plaintext characters of the password into a plaintext byte array and record the total length of the plaintext byte array; Convert the salt value into a salt value byte array; Iterate through each character byte of the plaintext byte array and encrypt it to obtain the encrypted byte array; The salt byte array is concatenated with the encrypted byte array to obtain the encrypted string; Save the account, encrypted string, and authorization duration to the offline login user table.

[0006] Optionally, obtaining the quantum state salt value includes: Determine if the user has defined a custom salt value; When determining whether a user-defined salt value is required, the user-defined salt value should be used. If the user has not defined a salt value, generate a 6-byte hardware-level true random number. Convert the random number into a 6-bit printable character as a salt value.

[0007] Optionally, the character bytes of each of the byte arrays are traversed and encrypted to obtain an encrypted byte array, including: The current salt value character is obtained according to formula (1). (1) Calculate the phase angle according to formula (2). (2) The offset is calculated according to formula (3). (3) Obtain the offset bytes according to formula (4). (4) Obtain the conjugate key according to formula (5). (5) Obtain the encrypted bytes according to formula (6). (6) in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the plaintext byte array. This is the offset. The offset bytes, For plaintext byte values, For conjugate keys, For encrypted bytes.

[0008] Optionally, the management method further includes: If it is determined that the user is not logging into the system for the first time, obtain the network connection status; Determine whether the connection status is normal; If the connection status is determined to be normal, the online login mode is activated for login authentication. If the connection status is determined to be abnormal, offline login mode is activated for login authentication. Hierarchical authorization management is implemented based on online / offline login mode and user level information.

[0009] Optionally, an online login mode can be initiated for login authentication, including: Obtain user registration information data; The registration information data is parsed to obtain the registration type, duration, product information, product serial number, and product deployment information; The authorization process confirms whether authorization is granted and the level of authorization.

[0010] Optionally, authorization and authorization level are confirmed after authentication, including: Determine whether the parsed product serial number matches the product serial number of the currently requested login software; If the parsed product serial number matches the product serial number of the currently requested login software, the deployment address time zone is obtained based on the parsed product deployment information; Determine whether the time zone of the deployment address is consistent with the time zone of the currently requested login software; If the time zone of the deployment address is consistent with the time zone of the currently requested login software, determine whether the login time exceeds the parsed time limit; If the login time does not exceed the parsed time limit, authorization is granted.

[0011] Optionally, an offline login mode can be activated for login authentication, including: Obtain the user's account information file; Based on the account information, obtain the corresponding encrypted string from the offline login user table; Decrypt the encrypted string to obtain the decoded user information; Add the decoded user information to the legitimate user set; Match the user to be logged in and their password in the collection of legitimate users. Based on the matching results of the collection of legitimate users and the matching results of the dynamic code, confirm whether authorization is granted and the level of authorization.

[0012] Optionally, the encrypted string is decrypted to obtain the decoded user information, including: The first 6 bytes of the encrypted string are used as the salt byte array, and the remaining bytes are used as the ciphertext byte array. The total length of the ciphertext byte array is recorded. Iterate through each ciphertext byte and decrypt it to obtain the plaintext byte; Convert the plaintext into a string.

[0013] Optionally, each ciphertext byte is traversed and decrypted to obtain the plaintext byte, including: The current salt value character is obtained according to formula (7). (7) Obtain the conjugate key according to formula (8). (8) Calculate the offset bytes according to formula (9). (9) Calculate the phase angle according to formula (10). (10) The offset is calculated according to formula (11). (11) Obtain the plaintext bytes according to formula (12). (12) in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the ciphertext byte array. This is the offset. The offset bytes, The ciphertext byte value, For conjugate keys, These are plaintext bytes.

[0014] Optionally, dynamic code is generated and saved, including: Calculate the hash value according to formula (13). (13) in, For hash value, For hash algorithms, For the key, For time counting; Take the lower 4 bits of the last byte of the hash value as the offset value; Starting with the offset value as the index, extract four consecutive bytes from the hash value to obtain the corresponding integer; The integer is moduloed to obtain the dynamic code.

[0015] Through the above technical solutions, this invention provides an information system login management method. By identifying the initial login status, it avoids duplicate registration and data conflicts, providing a basis for subsequent differentiated security strategies. Furthermore, by determining the authorization duration, it ensures users' legitimate access in offline environments while preventing indefinite abuse of permissions. The generated registration information data is bound to device and product information, enhancing anti-counterfeiting capabilities. The dynamic code generation and encrypted string conversion mechanism ensures the secure transmission and storage of sensitive user credentials in insecure environments, effectively preventing the risk of plaintext password leakage. Compared with existing technologies, this invention uses quantum random states instead of traditional pseudo-random sequences, significantly improving the quality of randomness and fundamentally enhancing anti-predictability. Using the dynamic phase angle as the core parameter for character transformation, it achieves nonlinear mapping through trigonometric functions, replacing traditional fixed shift, fixed XOR, and other linear operations, significantly improving resistance to frequency analysis, differential analysis, and linear cryptanalysis. The encryption process introduces dual variable factors of random state and dynamic phase; the same plaintext can be encrypted multiple times with the same key to obtain different ciphertexts, improving the anti-tampering and anti-forgery capabilities of data in transmission and storage scenarios.

[0016] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a management method according to one embodiment of the present invention; Figure 2 This is a flowchart illustrating the encryption of account and password according to an embodiment of the present invention; Figure 3 This is a flowchart of obtaining quantum state salt values ​​according to one embodiment of the present invention; Figure 4 This is a flowchart illustrating the encryption of character bytes according to an embodiment of the present invention; Figure 5 This is a flowchart illustrating the selection of login mode based on network status according to an embodiment of the present invention; Figure 6 This is a flowchart illustrating a hierarchical authorization process according to one embodiment of the present invention; Figure 7 This is a flowchart of the authentication process according to one embodiment of the present invention; Figure 8 This is a flowchart illustrating the activation of offline login mode according to an embodiment of the present invention; Figure 9 This is a flowchart of decrypting an encrypted string according to an embodiment of the present invention; Figure 10 This is a flowchart of obtaining plaintext bytes according to an embodiment of the present invention; Figure 11 This is a flowchart of generating dynamic code according to one embodiment of the present invention. Detailed Implementation

[0018] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0019] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0020] Figure 1 This is a flowchart of a management method according to an embodiment of the present invention, in which the management method includes: In step S1, it is detected whether the user is logging into the system for the first time. If the user is logging into the system for the first time, step S2 is executed; otherwise, step S7 is executed.

[0021] In step S2, the account, password, and authorization duration to be created are obtained. The login account can be in one of three formats: user ID, user alias, or user identifier.

[0022] In step S3, registration information data is generated and saved.

[0023] In step S4, dynamic code is generated and saved.

[0024] In step S5, the username and password are encrypted to obtain an encrypted string. Specifically, the steps for encrypting the username and password to obtain the string can be as follows: Figure 2 The method shown is illustrated. Figure 2 In addition, the method also includes: In step S51, the quantum state salt value is obtained.

[0025] In step S52, the plaintext characters of the password are converted into a plaintext byte array, and the total length of the plaintext byte array is recorded.

[0026] In step S53, the salt value is converted into a salt value byte array.

[0027] In step S54, the character bytes of each plaintext byte array are traversed and encrypted to obtain the encrypted byte array.

[0028] In step S55, the salt byte array and the encrypted byte array are concatenated to obtain the encrypted string.

[0029] In step S6, the account, encrypted string, and authorization duration are saved to the offline login user table.

[0030] In steps S1 to S6, firstly, identifying the initial login status avoids duplicate registrations and data conflicts, providing a basis for subsequent differentiated security strategies. Secondly, determining the authorization duration ensures legitimate access for users in offline environments while preventing indefinite abuse of permissions. The generated registration information data is bound to device and product information, enhancing anti-counterfeiting capabilities. Furthermore, dynamic code generation and encrypted string conversion mechanisms ensure the secure transmission and storage of sensitive user credentials in insecure environments, effectively preventing the risk of plaintext password leakage. Specifically, the introduction of quantum state salt effectively blocks rainbow table attacks, and the use of nonlinear encryption logic involving salt, byte position, and plaintext length makes the ciphertext extremely sensitive to plaintext changes, significantly increasing the cost of reverse analysis and differential attacks. Simultaneously, the structure of storing salt and ciphertext concatenated ensures reversible decryption feasibility in offline environments without relying on external storage. Finally, the account, encrypted string, and authorization duration are written into the offline login user table, enabling the system to complete identity verification and permission determination even when the network is unavailable. The overall solution takes into account high security, offline availability, and authorization controllability, thereby significantly improving the system's availability, business continuity, and overall protection level in weak network or no network scenarios while ensuring high security.

[0031] Compared with existing technologies, this invention uses quantum random states to replace traditional pseudo-random sequences. It has no periodicity, derivability, or statistical correlation, which makes the key stream have true random characteristics. It effectively resists attacks based on random sequence prediction, time series analysis, and pseudo-random seed restoration, and greatly enhances the basic security of encryption.

[0032] Furthermore, the methods for obtaining the quantum state salt value can be various those known to those skilled in the art. In a preferred embodiment of the present invention, the method for obtaining the quantum state salt value can be... Figure 3 The method shown in Figure 3 This management method also includes: In step S511, it is determined whether the user has defined a custom salt value. If the user has defined a custom salt value, step S512 is executed; otherwise, step S13 is executed.

[0033] In step S512, a user-defined salt value is used.

[0034] In step S513, a 6-byte hardware-level true random number is generated.

[0035] In step S514, the random number is converted into a 6-bit printable character as a salt value.

[0036] In this embodiment, the methods for encrypting character bytes can be various and known to those skilled in the art. In one example of the present invention, the method for encrypting character bytes can be... Figure 4 The method shown is illustrated. Figure 4 This management method also includes: In step S541, the current salt value character is obtained according to formula (1). (1) In step S542, the phase angle is calculated according to formula (2). (2) In step S543, the offset is calculated according to formula (3). (3) In step S544, the offset bytes are obtained according to formula (4). (4) In step S545, the conjugate key is obtained according to formula (5). (5) In step S546, the encrypted bytes are obtained according to formula (6). (6) in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the plaintext byte array. This is the offset. The offset bytes, For plaintext byte values, For conjugate keys, For encrypted bytes.

[0037] In steps S541 to S546, the dynamic phase angle is used as the core parameter for character transformation. A nonlinear mapping is achieved through trigonometric functions, replacing traditional linear operations such as fixed shifts and fixed XOR. This effectively smooths out statistical features of the plaintext, such as character frequency and repetition patterns, making the ciphertext devoid of exploitable structural patterns and significantly improving its resistance to frequency analysis, differential analysis, and linear cryptanalysis. Furthermore, the encryption process introduces dual variable factors: random state and dynamic phase. Multiple encryptions of the same plaintext using the same key can yield different ciphertexts, disrupting the fixed mapping relationship between plaintext and ciphertext. This resists replay attacks, dictionary matching attacks, and plaintext comparison attacks, enhancing the data's anti-tampering and anti-forgery capabilities in transmission and storage scenarios. The ciphertext is jointly determined by the key, quantum random state, and dynamic phase. Even if the master key is partially leaked, the plaintext cannot be recovered without the corresponding random state and phase trajectory. This achieves multi-factor collaborative security, reducing the risk of a single point of vulnerability causing the entire encryption system to fail. Furthermore, the phase offset amplitude, quantum random state length, and transformation rounds can all be flexibly configured, which can increase complexity in high-security scenarios and simplify computation on embedded, MCU, and low-computing-power devices, balancing security and operating efficiency, and resolving the contradiction between traditional encryption algorithms that either have high computational overhead or insufficient security strength.

[0038] To ensure service continuity and timely access for users under different network conditions, when a user logs in again after registering an account, the access mode is divided into online login mode and offline login mode based on the network connection status. Specifically, it could be... Figure 5 The method shown is illustrated. Figure 5 This management method also includes: In step S7, the network connection status is obtained.

[0039] In step S8, it is determined whether the connection status is normal. If the connection status is normal, step S9 is executed; otherwise, step S10 is executed.

[0040] In step S9, the online login mode is activated for login authentication.

[0041] In step S10, offline login mode is activated for login authentication.

[0042] In step S11, hierarchical authorization management is performed based on online / offline login mode and user level information.

[0043] In steps S7 to S11, while ensuring the continuity of user access and the immediacy of login under full network conditions, the system's high availability and data access security are dynamically balanced, solving the problem of single point of failure and security risks caused by the strong dependence of traditional systems on the network.

[0044] To achieve fine-grained access control and resource allocation, this implementation uses registration types to implement role-based hierarchies, granting different permissions to different users. Specifically, this could be... Figure 6 The method shown is illustrated. Figure 6 In addition, the method also includes: In step S91, the user's registration information data is obtained.

[0045] In step S92, the registration information data is parsed to obtain the parsed registration type, term, product information, product serial number, and product deployment information.

[0046] In step S93, authorization and its level are confirmed after authentication. Specifically, the authentication process can be as follows: Figure 7 The method shown includes: In step S931, it is determined whether the parsed product serial number matches the product serial number of the currently requested login software. If the parsed product serial number matches the currently requested login software product serial number, step S932 is executed.

[0047] In step S932, the deployment address time zone is obtained based on the parsed product deployment information.

[0048] In step S933, it is determined whether the time zone of the deployment address is consistent with the time zone of the currently requested login software. If the time zone of the deployment address is consistent with the time zone of the currently requested login software, step S934 is executed.

[0049] In step S934, it is determined whether the login time exceeds the parsed expiration date. If the login time does not exceed the parsed expiration date, step S935 is executed.

[0050] In step S935, authorization is granted. Specifically, the authorization level is determined based on the registration type, with levels ranging from high to low. For example, administrators are granted the highest level of privileges, including the ability to configure key system parameters and perform interface operations; operators are granted interface operation privileges; and observers are granted observation privileges, etc.

[0051] In step S936, authorization is denied.

[0052] In steps S931 to S936, a three-level chain verification process—product serial number matching, deployment timezone verification, and authorization period determination—achieves fine-grained software authorization control. First, legitimate serial numbers are locked to prevent cross-product theft. Then, timezone consistency verification blocks unauthorized deployment from different locations and environmental tampering. Finally, real-time login time is compared with the authorization period to block expired access. This multi-layered defense system precisely grants legitimate users access rights within a specified environment and period, effectively preventing the risks of serial number reuse, unauthorized cross-region deployment, and unauthorized login after authorization expires.

[0053] Furthermore, the specific steps for activating offline login mode for login authentication can be as follows: Figure 8 The method shown is illustrated. Figure 8 This management method also includes: In step S101, the user's account information file is obtained.

[0054] In step S102, the corresponding encrypted string is obtained from the offline login user table based on the account information. The offline login user table includes the username, user type, key, and validity period, etc. In step S103, the encrypted string is decrypted to obtain the decoded user information. The decoded user information includes the username, user type, key, decoded password, and validity period. Specifically, as shown... Figure 9 As shown, it includes: In step S1031, the first 6 bytes of the encrypted string are obtained as a salt byte array, the remaining bytes are obtained as a ciphertext byte array, and the total length of the ciphertext byte array is recorded.

[0055] In step S1032, each ciphertext byte is traversed and decrypted to obtain the plaintext byte.

[0056] In step S1033, the plaintext is converted into a string.

[0057] In step S104, the decoded user information is added to the set of legitimate users.

[0058] In step S105, the user to be logged in and their password are matched in the set of legitimate users. Based on the matching result of the set of legitimate users and the matching result of the dynamic code, the authorization status and authorization level are confirmed. Specifically, if the user to be logged in is found in the username list of the set of legitimate users, and the login password matches the password of the corresponding legitimate user in the user set list, then the match is successful.

[0059] In steps S101 to S105, a timeliness check is added on the basis of confirming the legitimacy of the user's identity, and authorization is confirmed or not based on the matching result, thereby realizing differentiated access control and dynamic permission management while ensuring basic login security.

[0060] In this embodiment, the method of decrypting each ciphertext byte to obtain the plaintext byte can be of various kinds known to those skilled in the art. In one example of the present invention, the method of decryption to obtain the plaintext byte can be as follows: Figure 10 The method shown herein. Specifically, it includes: In step S10321, the current salt value character is obtained according to formula (7). (7) In step S10322, the conjugate key is obtained according to formula (8). (8) In step S10323, the offset bytes are calculated according to formula (9). (9) In step S10324, the phase angle is calculated according to formula (10). (10) In step S10325, the offset is calculated according to formula (11). (11) In step S10326, the plaintext bytes are obtained according to formula (12). (12) in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the ciphertext byte array. This is the offset. The offset bytes, The ciphertext byte value, For conjugate keys, These are plaintext bytes.

[0061] In this implementation, the dynamic code can be determined based on the hash value. Specifically, as shown below... Figure 11 As shown, it includes: In step S41, the hash value is calculated according to formula (13). (13) in, For hash value, For hash algorithms, For the key, It is used for time counting. The key is obtained from the set of legitimate users. The function input is the key. and the message to be verified The message to be verified here Set as the remaining validity period .

[0062] In step S42, the lower 4 bits of the last byte of the hash value are taken as the offset value.

[0063] In step S43, four bytes are continuously extracted from the hash value starting with the offset value to obtain the corresponding integer.

[0064] In step S44, the integer is moduloed to obtain the dynamic code.

[0065] Through the above technical solutions, this invention provides an information system login management method. By identifying the initial login status, it avoids duplicate registration and data conflicts, providing a basis for subsequent differentiated security strategies. Furthermore, by determining the authorization duration, it ensures users' legitimate access in offline environments while preventing indefinite abuse of permissions. The generated registration information data is bound to device and product information, enhancing anti-counterfeiting capabilities. The dynamic code generation and encrypted string conversion mechanism ensures the secure transmission and storage of sensitive user credentials in insecure environments, effectively preventing the risk of plaintext password leakage. Compared with existing technologies, this invention uses quantum random states instead of traditional pseudo-random sequences, significantly improving the quality of randomness and fundamentally enhancing anti-predictability. Using the dynamic phase angle as the core parameter for character transformation, it achieves nonlinear mapping through trigonometric functions, replacing traditional fixed shift, fixed XOR, and other linear operations, significantly improving resistance to frequency analysis, differential analysis, and linear cryptanalysis. The encryption process introduces dual variable factors of random state and dynamic phase; the same plaintext can be encrypted multiple times with the same key to obtain different ciphertexts, improving the anti-tampering and anti-forgery capabilities of data in transmission and storage scenarios.

[0066] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0068] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0069] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0070] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0071] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0072] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0073] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0074] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for managing logins in an information system, characterized in that, The management method includes: Detect whether the user is logging into the system for the first time; If the system detects that the user is logging in for the first time, obtain the account, password, and authorization duration to be created; Generate and save registration information data; Generate and save dynamic code; The account and password are encrypted to obtain an encrypted string, including: Obtain the quantum state salt value; Convert the plaintext characters of the password into a plaintext byte array and record the total length of the plaintext byte array; Convert the salt value into a salt value byte array; Iterate through each character byte of the plaintext byte array and encrypt it to obtain the encrypted byte array; The salt byte array is concatenated with the encrypted byte array to obtain the encrypted string; Save the account, encrypted string, and authorization duration to the offline login user table.

2. The management method according to claim 1, characterized in that, Obtaining the quantum state salt value includes: Determine if the user has defined a custom salt value; When determining whether a user-defined salt value is required, the user-defined salt value should be used. If the user has not defined a salt value, generate a 6-byte hardware-level true random number. Convert the random number into a 6-bit printable character as a salt value.

3. The management method according to claim 2, characterized in that, Iterate through the character bytes of each of the byte arrays and encrypt them to obtain an encrypted byte array, including: The current salt value character is obtained according to formula (1). ，（1） Calculate the phase angle according to formula (2). ，（2） The offset is calculated according to formula (3). ，（3） Obtain the offset bytes according to formula (4). ，（4） Obtain the conjugate key according to formula (5). ，（5） Obtain the encrypted bytes according to formula (6). ，（6） in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the plaintext byte array. This is the offset. The offset bytes, For plaintext byte values, For conjugate keys, For encrypted bytes.

4. The management method according to claim 1, characterized in that, The management method also includes: If it is determined that the user is not logging into the system for the first time, obtain the network connection status; Determine whether the connection status is normal; If the connection status is determined to be normal, the online login mode is activated for login authentication. If the connection status is determined to be abnormal, offline login mode is activated for login authentication. Hierarchical authorization management is implemented based on online / offline login mode and user level information.

5. The management method according to claim 4, characterized in that, To initiate online login authentication, the following steps are required: Obtain user registration information data; The registration information data is parsed to obtain the registration type, duration, product information, product serial number, and product deployment information; The authorization process confirms whether authorization is granted and the level of authorization.

6. The management method according to claim 5, characterized in that, The authorization process confirms whether authorization is granted and the level of authorization, including: Determine whether the parsed product serial number matches the product serial number of the currently requested login software; If the parsed product serial number matches the product serial number of the currently requested login software, the deployment address time zone is obtained based on the parsed product deployment information; Determine whether the time zone of the deployment address is consistent with the time zone of the currently requested login software; If the time zone of the deployment address is consistent with the time zone of the currently requested login software, determine whether the login time exceeds the parsed time limit; If the login time does not exceed the parsed time limit, authorization is granted.

7. The management method according to claim 4, characterized in that, To enable offline login mode for login authentication, the following steps are required: Obtain the user's account information file; Based on the account information, obtain the corresponding encrypted string from the offline login user table; Decrypt the encrypted string to obtain the decoded user information; Add the decoded user information to the legitimate user set; Match the user to be logged in and their password in the collection of legitimate users. Based on the matching results of the collection of legitimate users and the matching results of the dynamic code, confirm whether authorization is granted and the level of authorization.

8. The management method according to claim 7, characterized in that, Decrypting the encrypted string to obtain the decoded user information includes: The first 6 bytes of the encrypted string are used as the salt byte array, and the remaining bytes are used as the ciphertext byte array. The total length of the ciphertext byte array is recorded. Iterate through each ciphertext byte and decrypt it to obtain the plaintext byte; Convert the plaintext into a string.

9. The management method according to claim 8, characterized in that, Iterate through each of the ciphertext bytes to decrypt them and obtain the plaintext bytes, including: The current salt value character is obtained according to formula (7). ，（7） Obtain the conjugate key according to formula (8). ，（8） Calculate the offset bytes according to formula (9). ，（9） Calculate the phase angle according to formula (10). ，（10） The offset is calculated according to formula (11). ，（11） Obtain the plaintext bytes according to formula (12). ，（12） in, The current salt value character. It is a salt value byte array. For location index, For modulo operation, The phase angle, The length of the ciphertext byte array. This is the offset. The offset bytes, The ciphertext byte value, For conjugate keys, These are plaintext bytes.

10. The management method according to claim 1, characterized in that, Generate and save dynamic code, including: Calculate the hash value according to formula (13). ，（13） in, For hash value, For hash algorithms, For the key, For time counting; Take the lower 4 bits of the last byte of the hash value as the offset value; Starting with the offset value as the index, extract four consecutive bytes from the hash value to obtain the corresponding integer; The integer is moduloed to obtain the dynamic code.

Images