TWI746504B - Method and device for realizing synchronization of session identification - Google Patents

Abstract

The present invention provides a method and device for realizing session identification synchronization. The method includes: initiating a first request to log in an application program to a server, the first request carries a first session identification, and the first session identification is the login account of the application program Generated from the original password, the original password is the login password before the modification corresponding to the login account; if the server determines that the first session ID is invalid, it verifies the legality of the terminal user, and sends the obtained verification result to the server. For the server to verify the verification result; if the server passes the verification result, the second session ID from the server is received and saved to the terminal. The second session ID is generated by the login account and the new password, and the new password is the login account The corresponding modified login password. The technical solution of the present invention can prevent the user who uses the terminal from re-entering a new password to log in to the application, and greatly improves the user's experience in logging in to the application.

Description

Method and device for realizing synchronization of session identification

The present invention relates to the field of network security technology, in particular to a method and device for realizing session identification synchronization.

With the continuous development of embedded technology and terminal technology, more and more terminal devices are applied to people's daily work and life. The applications installed on the terminal devices are also designed in multiple versions to be suitable for different operating systems, such as Windows, Linux, Android, iOS, etc. When users use their own accounts to access applications on different terminal devices, they will face the problem of account authentication. In order to prevent users from repeatedly entering authentication information, many applications have added the function of remembering passwords. However, when the same user resets the password of the application on one of the terminal devices, when the user needs to log in to the application through other terminal devices, the passwords previously recorded by the other terminal devices are no longer valid, and the user needs to enter the application The new password for the program. In some situations, it is not convenient for users to input new passwords through other terminal devices. For example, for users who are doing other tasks, inputting new passwords through terminal devices while their hands are occupied will bring about safety in production. Certain risks.

In view of this, the present invention provides a new technical solution, which can enable users to log in to applications in other terminals without re-entering a new password and ensure the security of logging in to applications.

In order to achieve the above objective, the present invention provides technical solutions as follows: According to the first aspect of the present invention, a method for realizing password synchronization is proposed, which includes: initiating a first request to a server to log in to an application, and the first request carries There is a first session identifier, the first session identifier is generated by the login account and the original password of the application program, and the original password is the login password before modification corresponding to the login account; if the server determines that all If the first session identifier is invalid, the user of the terminal is verified for legality, and the obtained verification result is sent to the server for the server to verify the verification result; if the server Server verification through the verification result, receives a second session identifier from the server and saves it to the terminal, the second session identifier is generated by the login account and a new password, and the new password is the The modified login password corresponding to the login account.

According to a second aspect of the present invention, a method for implementing password synchronization is proposed, which includes: when a terminal initiates a first request to log in to an application, verifying the validity of the first session identifier carried in the first request, The first session identifier is generated by the login account and original password of the application, and the original password is the login password before modification corresponding to the login account; if the verification of the first session identifier is invalid, instruct the The terminal performs legality verification on the user of the terminal; receives the verification result of the legality verification of the user from the terminal; if the server verifies the verification result, the second session identifier is sent To the terminal, the second session identifier is generated by the login account and a new password, and the new password is a modified login password corresponding to the login account.

According to the third party aspect of the present invention, a device for realizing password synchronization is proposed, which includes: a first sending module for initiating a first request for logging in an application to a server, and the first request carries the first session ID, the first session ID is generated by the login account and original password of the application, and the original password is the login password before modification corresponding to the login account; the first authentication module is used for The server determines that the first session identifier sent by the first sending module is invalid, performs legality verification on the user of the terminal, and sends the obtained verification result to the server for the server Verify the verification result; the first receiving module is configured to receive the second session identifier from the server if the server verifies the verification result obtained by the first verification module and Saved to the terminal, the second session identifier is generated by the login account and a new password, and the new password is a modified login password corresponding to the login account.

According to the fourth aspect of the present invention, a device for realizing password synchronization is proposed, including: a second verification module, which is used to respond to the first request carried in the first request when the terminal initiates the first request to log in to the application program. The validity of the session identifier is verified. The first session identifier is generated by the login account and original password of the application program, and the original password is the login password before modification corresponding to the login account; the instruction module uses If the second verification module verifies that the first session identifier verification is invalid, instruct the terminal to verify the validity of the user of the terminal; and the third receiving module is configured to receive instructions from the terminal The verification result of the legality verification of the user indicated by the module; the third sending module is used to send the second verification result if the server verifies the verification result received by the third receiving module The session identifier is sent to the terminal, the second session identifier is generated by the login account and a new password, and the new password is a modified login password corresponding to the login account.

It can be seen from the above technical solutions that the present invention can enable the user to log in to the application through the second session identifier, avoid the user who uses the terminal to re-enter a new password to log in to the application, and greatly improve the user’s experience of logging in to the application; After the user needs to reset the login password of the application, by verifying the user's legitimacy on the terminal side, the server's load on verifying the user's legitimacy can be reduced and the server's resource waste can be avoided.

101‧‧‧Step

102‧‧‧Step

103‧‧‧Step

104‧‧‧Step

105‧‧‧Step

106‧‧‧Step

107‧‧‧Step

201‧‧‧Step

202‧‧‧Step

203‧‧‧Step

301‧‧‧Step

302‧‧‧Step

311‧‧‧Step

312‧‧‧Step

313‧‧‧Step

314‧‧‧Step

401‧‧‧Step

402‧‧‧Step

403‧‧‧Step

404‧‧‧Step

501‧‧‧Step

502‧‧‧Step

503‧‧‧Step

601‧‧‧Step

602‧‧‧Step

603‧‧‧Step

604‧‧‧Step

701‧‧‧Step

702‧‧‧Step

801‧‧‧Step

802‧‧‧step

803‧‧‧Step

111‧‧‧First sending module

112‧‧‧First verification module

113‧‧‧First receiving module

1121‧‧‧Feature Collection Unit

1122‧‧‧Authentication Unit

1123‧‧‧Reminder unit

114‧‧‧First Generation Module

115‧‧‧The first encryption module

116‧‧‧Second Generation Module

117‧‧‧Second sending module

118‧‧‧Second receiving module

119‧‧‧First decryption module

120‧‧‧First Confirmation Module

121‧‧‧Second Confirmation Module

122‧‧‧Reminder Module

131‧‧‧Second verification module

132‧‧‧Indicating Module

133‧‧‧Third receiving module

134‧‧‧Third Sending Module

135‧‧‧Second decryption module

136‧‧‧The third verification module

137‧‧‧Third Generation Module

138‧‧‧Second Encryption Module

139‧‧‧Fourth Sending Module

140‧‧‧Third Confirmation Module

141‧‧‧The first control module

142‧‧‧Second control module

Fig. 1 is a schematic flow chart of modifying the login password of an application program through a first terminal; Fig. 2 is a schematic flow chart of a method for realizing session identification synchronization according to an exemplary embodiment of the present invention; Fig. 3A is a schematic diagram of a method according to the present invention An exemplary embodiment 2 shows a schematic flowchart of a method for implementing session identification synchronization; FIG. 3B is a flowchart of how to synchronize keys between a terminal and a server in FIG. 3A; FIG. 4 is an exemplary method according to the present invention Embodiment 3 shows a schematic flow diagram of the method for achieving session identification synchronization; FIG. 5 is a flow diagram of the method for achieving session identification synchronization shown according to an exemplary embodiment of the present invention; FIG. 6 is another flow diagram according to the present invention. A schematic flowchart of a method for implementing session identification synchronization shown in an exemplary embodiment; FIG. 7 is a schematic flowchart of a method for implementing session identification synchronization shown in another exemplary embodiment of the present invention; FIG. Another exemplary embodiment 3 of the present invention shows a schematic flowchart of a method for implementing session identification synchronization; FIG. 9 shows a schematic structural diagram of a terminal according to an exemplary embodiment of the present invention; A schematic structural diagram of a server according to an exemplary embodiment of the present invention; Fig. 11 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment 1 of the present invention; Fig. 12 shows a schematic diagram of a device according to the present invention A schematic structural diagram of an apparatus for realizing session identification synchronization according to exemplary embodiment two; FIG. 13 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment 3 of the present invention; FIG. 14 shows a schematic diagram according to the present invention A schematic structural diagram of an apparatus for realizing session identification synchronization in an exemplary embodiment 4 of FIG.

The exemplary embodiments will be described in detail here, and examples thereof are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present invention. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the scope of the appended application.

The terms used in the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms of "a", "said" and "the" used in the scope of the present invention and the appended applications are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" as used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information can also be referred to as second information, and similarly, the second information can also be referred to as first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to certainty".

Figure 1 is a schematic diagram of the process of modifying the login password of the application through the first terminal; where the first terminal and the second terminal both use the password-remembering function before modifying the original password to avoid paying attention to the application each time they log in to the application. You need to enter the login password. If the user modifies the original password of the application through the first terminal, because the login password has been modified, the second terminal still uses the recorded original password to log in to the application and the login fails, as shown in Figure 1, including The steps are as follows: In step 101, the first terminal initiates a password modification request to the server, and submits the information required to modify the password to the server, for example, login account, original password, new password, etc.

In step 102, the server verifies the submitted information to verify whether the original password is correct. If the original password is incorrect, perform step 101 again, prompting the user to re-initiate a password modification request to the server through the first terminal; for example, the original password If correct, go to step 103.

In step 103, the server stores the new password in the background database, generates a new session identifier according to the login account and the new password, and sets the original session identifier generated according to the login account and the original password to be invalid.

Step 104: Return the new session identifier to the first terminal.

In step 105, the first terminal receives the new session identifier returned by the server, stores the new session identifier in the local secure space of the first terminal, and completes the process of modifying the password of the application program of the first terminal.

In step 106, after the server changes the password, the second terminal initiates a login request to the server through the original session ID, where the second terminal records the original session ID in the first session by remembering the password after logging in to the application for the first time. On the second terminal.

In step 107, the server verifies the original session ID of the second terminal, confirms that the original session ID used is invalid, and feeds back a password re-input request to the second terminal. In this case, the second terminal needs to re-enter the password to modify the ID. After the new password, when the user's hands are occupied, entering the new password through the second terminal will bring certain security risks.

In view of this, the present invention can use the following embodiments to modify the login password at the first terminal, and the second terminal does not need to enter a new login password to log in to the server, thereby solving the need for users to pass through the second terminal in the prior art. When logging in to an application, re-enter the new password to log in to the server that provides the application.

In order to further explain the present invention, the following embodiments are provided: FIG. 2 is a schematic flowchart of a method for realizing session identification synchronization according to an exemplary embodiment 1 of the present invention; the terminal applied by the method is the terminal shown in FIG. 1 above. The second terminal, as shown in FIG. 2, includes the following steps: Step 201, initiating a first request to the server to log in to the application, the first request carries a first session identifier, and the first session identifier is the login account of the application Generated from the original password, the original password is the login password before modification corresponding to the login account; in one embodiment, the terminal may directly send the first session identification corresponding to the server by recording the login password when logging in to the application for the first time The character string of can be recorded locally on the first terminal by recording the first session identifier. When the terminal logs in to the application program again, it logs in to the application program by means of the recorded first session identifier, so that the user can avoid the operation of re-entering the login password. In an embodiment, the method for generating the first session identifier can be determined by the server side, and the first session identifier can be generated according to the user's login account and original password through a hash algorithm such as md5 and sha1, for example, according to the login account The original passwords are zhangxiao and zx098, and the login time stamp is 20151026. The MD4 algorithm is performed on the above login account, original password, and time stamp through the md5 algorithm to obtain the first session identifier 3EC3E3D381B9CF4359F4C1CB02CDF64.

Step 202: If the server determines that the first session identifier is invalid, it verifies the validity of the terminal user, and sends the obtained verification result to the server for the server to verify the verification result; in one embodiment, The legality verification can be performed through the biological characteristics of the user of the terminal, for example, the local legality verification on the terminal side is performed on the user through the biological characteristics of the user's fingerprint, iris, and face. In an embodiment, before the terminal sends the verification result to the server, the verification result and the random number corresponding to the verification result may be encrypted by the server's symmetric key, and the encrypted verification result may be sent to the server. This ensures that the verification result will not be tampered with after being illegally intercepted during the transmission process, and the security of the verification result transmission between the terminal and the server is ensured.

Step 203: If the server passes the verification result, the second session identifier from the server is received and saved to the terminal. The second session identifier is generated by the login account and the new password, and the new password is the modified login password corresponding to the login account. .

In one embodiment, in order to prevent the second session identifier from being intercepted and tampered with by unauthorized users during the transmission process, the public key of the terminal may be used to encrypt the second session identifier. After the terminal receives the encrypted second session identifier, The encrypted second session identifier is decrypted by the private key of the terminal, thereby obtaining the second session identifier. In one embodiment, the method for generating the second session identifier can be obtained by referring to the method for generating the first session identifier. For example, when the user changes the login password to zhangxiao through the first terminal of the embodiment shown in FIG. , Through the same hash operation as the above-mentioned first session identifier, the second session identifier 2EF430338DF56A6FE40819CBF75982A9 can be obtained.

Through the above steps 201 to 203, the user can log in to the application through the second session ID, avoiding the user who uses the terminal to re-enter a new password to log in to the application, which greatly improves the user’s experience of logging in to the application; After the user needs to reset the login password of the application, by verifying the user's legitimacy on the terminal side, the server's load on verifying the user's legitimacy can be reduced and the server's resource waste can be avoided.

Fig. 3A is a schematic flowchart of a method for implementing session identification synchronization according to an exemplary embodiment 2 of the present invention. Fig. 3B is a flowchart of how to synchronize a key between a terminal and a server in Fig. 3A; Fig. 3A As shown, it includes the following steps: Step 301, generating random numbers of the verification string corresponding to the verification result through a hashing algorithm; in one embodiment, the terminal and the server can agree on the same hashing algorithm to ensure that the terminal And the server can generate the same random number according to the hashing algorithm. In an embodiment, the verification string in the verification result may be, for example, "001" and "000", where "001" indicates that the verification is passed, and "000" indicates that the verification is not passed.

Step 302: Encrypt the verification string and the random number by the symmetric key of the server to obtain the encrypted verification result.

In one embodiment, how the terminal obtains the symmetric secret key of the server, please refer to the process shown in FIG. 3B. As shown in FIG. 3B, the key synchronization between the server and the terminal includes the following steps: Step 311, the public key and the private key of the terminal are generated according to the asymmetric encryption algorithm; in one embodiment, the asymmetric encryption algorithm may be, for example, RSA, knapsack algorithm, Elgamal, DH, elliptic curve encryption algorithm (ECC), etc., this embodiment does not limit the asymmetric encryption algorithm, as long as the key pair of the public key and the private key can be generated according to the asymmetric encryption algorithm Can.

Step 312, send the public key of the terminal to the server; Step 313, receive the server’s symmetric key encrypted by the terminal’s public key; in one embodiment, the server generates its symmetric key, and the terminal The public key encrypts its symmetric key, and sends the encrypted symmetric key to the terminal. In addition, the server can also encrypt and store the modified new password with a symmetric key, so as to prevent the user from leaking the modified new password through the first terminal shown in FIG. 1.

Step 314: Decrypt the encrypted symmetric key using the private key of the terminal to obtain the symmetric key of the server.

Through the above steps 311-314, the server can obtain the public key of the terminal, and the terminal can obtain the symmetric key of the server, which realizes the key synchronization process between the symmetric key of the server and the private key of the terminal.

In this embodiment, the confidentiality of the verification result can be ensured by the symmetric encryption technology, and the verification result can be prevented from being tampered with by unauthorized users, and the encrypted data can be prevented from being replayed and utilized by random numbers.

FIG. 4 is a schematic flowchart of a method for realizing session identification synchronization according to an exemplary embodiment 3 of the present invention; this embodiment uses how the terminal performs local legality verification on the user as an example to illustrate, as shown in FIG. 4 As shown, it includes the following steps: Step 401, collect the biometric characteristics of the terminal user through the biosensor on the login interface of the application; in one embodiment, the biometric characteristics may be the user's fingerprint, iris, face, etc. Biological characteristics. If the biometric feature is a fingerprint, the user's fingerprint can be obtained from the current login interface of the application, which prevents the user from having to log out of the login interface currently presented by the application, and realizes the direct fingerprint recognition operation on the login interface, which simplifies Steps to verify the user's local legality.

Step 402, perform biometric authentication, whether the authentication is passed, if the biometric authentication is passed, go to step 403, if the biometric authentication is not passed, go to step 404; step 403, if the biometric authentication is passed, determine that the terminal user is legitimate User: In an embodiment, the authentication of biometrics can refer to related descriptions in the prior art, which will not be described in detail in this embodiment.

In step 404, if the biometric authentication fails, the login interface of the application is prompted to log in to the application with a login account and a login password.

In this embodiment, when a large number of users of the same application reset the login password through one of the terminals and log in to the application through other terminals, this embodiment can optimize the load on the server side through the terminal's local identity authentication mechanism. , To prevent attackers from carrying out distributed denial of service (DDOS) attacks on the server.

Fig. 5 is a schematic flowchart of a method for implementing session identification synchronization according to an exemplary embodiment 4 of the present invention; after the terminal obtains and saves the second session identification through the above-mentioned embodiment, the server ensures that the user logs in Security, the validity period of the second session identifier can be set, so that the period of time for the user to log in to the application is restricted by the validity period of the second session identifier, as shown in Figure 5, including the following steps: Step 501, determine whether the second session identifier Within the validity period, if the second session ID is within the validity period, go to step 502, if the second session ID has exceeded the validity period, go to step 503; step 502, if the second session ID is within the validity period, pass the second session Identify the login application; step 503, if the second session identifier has exceeded the validity period, the user is prompted to log in to the application with the login account and the valid login password of the login account.

In one embodiment, the expiration date can be obtained from the server. For example, the user resets the new password through the first terminal, and the time when the server generates the second session identifier through the new password is October 10, 2015. At 12 minutes, the validity period is one month. The terminal can obtain the generation time and validity period of the second session identifier from the server, so as to determine whether the user can directly log in to the application through the second session identifier according to the second session identifier , If the second session ID has exceeded 1 month, you can prompt the user to log in to the application with the login account and the valid login password of the login account on the login interface of the application.

In this embodiment, the user's login behavior is restricted by setting the validity period of the second session identifier, thereby preventing illegal users from logging in to the application after obtaining the second session identifier, and ensuring the security of the user logging in to the application.

FIG. 6 is a schematic flowchart of a method for realizing session identification synchronization according to another exemplary embodiment 1 of the present invention; in order to be consistent with the description of the embodiment shown in FIG. 1, the method is applied on a server as an example For an exemplary description, as shown in FIG. 6, it includes the following steps: Step 601, when the terminal initiates a first request to log in to the application, the validity of the first session identifier carried in the first request is verified, and the first session The identifier is generated by the login account of the application and the original password, and the original password is the login password before modification corresponding to the login account; in one embodiment, the first session identifier may be compared with the valid session identifier stored in the server If the first session identifier is the same as the stored valid session identifier, it is determined that the first session identifier is valid, and if the first session identifier is not the same as the stored valid session identifier, it is determined that the first session identifier is invalid.

Step 602: If the verification of the first session identifier is invalid, instruct the terminal to verify the legality of the user of the terminal; in one embodiment, the method for the user of the terminal to verify the legality can refer to the relevant description of the above-mentioned embodiment, here No more details.

Step 603: Receive the verification result of the user's legality verification from the terminal; in one embodiment, if the terminal sends the verification result to the server, the verification result and the verification result corresponding to the verification result are paired by the server's symmetric key. The random number is encrypted, and the encrypted verification result is sent to the server. At this time, the server also needs to use the symmetric key to perform the result of the encrypted verification result.

Step 604: If the server passes the verification result, the second session identifier is sent to the terminal. The second session identifier is generated by the login account and the new password, and the new password is the modified login password corresponding to the login account.

Through the above steps 601-604, a legal user can log in to the server, and the legal user can obtain the second session ID, which prevents the legal user from re-entering the new password to log in to the application when using the terminal, which greatly improves This improves the user’s experience of logging in to the application; when a large number of users need to reset the application’s login password, by instructing the terminal to verify the user’s legitimacy, the server’s load on verifying the user’s legitimacy can be reduced and avoided The server's resources are wasted.

FIG. 7 is a schematic flowchart of a method for realizing session identification synchronization according to another exemplary embodiment 2 of the present invention; as shown in FIG. 7, it includes the following steps: Step 701, if the terminal has already used the symmetric key of the server The verification result is encrypted, and the encrypted verification result is decrypted by the server's symmetric key to obtain the verification string and random number corresponding to the verification result; step 702, verify the verification string and random number, if the verification is verified The string and random number are verified, and the second session identifier is sent to the terminal.

In an embodiment, the terminal and the server can agree on the same hash algorithm, so that it can be ensured that the terminal and the server can generate the same random number according to the hash algorithm, and then double-verify the verification result through the random number. In an embodiment, the verification string in the verification result may be, for example, "001" and "000", where "001" indicates that the verification is passed, and "000" indicates that the verification is not passed. In an embodiment, the second session identifier may be encrypted by the public key of the terminal, so as to ensure the security of the second session identifier during the transmission process.

Regarding how the terminal obtains the symmetric secret key of the server and how the server obtains the public key of the terminal, please refer to the description of FIG. 3B above, which will not be described in detail here.

In this embodiment, symmetric encryption technology can ensure the confidentiality of the verification result, prevent the verification result from being tampered with by unauthorized users, and prevent the encrypted data from being replayed and used by random numbers.

FIG. 8 is a schematic flowchart of a method for realizing session identifier synchronization according to another exemplary embodiment 3 of the present invention; after the server generates and saves the second session identifier through the above-mentioned embodiment, the server ensures that the user logs in For security, the validity period of the second session identifier can be set, so as to limit the period of time for the user to log in to the application through the validity period of the second session identifier. Within the validity period, if the second session ID is within the validity period, go to step 802, if the second session ID has exceeded the validity period, go to step 803; step 802, if the second session ID is within the validity period, allow the user Log in to the application through the second session identifier; step 803, if the second session identifier has exceeded the validity period, prohibit the user from logging in to the application through the second session identifier.

In one embodiment, the server may determine the validity period of the second session identifier according to the period set by the user. For example, the user resets the new password through the first terminal and the validity period is one month, and the server passes the new The password generated the second session ID at 12:12, October 10, 2015. The server can determine the validity period of the second session ID until 12:12, November 10, 2015. When the user can Directly log in to the application through the second session identifier, and when the time limit expires, the user may be prohibited from logging in to the application through the second session identifier.

In this embodiment, the user's login behavior is restricted by setting the validity period of the second session identifier, thereby preventing illegal users from illegally logging in to the application after obtaining the second session identifier, and ensuring the security of the user's login to the application.

As an exemplary scenario, after the user resets the login password of the application through the mobile phone, if the user logs in the application through the vehicle-mounted terminal, the vehicle-mounted terminal has recorded the invalid first session before the user resets the login password ID. Since the server has set the first session ID to be invalid, the user cannot log in to the application through the vehicle-mounted terminal. Because the user is driving, it is not convenient for the user to enter a new password at this time. Perform biometric verification on the user. When it is determined that the user is a legal user of the vehicle-mounted terminal, the second session identifier can be obtained from the server through the vehicle-mounted terminal, and then the application can be logged in through the second session identifier, which can reduce the number of users Risks during driving.

Corresponding to the foregoing method for realizing session identification synchronization, the present invention also proposes a schematic structural diagram of a terminal according to an exemplary embodiment of the present invention shown in FIG. 9. Please refer to Figure 9. At the hardware level, the terminal includes a processor, internal bus, network interface, memory, and non-volatile memory. Of course, it may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory to the memory and then runs it to form a device that realizes the synchronization of the session identification on the logical level. Of course, in addition to the software implementation, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution body of the following processing flow is not limited to each logic unit, and can also Is a hardware or logic device.

Corresponding to the foregoing method for realizing session identification synchronization, the present invention also proposes a schematic structural diagram of a server according to an exemplary embodiment of the present invention shown in FIG. 10. Please refer to Figure 10. At the hardware level, the server includes a processor, internal bus, network interface, memory, and non-volatile memory, and of course, it may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory to the memory and then runs it to form a device that realizes the synchronization of the session identification on the logical level. Of course, in addition to the software implementation, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc. That is to say, the execution body of the following processing flow is not limited to each logic unit, and can also Is a hardware or logic device.

FIG. 11 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment of the present invention; as shown in FIG. 11, the apparatus for realizing session identification synchronization may include: a first sending module 111, a first sending module 111, and a first sending module 111; A verification module 112 and a first receiving module 113. Among them: the first sending module 111 is used to initiate a first request to the server to log in to the application, the first request carries a first session identifier, and the first session identifier is generated by the login account and original password of the application, The original password is the login password before modification corresponding to the login account; the first verification module 112 is used to verify the legality of the terminal user if the server determines that the first session identifier sent by the first sending module 111 is invalid, Send the obtained verification result to the server for the server to verify the verification result; the first receiving module 113 is used to receive the verification result from the server if the server verifies the verification result obtained by the first verification module 112 And save the second session identifier to the terminal. The second session identifier is generated by the login account and the new password, and the new password is the modified login password corresponding to the login account.

FIG. 12 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment 2 of the present invention; as shown in FIG. 12, based on the embodiment shown in FIG. 11, in an embodiment, The device may further include: a first generation module 114, configured to generate random numbers of the verification string corresponding to the verification result obtained by the first verification module 112 through a hash algorithm; and a first encryption module 115, configured to pass the server The symmetric key of the processor encrypts the verification string obtained by the first verification module 112 and the random number generated by the first generation module 114 to obtain an encrypted verification result.

In an embodiment, the device may further include: a second generation module 116, configured to generate the public key and private key of the terminal according to the asymmetric encryption algorithm; and the second sending module 117, configured to convert the second generation module The public key of the terminal generated by 116 is sent to the server; the second receiving module 118 is used to receive the symmetric key of the server whose public key of the terminal has been encrypted by the server through the second sending module 117; the first decryption The module 119 is used to decrypt the encrypted symmetric key by the private key of the terminal generated by the second generation module 118 to obtain the symmetric key of the server.

In an embodiment, the first verification module 112 may include: a feature collection unit 1121, configured to collect the biometric features of the terminal user through the biosensor on the login interface of the application; the certification unit 1122, configured to check the feature The biometrics collected by the collection unit 1121 are authenticated; the first determining unit is used to determine that the user of the terminal is a legitimate user if the biometrics are authenticated by the authentication unit 1122; the prompt unit 1123 is used to verify that the biometrics are not authenticated by the authentication unit 1122 Pass, the application login interface prompts to log in to the application through the login account and login password.

In an embodiment, the device may further include: a first determining module 120, configured to determine whether the second session identifier received by the first receiving module 113 is within the validity period; and a second determining module 121, configured to determine whether The first determining module 120 determines that the second session identifier is within the valid period, and determines to log in to the application through the second session identifier; the prompt module 122 is used for if the first determining module 120 determines that the second session identifier has exceeded the valid period , Prompt the user to log in to the application with the login account and the valid login password of the login account.

FIG. 13 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment 3 of the present invention; as shown in FIG. 13, the apparatus for realizing session identification synchronization may include: a second verification module 131, an indication module Group 132, third receiving module 133, and third sending module 134. Wherein: the second verification module 131 is used to verify the validity of the first session identifier carried in the first request when the terminal initiates the first request to log in to the application, and the first session identifier is the login account of the application Generated from the original password, the original password is the login password before modification corresponding to the login account; the indicating module 132 is used for instructing the terminal to legalize the terminal user if the second verification module 131 verifies that the first session ID verification is invalid The third receiving module 133 is used to receive the verification result of the user’s legality verification indicated by the instruction module 132 from the terminal; the third sending module 134 is used to verify if the server passes the third receiving The verification result received by the module 133 sends the second session identifier to the terminal. The second session identifier is generated by the login account and the new password, and the new password is the modified login password corresponding to the login account.

FIG. 14 shows a schematic structural diagram of an apparatus for realizing session identification synchronization according to an exemplary embodiment 4 of the present invention; as shown in FIG. 14, on the basis of the embodiment shown in FIG. 13, in an embodiment, The device may further include: a second decryption module 135, configured to encrypt the verification result received by the third receiving module 133 by the symmetric key of the server if the terminal has already used the symmetric key of the server to encrypt the encrypted The verification result is decrypted to obtain the verification string and random number corresponding to the verification result; the third verification module 136 is used to verify the verification string and random number decrypted by the second decryption module 135, if the verification string is If the random number verification is passed, the third sending module 134 executes the step of sending the second session identifier to the terminal.

In one embodiment, the device may further include: a third generation module 137, configured to generate the symmetric key of the server according to the symmetric encryption algorithm, so that the second decryption module 135 can pass the symmetric key pair of the server The encrypted verification result is decrypted; the second encryption module 138 is used to cipher the symmetric key generated by the third generation module 137 with the public key of the terminal; the fourth sending module 139 is used to transfer the second The symmetric key encrypted by the encryption module 138 is sent to the terminal, so that the terminal can decrypt the encrypted symmetric key with the private key corresponding to the public key to obtain the symmetric key of the server.

In an embodiment, the device may further include: a third determining module 140, configured to determine whether the second session identifier sent by the third sending module 134 is within the valid period; a first control module 141, configured to determine whether the second session identifier The third determination module 140 determines that the second session identifier is within the validity period, and allows the user to log in to the application through the second session identifier; the second control module 142 is used for if the third determination module 140 determines that the second session identifier has exceeded During the valid period, the user is prohibited from logging in to the application through the second session ID. The above embodiment shows that when the user changes the login password of the application at the first terminal, the user can log in to the application through the second terminal. When logging in to the application in a second terminal that is different from the first terminal, the user avoids entering the modified login password to log in to the application, thereby improving the user experience and ensuring the security of login.

Those with ordinary knowledge in the technical field will easily think of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptive changes of the present invention. These variations, uses, or adaptive changes follow the general principles of the present invention and include common knowledge or conventional technical means in the technical field not disclosed by the present invention. . The specification and embodiments are only regarded as exemplary, and the true scope and spirit of the present invention are pointed out by the following patent application scope.

It should also be noted that the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or equipment including a series of elements not only includes those elements, but also includes Other elements that are not explicitly listed, or include elements inherent to such processes, methods, commodities, or equipment. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, commodity, or equipment that includes the element.

The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the present invention Within the scope of protection.

Claims (14)

A method for realizing session identification synchronization when a password is reset, applied on a terminal, the method comprising: initiating a first request for logging in an application to a server, the first request carrying a first session identification, the The first session identifier is generated by the login account of the application and the original password; when the original password has been modified to a new password for the login account of the application: use of the terminal If the server verifies the verification result, it will receive the verification result from the server if the server verifies the verification result. And save the second session identifier of the device to the terminal. The second session identifier is different from the first session identifier and is generated by the login account and the new password; it is determined whether the second session identifier is in Within the valid period; if the second session identifier is within the valid period, it is determined to log in to the application through the second session identifier; and if the second session identifier has exceeded the valid period, prompting The user logs in the application program through the login account and the valid login password of the login account. The method according to item 1 of the scope of patent application, wherein the method further comprises: generating a verification string corresponding to the verification result through a hash algorithm Random number; encrypt the verification string and the random number by the symmetric key of the server to obtain the encrypted verification result. The method according to item 2 of the scope of patent application, wherein the method further comprises: generating the public key and the private key of the terminal according to an asymmetric encryption algorithm; and sending the public key of the terminal to the server ; Receive the server's symmetric key that has been encrypted by the server through the terminal’s public key; decrypt the encrypted symmetric key through the terminal’s private key to obtain the server’s Symmetric key. The method according to item 1 of the scope of the patent application, wherein the legal verification of the user of the terminal includes: collecting the user of the terminal through a biosensor on the login interface of the application The biometrics; authenticate the biometrics; if the biometric authentication passes, determine that the user of the terminal is a legitimate user; if the biometric authentication fails, prompt on the login interface of the application Log in to the application through the login account and the new password. A method for realizing session identification synchronization when a password is reset is applied on a server, and the method includes: when a terminal initiates a first request to log in to an application, sending a request to the first The validity of the first session identifier carried in the request is verified. The first session identifier is generated by the login account and original password of the application; when the original password has been modified to be used to log in to the application When the new password of the login account is: instruct the terminal to verify the legality of the user of the terminal; receive the verification result of the legality verification of the user from the terminal; if the server After the verification passes the verification result, a second session identifier is sent to the terminal, where the second session identifier is different from the first session identifier and is generated for the login account and the new password; determining the first session identifier 2. Whether the session identifier is within the valid period; if the second session identifier is within the valid period, allow the user to log in to the application through the second session identifier; and if the second session identifier has Within the validity period, the user is prohibited from logging in to the application program through the second session identifier. The method according to item 5 of the scope of patent application, wherein the method further includes: if the terminal has already used the server's symmetric key to encrypt the verification result, using the server's symmetric encryption key to encrypt the verification result The key decrypts the encrypted verification result to obtain the verification string and random number corresponding to the verification result; verify the verification string and the random number, if the verification string and the random number are verified After the random number verification is passed, execute the sending of the second session identifier The step of sending to the terminal. The method according to item 6 of the scope of patent application, wherein the method further comprises: generating a symmetric key of the server according to a symmetric encryption algorithm; and encrypting the symmetric key through the public key of the terminal Key cryptography; sending the encrypted symmetric key to the terminal, so that the terminal can decrypt the encrypted symmetric key through the private key corresponding to the public key to obtain the server Symmetric key. A device for realizing session identification synchronization when a password is reset, applied on a terminal, the device comprising: a first sending module for initiating a first request for logging in an application program to a server, and the first request carries There is a first session identifier, the first session identifier is generated by the login account of the application and the original password; a first verification module; and a first receiving module; wherein, when the original password has been modified to When the new password of the login account used to log in the application: the first verification module is used to verify the legality of the user of the terminal, and send the obtained verification result to the server , For the server to verify the verification result; the first receiving module is configured to receive the verification result from the first verification module if the server verifies the verification result obtained by the first verification module The second session identifier of the server is saved to the terminal, and the second session The identifier is different from the first session identifier and is generated for the login account and the new password; wherein, the device further includes: a first determining module, configured to determine the information received by the first receiving module Whether the second session identifier is within the valid period; a second determining module is configured to determine whether the second session identifier is passed if the first determining module determines that the second session identifier is within the valid period Log in to the application; and a prompt module for prompting the user to pass the login account and the login account if the first determination module determines that the second session identifier has exceeded the validity period Log in to the application with a valid login password. The device according to item 8 of the scope of patent application, wherein the device further includes: a first generation module for generating a verification corresponding to the verification result obtained by the first verification module through a hash algorithm Random number of the character string; a first encryption module for the verification character string obtained by the first verification module and the first generation module generated by the symmetric key of the server The random number is encrypted, and the encrypted verification result is obtained. The device according to item 9 of the scope of patent application, wherein the device further includes: a second generation module for generating the public key and private key of the terminal according to an asymmetric encryption algorithm; and a second sending module , Used to generate the second generation module The public key of the terminal is sent to the server; the second receiving module is used to receive the symmetric secret of the server whose public key of the terminal has been encrypted and sent by the server through the second sending module The first decryption module is used to decrypt the encrypted symmetric key by the private key of the terminal generated by the second generation module to obtain the symmetric key of the server. The device according to item 8 of the scope of patent application, wherein the first verification module includes: a feature collection unit configured to collect information of the user of the terminal through a biosensor on the login interface of the application program Biometrics; an authentication unit for authenticating the biometrics collected by the feature collection unit; a first determining unit for determining that the user of the terminal is if the biometrics are authenticated by the authentication unit A legitimate user; a prompt unit, configured to prompt the login interface of the application program to log in the application program through the login account number and the new password if the authentication unit fails to authenticate the biometrics. A device for realizing session identification synchronization when a password is reset is applied on a server, and the device includes: a second verification module, which is used to respond to the first request when a terminal initiates a first request to log in to an application program Verify the validity of the first session identifier carried in the application program, where the first session identifier is generated by the login account and original password of the application; An instruction module; a third receiving module; and a third sending module; wherein, when the original password has been modified to a new password for the login account of the application: the instruction module , Used to instruct the terminal to verify the legality of the user of the terminal; the third receiving module, used to receive the legal verification of the user from the terminal according to the instruction module Verification result; the third sending module is configured to send a second session identifier to the terminal if the server verifies the verification result received by the third receiving module, and the second The session identifier is different from the first session identifier and is generated for the login account and the new password; wherein, the device further includes: a third determining module, configured to determine the information sent by the third sending module Whether the second session identifier is within the validity period; the first control module is configured to allow the user to pass through the The second session identifier logs into the application program; the second control module is used for prohibiting the user from passing the first session identifier if the third determining module determines that the second session identifier has exceeded the valid period Second, the session identifier logs in the application program. According to the device described in item 12 of the scope of patent application, the The device further includes: a second decryption module, configured to, if the terminal has used the symmetric key of the server to encrypt the verification result received by the third receiving module, pass the server Decrypts the encrypted verification result with the symmetric key to obtain the verification string and random number corresponding to the verification result; the third verification module is used to decrypt the second decryption module The verification string and the random number are verified, and if the verification of the verification string and the random number is passed, the third sending module executes the step of sending the second session identifier to the terminal. The device according to item 13 of the scope of patent application, wherein the device further includes: a third generation module for generating a symmetric key of the server according to a symmetric encryption algorithm; and a second encryption module for In the symmetric key cryptographically generated by the third generation module using the public key of the terminal; the fourth sending module is used to encrypt the second encryption module after the The symmetric key is sent to the terminal, so that the terminal can decrypt the encrypted symmetric key with the private key corresponding to the public key to obtain the symmetric key of the server.

Images