CN107294917A - One kind trusts login method and device - Google Patents

One kind trusts login method and device Download PDF

Info

Publication number
CN107294917A
CN107294917A CN201610201576.3A CN201610201576A CN107294917A CN 107294917 A CN107294917 A CN 107294917A CN 201610201576 A CN201610201576 A CN 201610201576A CN 107294917 A CN107294917 A CN 107294917A
Authority
CN
China
Prior art keywords
website
user
trust
log
identity information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201610201576.3A
Other languages
Chinese (zh)
Inventor
温涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to CN201610201576.3A priority Critical patent/CN107294917A/en
Publication of CN107294917A publication Critical patent/CN107294917A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102Entity profiles
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • H04L63/126Applying verification of the received information the source of the received data

Abstract

The application provides a kind of trust login method and device, and wherein this method is applied to user and logs on to the second website by the first website trust, including:Second website is when receiving trust logging request, signature verification is carried out to the trust logging request, and the user identity information of the user carried in the trust logging request is obtained, the user identity information is the information for being used to identify user that the first website is generated in User logs in success;When passing through in signature verification, and determining that the user identity information is stored in memory space corresponding with the user, second website performs to trust and logged in.The application improves the security that login is trusted between website.

Description

One kind trusts login method and device
Technical field
The application is related to network technology, more particularly to a kind of to trust login method and device.
Background technology
User jumps to another website, if two nets by a website sometimes when accessing website Station is required for user's input username and password to be logged in, and that will make it that website jump procedure is relatively complicated. Trust the mode logged in simplify to propose in website redirect procedure, correlation technique.
Trusting to log in can apply between two websites with same account system or interlock account system, Also, trust login and rely primarily on signature verification, such as, trust after A websites are logged in B websites and step on During record, A websites can be sent by the URL signed through A websites to B websites trusts logging request, B Website passes through rear i.e. trusted in signature verification and logged in, it is no longer necessary to the user name of user's input B websites and Password.But this trust login mode has potential safety hazard, such as, if attacker obtains A websites Ask B websites to trust the URL logged in, then B websites will verify signature by and allow attacker Sign-on access, easily causes the user profile leakage in B websites.
The content of the invention
In view of this, the application provides a kind of trust login method and device, to improve trust between website The security of login.
Specifically, the application is achieved by the following technical solution:
First aspect trusts login method there is provided one kind, and methods described is believed applied to user by the first website Appoint and log on to the second website, methods described includes:
The trust logging request is signed when receiving trust logging request second website Checking, and obtain the user identity information of the user carried in the trust logging request, the use Family identification information is the information for being used to identify user that the first website is generated in User logs in success;
Pass through in signature verification, and determine that the user identity information is stored in deposit corresponding with the user When storing up space, second website performs to trust and logged in.
Second aspect trusts login method there is provided one kind, and methods described is believed applied to user by the first website Appoint and log on to the second website, methods described includes:
First website is receiving trust login of the listed Client-initiated to the second website During request, the user identity information of the user is obtained;
First website sends the trust logging request of signature to the second website, and carries user's mark Know information, with cause the second website checking signature and user identity information by when carry out trust login.
The third aspect trusts entering device there is provided one kind, and methods described is believed applied to user by the first website Appoint and log on to the second website, described device includes:
Requests verification module, for second website when receiving trust logging request, to the letter Appoint logging request to carry out signature verification, and obtain the user's mark for trusting the user carried in logging request Know information, the user identity information is that the mark that is used for that the first website is generated in User logs in success is used The information at family, judges whether the user identity information is stored in locally memory space corresponding with user;
Performing module is logged in, for passing through in signature verification, and determines that the user identity information is stored in During memory space corresponding with the user, perform and trust login.
Fourth aspect trusts entering device there is provided one kind, and methods described is believed applied to user by the first website Appoint and log on to the second website, described device includes:
Data obtaining module, for receiving letter of the listed Client-initiated to the second website When appointing logging request, the user identity information of the user is obtained;
Request sending module, for sending the trust logging request of signature to the second website, and carries user Identification information, with cause the second website checking signature and user identity information by when carry out trust login.
The application provide trust login method and device, by passing through in signature verification, and with trust When storing user identity information in the corresponding memory space of user of logging request, just allow to trust login, This mode that the checking to user identity information is added in login is trusted, improves letter between website Appoint the security logged in.
Brief description of the drawings
Fig. 1 is a kind of flow chart of trust login method shown in the exemplary embodiment of the application one;
Fig. 2 is a kind of structure chart of trust entering device shown in the exemplary embodiment of the application one;
Fig. 3 is the structure chart of another trust entering device shown in the exemplary embodiment of the application one;
Fig. 4 is the structure chart of another trust entering device shown in the exemplary embodiment of the application one;
Fig. 5 is the structure chart of another trust entering device shown in the exemplary embodiment of the application one.
Embodiment
Here exemplary embodiment will be illustrated in detail, its example is illustrated in the accompanying drawings.Following When description is related to accompanying drawing, unless otherwise indicated, the same numbers in different accompanying drawings represent same or analogous Key element.Embodiment described in following exemplary embodiment does not represent the institute consistent with the application There is embodiment.On the contrary, they are only one be described in detail in such as appended claims, the application The example of the consistent apparatus and method of a little aspects.
Trust that to log in be a kind of to access website in order to simplify user and performing flow when redirecting between website Mode, such as, it is assumed that user has logged in website A by inputting username and password, and wants to jump Go to website B;If supporting to trust between website A and website B logs in, then user can be in website The website B direct Website login B of link is clicked in A;And if do not supported between website A and website B Trust and log in, when user clicks on website B link in the A of website, in addition it is also necessary to input username and password It could be logged in website B.Above-mentioned trust logs in the website (such as, website A or website B) where performing, User can log in the website in several ways, such as, by browser can log in net on PC Stand, or, the website can also be logged in by browser on Intelligent mobile equipment (such as, mobile phone), Or, can also on Intelligent mobile equipment in the form of the applications such as APP Website login, for example, In website A application APP, signed in using website B account in the A of website.
During login is trusted, website A is sent by one through the A URL signed to website B Trust logging request, but the URL is easily forged by attacker, if attacker uses identical URL Trust to website B requests and log in, website B sign tests are logged in by can perform to trust.In order to improve trust The security of login, trusts login method, even if the purpose of this method is so that this application provides one kind Attacker obtains the URL for trusting logging request, and website B can be recognized and be refused the access of attacker.
Flow shown in Figure 1, the flow by user will by website A trust log on to website B exemplified by, To describe how to realize website A (being properly termed as the first website) to website B (being properly termed as the second website) Between trust log in, if that is, user by user name and password login to website A after, how to trust Log on to website B.In the method, User logs in website A and perform to website B trust login Before, in addition it is also necessary to once in website B quick login.
As shown in figure 1, in a step 101, website B receives the quick logging request of user, user Using website A account quick login is done on the B of website, i.e., by inputting user in the B of website The username and password that A is set in website, with Website login B.In a step 102, website B can be with The log-on message (username and password) that user inputs in quick log in is got, and in step 103 In, request website A verifies that the request is signed through website B to the log-on message.
At step 104, website A is verified to the signature of user name, password and website B.And After being verified, in step 105, website B will be returned to through the website A the results signed, Authorized user message and the user identity information of the user can be included in the result.It is therein to use Family authorization message purpose is to inform website B, and the user that the request is fast logged in has already been through checking, is Website A validated user, and the correspondence mark of user identity information to be website A the distribute to user.
Website B is after the result of website A transmissions is received, in step 106, verifies website A Signature, if by and confirm that the user that fast logs in, can be by website A by website A checking User identity information be stored in should be in the memory space of user.For example, website B can be created pair Should user memory space, the memory space is, for example, the session of correspondence user this sign-on access Session, and website A user identity information is stored in the session.
Here the session session that lower website B is created is briefly described:Session Chinese is " session " The meaning, " session " between representative server and client, such as, and when user is accessing a website, The Website page that user browses in a browser is website client end, and a corresponding also website Server, the process of user's access website is related to the session between server and client.Website service User's (namely each client) that device end can sign in website for each creates a corresponding meeting Talk about session, it is possible to this session is identified with SessionID.Server is created after session, can It is stored in so that SessionID is returned into client in the browser of user, when user end to server is passed The SessionID can be carried during transmission of data, to cause server according to the SessionID by this user Session information be stored in corresponding session.Different users is recorded with different Session, Session is a data structure for being used to store User logs in access information.
By described above it can be seen that, in the quick login process shown in Fig. 1, website B has obtained one The user identity information of website A legal login user, and the user identity information has been stored in pair Should be in the session session of user.So, that user identity information also correspond to be allowed by website A trusts the mark for the user for logging on to website B, because this user is in quick login process CEInet The A that stands verifies acknowledged validated user.In follow-up trust login process, if a user will be by net The A that stands, which trusts, logs on to website B, and website B can just check the user's mark for the user that oneself whether is stored with Know information, if storage just allows user to carry out trust login, otherwise can refuse trust and log in.Can be with The process logged in continued reference to the trust in Fig. 1.
In step 107 and 108, user logs on to website A by inputting username and password and visited Ask, when user desires access to website B, the chained address of the website B in the A of website can be clicked on, Now website A can start to go to website B trust login.
In step 110, in the trust login method of the application, in the URL of the trust logging request of signature In add a kind of information, i.e. user identity information.Website A accesses website B request according to user, Signed trust logging request is assembled, and carries the user identity information USERID of user. In step 111, website A sends the trust logging request to website B.
Referring to step 112 and step 113, website B is received after website A trust logging request, can To verify website A signature, even if signature verification passes through, website B also needs to judge what is carried in request Whether user identity information is stored in locally memory space corresponding with user.If the user is one Legal website A user, and passing through the quick login in website B before so that website B has prestored the user identity information of the user in the session of user, then in step 113, When website B goes to search in the corresponding session session of the user, the use carried in request can be found Family identification information such as USERID are had stored in session, then website B can allow the user to visit Ask, user realizes without inputting username and password again and trusts login.
And if an attacker obtains the URL of the trust logging request in the step 111 in Fig. 1, And trust logging request is sent to website B by the URL, website B can be recognized and be refused its visit Ask, principle is as follows:Website B is tested in step 112 after the trust logging request of attacker is received Signed certificate star passes through, in step 113, although also carrying use in the URL that attacker forges Family identification information, the user identity information can not locally found by website B, because website B It will go to search whether the user identity information that is stored with the corresponding session session of attacker, and attacker Do not stored in session.Such as, according to the characteristics of session session, different user correspondence is different Session, which includes needing to be same computer equipment and same browser, and attacker makes During with the equipment of oneself to website B transmission trust logging requests, website B can create one for the attacker Corresponding session, and search whether what is carried in trust logging request in the session of attacker User identity information.The checking of certain step 113 will fail, and website B will refuse to trust sign-on access.
It can see by above-mentioned Fig. 1 flow, trust the targeted sites website B logged in, can confirm After one website A legal login user, the information of this user is stored in storage corresponding with user In space, for example, it is stored in the session of the user.So, logged in even if attacker has forged trust The URL of request, website B will not also find the use carried in request in the corresponding session of attacker Family identification information, and cause the authentication failed to trusting logging request.Therefore, by login is trusted The checking to user identity information is added, the security trusted and logged in is improved.
In addition, session session may have effective time, such as the session failed after 5 minutes, then Logged in even a legal user trusts in request, due to session failed, the information stored in session Also fail, cause website B in the authentication failed of step 113.Either, that is mentioned in above-mentioned example attacks The person of hitting accesses situation about being refused by website B.In the case where these are to user identity information authentication failed, Website B can redirect this trust logging request, and guiding user first goes to perform quick login, The step 101 and step 102 such as jumped in Fig. 1, allows user fast to be logged in website, weight New input website A username and password, i.e. website B can verify the identity of a user again, weight Newly perform Fig. 1 flow.
The embodiment of the present application additionally provides trust entering device, with applied to website so that website can be held The trust login method of row the application.Trust entering device as shown in Figure 2, the device can apply to Trust the purpose website of logging request, such as website B when logging in is trusted to website B in website A.Should Device can include:Requests verification module 21 and login performing module 22.
Requests verification module 21, for second website when receiving trust logging request, to described Trust logging request and carry out signature verification, and obtain the user for trusting the user carried in logging request Identification information, the user identity information is the first website, and being used for of being generated in User logs in success identifies The information of user, judges whether the user identity information is stored in memory space corresponding with user;
Performing module 22 is logged in, for passing through in signature verification, and the user identity information storage is determined In local memory space corresponding with the user, perform and trust login.
Referring to Fig. 3, the device can also include:Login authentication module 23 and information storage module 24.
Login authentication module 23, for before trust logging request is received, also receiving the quick of user Log-on message of the user in the first website is carried in logging request, the quick logging request, is asked First website is verified to the log-on message, carries the log-on message;
Information storage module 24, for receive first website checking log-on message pass through rear transmission User identity information, creates memory space corresponding with the user, and the user identity information is deposited Storage is in the memory space.For example, the memory space is session session.
Trust entering device as shown in Figure 4, the device can apply to trust the source website of logging request, Website A when logging in such as is trusted to website B in website A.The device can include:Acquisition of information mould Block 41 and request sending module 42.
Data obtaining module 41, for receiving the listed Client-initiated to the second website When trusting logging request, the user identity information of the user is obtained;
Request sending module 42, the trust logging request for sending signature to the second website, carries user Identification information, with cause the second website checking signature and user identity information by when carry out trust login.
Referring to Fig. 5, the device can also include:Checking request module 43 and information feedback module 44.
Checking request module 43, for receiving the request verified to log-on message that the second website is sent, The request carries the log-on message for the first website that user inputs at request the second website of quick login;
Information feedback module 44, for by rear, first website to be by user's in checking log-on message User identity information is sent to the second website, to cause second website empty in storage corresponding with user Between store user identity information.
The preferred embodiment of the application is the foregoing is only, it is all at this not to limit the application Within the spirit and principle of application, any modification, equivalent substitution and improvements done etc. should be included in Within the scope of the application protection.

Claims (10)

1. one kind trusts login method, it is characterised in that methods described is believed applied to user by the first website Appoint and log on to the second website, methods described includes:
The trust logging request is signed when receiving trust logging request second website Checking, and obtain the user identity information of the user carried in the trust logging request, the use Family identification information is the information for being used to identify user that the first website is generated in User logs in success;
Pass through in signature verification, and determine that the user identity information is stored in deposit corresponding with the user When storing up space, second website performs to trust and logged in.
2. according to the method described in claim 1, it is characterised in that receive letter in second website Appoint before logging request, methods described also includes:
Second website, which is received, carries described in the quick logging request of user, the quick logging request Log-on message of the user in the first website;
The website of second web site requests first is verified to the log-on message, is carried described log in and is believed Breath, and first website is received in checking user identity information of the log-on message by rear transmission;
Second website creates memory space corresponding with the user, and by the user identity information It is stored in the memory space.
3. according to the method described in claim 1, it is characterised in that the memory space is session session.
4. one kind trusts login method, it is characterised in that methods described is believed applied to user by the first website Appoint and log on to the second website, methods described includes:
First website is receiving trust login of the listed Client-initiated to the second website During request, the user identity information of the user is obtained;
First website sends the trust logging request of signature to the second website, and carries user's mark Know information, with cause the second website checking signature and user identity information by when carry out trust login.
5. method according to claim 4, it is characterised in that methods described also includes:
First website receives the request verified to log-on message that the second website is sent, described to ask Seek the log-on message for carrying the first website that user inputs at request the second website of quick login;
In checking log-on message by rear, first website sends the user identity information of user to the Two websites, to cause second website to store user identity information in memory space corresponding with user.
6. one kind trusts entering device, it is characterised in that methods described is believed applied to user by the first website Appoint and log on to the second website, described device includes:
Requests verification module, for second website when receiving trust logging request, to the letter Appoint logging request to carry out signature verification, and obtain the user's mark for trusting the user carried in logging request Know information, the user identity information is that the mark that is used for that the first website is generated in User logs in success is used The information at family, judges whether the user identity information is stored in locally memory space corresponding with user;
Performing module is logged in, for passing through in signature verification, and determines that the user identity information is stored in During memory space corresponding with the user, perform and trust login.
7. device according to claim 6, it is characterised in that described device also includes:
Login authentication module, is stepped on for before trust logging request is received, also receiving the quick of user Record request, carries log-on message of the user in the first website in the quick logging request, request the One website is verified to the log-on message, carries the log-on message;
Information storage module, for receiving first website in checking use of the log-on message by rear transmission Family identification information, creates memory space corresponding with the user, and the user identity information is stored In the memory space.
8. device according to claim 6, it is characterised in that the memory space is session session.
9. one kind trusts entering device, it is characterised in that methods described is believed applied to user by the first website Appoint and log on to the second website, described device includes:
Data obtaining module, for receiving letter of the listed Client-initiated to the second website When appointing logging request, the user identity information of the user is obtained;
Request sending module, for sending the trust logging request of signature to the second website, and carries user Identification information, with cause the second website checking signature and user identity information by when carry out trust login.
10. device according to claim 9, it is characterised in that described device also includes:
Checking request module, for receiving the request verified to log-on message that the second website is sent, The request carries the log-on message for the first website that user inputs at request the second website of quick login;
Information feedback module, for by rear, first website to be by the use of user in checking log-on message Family identification information is sent to the second website, to cause second website in memory space corresponding with user Store user identity information.
CN201610201576.3A 2016-03-31 2016-03-31 One kind trusts login method and device Pending CN107294917A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201610201576.3A CN107294917A (en) 2016-03-31 2016-03-31 One kind trusts login method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201610201576.3A CN107294917A (en) 2016-03-31 2016-03-31 One kind trusts login method and device

Publications (1)

Publication Number Publication Date
CN107294917A true CN107294917A (en) 2017-10-24

Family

ID=60086853

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201610201576.3A Pending CN107294917A (en) 2016-03-31 2016-03-31 One kind trusts login method and device

Country Status (1)

Country Link
CN (1) CN107294917A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110278187A (en) * 2019-05-13 2019-09-24 网宿科技股份有限公司 Multiple terminals single-point logging method, system, sync server and medium
CN111259368A (en) * 2019-11-07 2020-06-09 深圳市远行科技股份有限公司 Method and equipment for logging in system
CN115037545A (en) * 2022-06-14 2022-09-09 江苏银承网络科技股份有限公司 Method, device and storage medium for login of website without secret authorization

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101697515A (en) * 2009-11-06 2010-04-21 金蝶软件(中国)有限公司 Web mode-based authentication method, system and device
CN102624737A (en) * 2012-03-27 2012-08-01 武汉理工大学 Single sign-on integrated method for Form identity authentication in single login system
WO2015043224A1 (en) * 2013-09-29 2015-04-02 Tencent Technology (Shenzhen) Company Limited Method and apparatus for service login based on third party's information
CN102710759B (en) * 2012-05-22 2015-04-15 中国联合网络通信集团有限公司 Web server, business logging method and system
CN105007280A (en) * 2015-08-05 2015-10-28 郑州悉知信息技术有限公司 Application sign-on method and device

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101697515A (en) * 2009-11-06 2010-04-21 金蝶软件(中国)有限公司 Web mode-based authentication method, system and device
CN102624737A (en) * 2012-03-27 2012-08-01 武汉理工大学 Single sign-on integrated method for Form identity authentication in single login system
CN102710759B (en) * 2012-05-22 2015-04-15 中国联合网络通信集团有限公司 Web server, business logging method and system
WO2015043224A1 (en) * 2013-09-29 2015-04-02 Tencent Technology (Shenzhen) Company Limited Method and apparatus for service login based on third party's information
CN105007280A (en) * 2015-08-05 2015-10-28 郑州悉知信息技术有限公司 Application sign-on method and device

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
邱慧宇等: "《网络数据库技术基础》", 30 September 2004 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110278187A (en) * 2019-05-13 2019-09-24 网宿科技股份有限公司 Multiple terminals single-point logging method, system, sync server and medium
CN111259368A (en) * 2019-11-07 2020-06-09 深圳市远行科技股份有限公司 Method and equipment for logging in system
CN115037545A (en) * 2022-06-14 2022-09-09 江苏银承网络科技股份有限公司 Method, device and storage medium for login of website without secret authorization

Similar Documents

Publication Publication Date Title
CN104378376B (en) Single-point logging method, certificate server and browser based on SOA
CN105007280B (en) A kind of application login method and device
US9026788B2 (en) Managing credentials
Li et al. Security issues in OAuth 2.0 SSO implementations
US10225260B2 (en) Enhanced authentication security
CN103024740B (en) Method and system for accessing internet by mobile terminal
CN105917630A (en) Redirect to inspection proxy using single-sign-on bootstrapping
CN106375348B (en) Portal authentication method and device
CN107046544A (en) A kind of method and apparatus of the unauthorized access request recognized to website
CN105939326A (en) Message processing method and device
JP4960738B2 (en) Authentication system, authentication method, and authentication program
CN106656952A (en) Authentication method, device and system for registration equipment
CN106161475B (en) Method and device for realizing user authentication
CN106559384A (en) A kind of utilization public number realizes the method and device for logging in
CN106209727B (en) Session access method and device
CN106549909A (en) A kind of authority checking method and apparatus
US20140298443A1 (en) System and method of extending a host website
CN104618356B (en) Auth method and device
CN105791249A (en) Third-party application processing method, device and system
CN107294917A (en) One kind trusts login method and device
CN105187417B (en) Authority acquiring method and apparatus
Vasileios Grammatopoulos et al. A web tool for analyzing FIDO2/WebAuthn Requests and Responses
JP5086024B2 (en) User authentication system, apparatus, and method
US20170230416A1 (en) System and methods for preventing phishing attack using dynamic identifier
CN109729045A (en) Single-point logging method, system, server and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 1246036

Country of ref document: HK

RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20171024