WO2018045802A1

WO2018045802A1 - Login authentication and login password modification authentication methods, terminal, and server

Info

Publication number: WO2018045802A1
Application number: PCT/CN2017/091251
Authority: WO
Inventors: 温海龙
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-09-12
Filing date: 2017-06-30
Publication date: 2018-03-15
Also published as: CN107819723A

Abstract

Disclosed is a login authentication method, comprising: a terminal sends a login page request to a server; the terminal receives a login page, an authentication random number, and a punching random number returned by the server; the terminal uses, after receiving a login password inputted by a user, the received login password to decrypt the authentication random number and the punching random number, and generates authentication information; the terminal sends the authentication information to the server, so that the server authenticates the received the authentication information, and permits the terminal to log in when the authentication is successful. Also disclosed are a login password modification authentication method, a terminal, and a server. According to the present invention, by using an authentication random number and a punching random number to generate authentication information, and encrypting the authentication random number and the punching random number using a login password, an attacker cannot crack the login password by means of HASH dictionary attacking, so that reveal of Web UI login passwords is effectively avoided, and the security of Web UI login is improved.

Description

Login authentication and login password modification authentication method, terminal and server

Technical field

The present disclosure relates to the field of communications technologies, and in particular, to a login authentication and login password modification authentication method, a terminal, and a server.

Background technique

At present, when a client (such as a customer premise equipment (CPE) or MiFi (Mobile Wifi)) is used for login authentication of the Web UI (Website User Interface), the login password is generally adopted. Base64 is encoded and then transmitted. This is easy to be eavesdropped in the WLAN wireless network environment, and the password is cleared by Base64 anti-encoding, which causes the Web UI login password to leak.

Summary of the invention

The main purpose of the present disclosure is to provide a login authentication and login password modification authentication method, a terminal, and a server, which are designed to prevent Web UI login password leakage and improve the security of Web UI login.

The login authentication method provided by the present disclosure includes: the terminal sends a login page request to the server; the terminal receiving the login page returned by the server based on the login page request, the encrypted authentication random number, and the punctured random number, and the authentication random number and The punctured random number is encrypted by using a pre-stored login password corresponding to the terminal; after receiving the login password input by the user based on the login page, the terminal uses the received login password to return the authentication random number to the server. And decrypting the punctured random number, and generating authentication information according to the decrypted authentication random number and the punctured random number; the terminal sends the authentication information to the server, so that the server authenticates the received authentication information, and is authenticated The terminal is allowed to log in when passing.

Optionally, the step of generating the authentication information according to the decrypted authentication random number and the punctured random number comprises: calculating a digest value of the decrypted authentication random number; calculating a punching position according to the decrypted punctured random number a number of puncturing lengths or a number of bits; deleting data corresponding to the puncturing position and the puncturing length of the digest value, and moving the other data after the deleted data to the puncturing length to generate The authentication information.

In addition, the login authentication method provided by the present disclosure includes: after receiving the login page request sent by the terminal, the server returns a login page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching The random number is encrypted by using a pre-stored login password corresponding to the terminal, so that the terminal returns the authentication returned by the server after receiving the login password input by the user based on the login page. The random number and the punctured random number are decrypted, and the authentication information is generated according to the decrypted authentication random number and the punctured random number, and the authentication information is sent to the server; after receiving the authentication information sent by the terminal, the server receives the The obtained authentication information is authenticated, and the terminal is allowed to log in when the authentication is passed.

Optionally, the step of authenticating the received authentication information includes: calculating a digest value of the pre-stored authentication random number; calculating a punching position and a punching length according to the pre-stored punching random number; and using the digest value With the punch position and Data corresponding to the puncturing length is deleted, and the other data after the deleted data is forwarded by the puncturing length to generate an authentication digest value; and the authentication digest value is compared with the received authentication information, if If they are consistent, the authentication is passed.

In addition, the login password modification authentication method provided by the present disclosure includes: the terminal sends a login password modification page request to the server; the terminal receiving server changes the login password modification page, the encrypted authentication random number, and the punching based on the login password modification page request. a random number, and the authentication random number and the punctured random number are encrypted by using a pre-stored original login password corresponding to the terminal; and the terminal receives the original login password and the new login entered by the user based on the login password modification page. After the password, decrypting the authentication random number and the punched random number returned by the server by using the received original login password, and generating authentication information according to the decrypted authentication random number and the punched random number; and the authentication information and the new The login password is sent to the server for the server to authenticate the received authentication information, and the pre-stored original login password corresponding to the terminal is updated to the new login password when the authentication is passed.

In addition, the login password modification authentication method provided by the disclosure includes: after receiving the login password modification page request sent by the terminal, the server returns a login password modification page, an encrypted authentication random number, and a punched random number to the terminal, and the Both the authentication random number and the punctured random number are encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page. Decrypting the authentication random number and the punched random number returned by the server by using the received original login password, generating authentication information according to the decrypted authentication random number and the punched random number, and the authentication information and the new login password Sending to the server; and after receiving the authentication information and the new login password sent by the terminal, the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal when the authentication is passed For the new login password.

In addition, the terminal provided by the present disclosure includes: a first sending module, configured to send a login page request to the server; and a first receiving module configured to receive a login page returned by the server based on the login page request, an encrypted authentication random number, and Punching a random number, and the authentication random number and the puncturing random number are encrypted by using a pre-stored login password corresponding to the terminal; the first generation module is configured to receive the login input by the user based on the login page After the password, the authentication random number and the punched random number returned by the server are decrypted by using the received login password, and the authentication information is generated according to the decrypted authentication random number and the punched random number; the first sending module further It is configured to send the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication is passed.

Optionally, the first generating module includes: a first calculating unit, configured to calculate a digest value of the decrypted authentication random number; the first calculating unit is further configured to calculate, according to the decrypted punching random number a hole position and a punching length; the first generating unit is configured to delete data corresponding to the punching position and the punching length of the digest value, and advance other data after the deleted data The length of the hole to generate the authentication information.

In addition, the server provided by the present disclosure includes: a first returning module, configured to return a login page, an encrypted authentication random number, and a punctured random number to the terminal after receiving the login page request sent by the terminal, and the authentication is randomized The number and the punctured random number are encrypted by using a pre-stored login password corresponding to the terminal, so that the terminal uses the received login password pair after receiving the login password input by the user based on the login page. The authentication random number returned by the server and the punctured random number are decrypted, and the authentication information is generated according to the decrypted authentication random number and the punctured random number, and the authentication information is sent to the server; the first authentication module is set to receive After the authentication information sent by the terminal, the received authentication information is authenticated, and the terminal is allowed to log in when the authentication is passed.

Optionally, the first authentication module includes: a second calculating unit, configured to calculate a digest value of the pre-stored authentication random number; the second calculating unit is further configured to calculate a punching position according to the pre-stored punching random number And a punching length; the second generating unit is configured to delete the data corresponding to the punching position and the punching length of the digest value, and advance the other data after the deleted data to the punching length And generating an authentication digest value; the authentication unit is configured to compare the authentication digest value with the received authentication information, and if yes, determine that the authentication is passed.

In addition, the terminal provided by the present disclosure includes: a second sending module, configured to send a login password modification page request to the server; and a second receiving module configured to receive a login password modification page returned by the server based on the login password modification page request, and Encrypted authentication random number and punctured random number, and the authentication random number and the punctured random number are both encrypted by using a pre-stored original login password corresponding to the terminal; and the second generation module is set to be based on the received user After the original login password and the new login password input by the login password modification page, the authentication random number and the punched random number returned by the server are decrypted by using the received original login password, according to the decrypted authentication random number and playing The hole random number generates authentication information; the second sending module is further configured to send the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and pre-stores the authentication when the authentication is passed The original login password corresponding to the terminal is updated to the new login password.

In addition, the server provided by the present disclosure includes: a second returning module, configured to return a login password modification page, an encrypted authentication random number, and a punched random number to the terminal after receiving the login password modification page request sent by the terminal, and The authentication random number and the punctured random number are both encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page. And decrypting the authentication random number and the punched random number returned by the server by using the received original login password, generating authentication information according to the decrypted authentication random number and the punched random number, and the authentication information and the new The login password is sent to the server; and the second authentication module is configured to, after receiving the authentication information and the new login password sent by the terminal, authenticate the received authentication information, and store the pre-stored information when the authentication is passed. The original login password corresponding to the terminal is updated to the new login password.

The login authentication and login password modification authentication method, the terminal, and the server provided by the disclosure, after receiving the login page request sent by the terminal, return the login page, the encrypted authentication random number, and the punched random number to the terminal, and the server Both the authentication random number and the punctured random number are encrypted by using a pre-stored login password corresponding to the terminal, so that the terminal uses the received login password after receiving the login password input by the user based on the login page. The login password decrypts the authentication random number and the punched random number returned by the server, and generates authentication information according to the decrypted authentication random number and the punched random number, and sends the authentication information to the server; the server sends the received terminal After the authentication information, the received authentication information is authenticated, and the terminal is allowed to log in when the authentication is passed. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

DRAWINGS

1 is a schematic flowchart of a first embodiment of a login authentication method according to the present disclosure;

2 is a schematic flowchart of a step of generating authentication information in a second embodiment of the login authentication method according to the present disclosure;

3 is a schematic flowchart of a third embodiment of a login authentication method according to the present disclosure;

4 is a schematic flowchart of a step of generating authentication information in a fourth embodiment of the login authentication method of the present disclosure;

FIG. 5 is a schematic flowchart of a first embodiment of a login password modification and authentication method according to the present disclosure;

6 is a schematic flowchart of a second embodiment of a method for authenticating a login password modification according to the present disclosure;

7 is a schematic diagram of functional modules of a first embodiment of the present disclosure;

8 is a schematic diagram of a refinement function module of a first generation module in a second embodiment of the present disclosure;

9 is a schematic diagram of functional modules of a first embodiment of the server of the present disclosure;

10 is a schematic diagram of a refinement function module of an authentication module in a second embodiment of the present disclosure;

11 is a schematic diagram of functional modules of a third embodiment of the terminal of the present disclosure;

FIG. 12 is a schematic diagram of functional modules of a third embodiment of the server of the present disclosure.

The implementation, functional features and advantages of the present disclosure will be further described with reference to the accompanying drawings.

detailed description

It is understood that the specific embodiments described herein are merely illustrative of the disclosure and are not intended to limit the disclosure.

The present disclosure provides a login authentication method that is implemented based on a terminal. 1 is a schematic flowchart of a login authentication method according to a first embodiment of the present disclosure. The login authentication method provided by the present disclosure includes the following steps: Step S110: A terminal sends a login page request to a server. In this embodiment, the login is performed. The authentication method can be used for the web UI login authentication method. The login page request can be used to log in to the web UI authentication request.

After receiving the login page request sent by the terminal, the server generates two random numbers, one is the authentication random number and the other is the punching random number. The server then encrypts the authentication random number and the punctured random number using a pre-stored login password corresponding to the terminal. The server then sends the login page, the encrypted authentication random number, and the punctured random number to the terminal.

Optionally, the authentication random number and the punctured random number sent by the server to the terminal are generated by the server using the sequence number and the time parameter as a seed, and the initial value of the sequence number is not 0, and the sequence number of the random number is incremented by 1 each time. The parameter value is the time at which the random number is generated.

In step S120, the terminal receives a login page, an encrypted authentication random number, and a punctured random number that are returned by the server based on the login page request, and the authentication random number and the punctured random number both use pre-stored corresponding to the terminal. The login password is encrypted.

Optionally, the algorithm for encrypting the authentication random number and the punctured random number by using the login password may be a public standard encryption algorithm, such as AES, or a private encryption algorithm.

In step S130, after receiving the login password input by the user based on the login page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received login password, and randomly according to the decrypted authentication. The number and the punctured random number generate authentication information.

After receiving the login page, the terminal displays the login page, and the user enters the login password in the password input field of the login page. It can be understood that, when the login password input by the user is correct, the login password corresponding to the terminal pre-stored by the server is consistent with the login password input by the user, so the terminal can use the login password entered by the user to authenticate the random number and the punched random number. Make a correct decryption. When the login password entered by the user is incorrect, the login password corresponding to the terminal prestored by the server does not match the login password input by the user. Therefore, the terminal cannot correctly decrypt the authentication random number and the punched random number by using the login password input by the terminal.

The manner of generating authentication information according to the authentication random number and the punctured random number may be generated according to a preset rule. Preset rules can be set according to actual needs.

In step S140, the terminal sends the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication passes.

In this embodiment, the server needs to generate the authentication information according to the previously generated authentication random number and the punctured random number, and after receiving the authentication information, the server compares the received authentication information with the generated authentication information, If they match, the authentication is passed; if they are not, the authentication is not passed.

The login authentication method provided by the present disclosure sends a login page request to the server through the terminal, and receives a login page returned by the server based on the login page request, an encrypted authentication random number, and a punched random number, and receives the user based on the After the login password input on the login page is described, the authentication random number and the punched random number returned by the server are decrypted by using the received login password, and the authentication information is generated according to the decrypted authentication random number and the punched random number, and then The terminal sends the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication is passed. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

Further, based on the first embodiment of the present disclosure login authentication method, the present disclosure further provides a second embodiment of the login authentication method. Referring to FIG. 2, FIG. 2 is a step of generating authentication information in the second embodiment of the public login authentication method. Schematic diagram of the refinement process. In the second embodiment, the step of generating the authentication information according to the decrypted authentication random number and the punctured random number includes: Step S131, calculating a digest value of the decrypted authentication random number; in this embodiment, calculating the digest The value of the algorithm can be MD5 or SHA-1 or other algorithms.

In step S132, the punching position and the punching length are calculated based on the decrypted punching random number.

It can be understood that the puncturing length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

In step S133, the data corresponding to the punching position and the punching length of the digest value is deleted, and the other data after the deleted data is advanced by the punching length to generate the authentication information.

In this embodiment, optionally, to ensure that the length of the digest value is constant, it is required to fill the new digest value generated by the puncturing, and the padding value is preferably a random value, and the padding length is the number of punctured bytes or punched. The number of bits.

In this embodiment, since the random number punching filling technique is adopted, the security at the time of login authentication is further improved.

The present disclosure further provides a login authentication method that is based on a server implementation. Referring to FIG. 3, FIG. 3 is a schematic flowchart of a login authentication method according to a third embodiment of the present disclosure. The login authentication method provided by the present disclosure includes the following steps: Step S210: After receiving a login page request sent by a terminal, the server returns a login to the terminal. Page, encrypted authentication a random number and a punctured random number, and the authentication random number and the punctured random number are encrypted by using a pre-stored login password corresponding to the terminal, so that the terminal receives the user input based on the login page. After the password is logged in, the authentication random number and the punctured random number returned by the server are decrypted by using the received login password, and the authentication information is generated according to the decrypted authentication random number and the punctured random number, and the authentication information is generated. Send to the server.

In this embodiment, the terminal first sends a login page request to the server. The login authentication method can be used for the web UI login authentication method. The login page request can be used to log in to the web UI authentication request.

Step S220: After receiving the authentication information sent by the terminal, the server authenticates the received authentication information, and allows the terminal to log in when the authentication is passed.

The login authentication method provided by the present disclosure returns a login page, an encrypted authentication random number, and a punctured random number to the terminal after receiving the login page request sent by the terminal, and the authentication random number and the punctured random number And encrypting, by using the pre-stored login password corresponding to the terminal, for the terminal to use the login password input by the user based on the login page, and using the received login password to return the authentication random number to the server. Decrypting with the punctured random number, and generating authentication information according to the decrypted authentication random number and the punctured random number, and sending the authentication information to the server; after receiving the authentication information sent by the terminal, the server receives the received The authentication information is authenticated and the terminal is allowed to log in when the authentication is passed. The present disclosure generates authentication information by using an authentication random number and a punctured random number, and the authentication random number and the punctured random number are encrypted by using a login password, so that an attacker cannot crack through a HASH dictionary attack. The login password effectively avoids the leakage of the Web UI login password and improves the security of the Web UI login.

Further, based on the third embodiment of the present disclosure login authentication method, the present disclosure further provides a fourth embodiment of the login authentication method. Referring to FIG. 4, FIG. 4 is a step of generating authentication information in the fourth embodiment of the public login authentication method. Schematic diagram of the refinement process. In the fourth embodiment, the authenticating the received authentication information includes the following steps.

In step S211, the digest value of the pre-stored authentication random number is calculated. In this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms.

In step S212, the punching position and the punching length are calculated based on the pre-stored punching random numbers. It can be understood that the puncturing length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

In step S213, the data corresponding to the punching position and the punching length of the digest value is deleted, and the other data after the deleted data is advanced by the punching length to generate an authentication digest value.

In step S214, the authentication digest value is compared with the received authentication information, and if they match, it is determined that the authentication is passed. In this embodiment, optionally, to ensure that the length of the digest value is constant, it is required to fill the new digest value generated by the puncturing, and the padding value is preferably a random value, and the padding length is the number of punctured bytes or punched. The number of bits.

The present disclosure further provides a login password modification authentication method, which is implemented based on a terminal. Referring to FIG. 5, FIG. 5 is a schematic flowchart of a login password modification and authentication method according to a first embodiment of the present disclosure. The login password modification authentication method provided by the present disclosure includes the following steps.

In step S310, the terminal sends a login password modification page request to the server.

In this embodiment, the login password modification authentication method can be used for the Web UI login password modification authentication method. The login password modification page request can modify the authentication request for the web UI login password.

After receiving the login password modification page request sent by the terminal, the server generates two random numbers, one is an authentication random number, and the other is a punching random number. The server then encrypts the authentication random number and the punctured random number using the pre-stored original login password corresponding to the terminal. The server then sends the login password modification page, the encrypted authentication random number, and the punctured random number to the terminal.

In step S320, the terminal receiving the login password modification page, the encrypted authentication random number and the punching random number returned by the server based on the login password modification page request, and the authentication random number and the punching random number both utilize the pre-stored The original login password corresponding to the terminal is encrypted.

In step S330, after receiving the original login password and the new login password input by the user based on the login password modification page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received original login password. The authentication information is generated according to the decrypted authentication random number and the punched random number.

After receiving the login password modification page, the terminal displays the login password modification page, and the user is in the login password modification page. Enter the original login password and the new login password in the password input field. It can be understood that, when the original login password input by the user is correct, the original login password corresponding to the terminal pre-stored by the server is consistent with the original login password input by the user, so the terminal can use the original login password input by the user to authenticate the random number and Punch the random number for correct decryption. When the original login password entered by the user is incorrect, the original login password corresponding to the terminal pre-stored by the server is inconsistent with the original login password input by the user, so the terminal cannot use the original login password input by the user to correctly authenticate the random number and the punched random number. Decrypt.

Optionally, the step of generating the authentication information according to the decrypted authentication random number and the punctured random number includes:

The digest value of the decrypted authentication random number is calculated; in this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms.

The punching position and the punching length are calculated according to the decrypted random number of punching holes; it can be understood that the punching length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

Data corresponding to the punching position and the punching length of the digest value is deleted, and other data after the deleted data is advanced by the punching length to generate the authentication information.

Step S340, the authentication information and the new login password are sent to the server, so that the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal to the new when the authentication is passed. login password.

The login authentication method provided by the present disclosure sends a login password modification page request to the server through the terminal, and receives a login password modification page, an encrypted authentication random number, and a punched random number returned by the server based on the login password modification page request, After receiving the original login password and the new login password input by the user based on the login password modification page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received original login password, according to the decrypted The authentication random number and the punctured random number generate authentication information, and then send the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and pre-stores the terminal with the terminal when the authentication is passed. The corresponding original login password is updated to the new login password. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

The present disclosure further provides a login password modification authentication method, which is based on a server implementation. Referring to FIG. 6 , FIG. 6 is a schematic flowchart of a second embodiment of a login password modification and authentication method. The login password modification and authentication method provided by the present disclosure includes the following steps.

In step S410, after receiving the login password modification page request sent by the terminal, the server returns a login password modification page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching random number are both Encrypting with a pre-stored original login password corresponding to the terminal, for the terminal to receive the original login password and the new login password input by the user based on the login password modification page, and using the received original login password Decrypting the authentication random number and the punctured random number returned by the server, generating authentication information according to the decrypted authentication random number and the punctured random number, and transmitting the authentication information and the new login password to the server.

In this embodiment, the terminal first sends a login password modification page request to the server. The login password modification authentication method can be used for the web UI login password modification authentication method. The login password modification page request can modify the authentication request for the web UI login password.

Optionally, the algorithm for encrypting the authentication random number and the punctured random number by using the original login password may be a public standard encryption algorithm, such as AES, or a private encryption algorithm;

After receiving the login password modification page, the terminal displays the login password modification page, and the user inputs the original login password and the new login password in the password input field of the login password modification page. It can be understood that, when the original login password input by the user is correct, the original login password corresponding to the terminal pre-stored by the server is consistent with the original login password input by the user, so the terminal can use the original login password input by the user to authenticate the random number and Punch the random number for correct decryption. When the original login password entered by the user is incorrect, the original login password corresponding to the terminal pre-stored by the server is inconsistent with the original login password input by the user, so the terminal cannot use the original login password input by the user to correctly authenticate the random number and the punched random number. Decrypt.

In step S420, after receiving the authentication information and the new login password sent by the terminal, the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal to the location when the authentication is passed. The new login password.

Optionally, the step of authenticating the received authentication information includes: calculating a digest value of the pre-stored authentication random number; in this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms.

According to the pre-stored random number of punching holes, the punching position and the punching length are calculated; it can be understood that the punching length can be a word Metering can also be measured in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

The data corresponding to the punching position and the punching length of the digest value is deleted, and the other data after the deleted data is advanced by the punching length to generate an authentication digest value.

The authentication digest value is compared with the received authentication information, and if they are consistent, the authentication is determined to pass.

The login authentication method provided by the present disclosure returns a login password modification page, an encrypted authentication random number, and a punched random number to the terminal after receiving the login password modification page request sent by the terminal, and the authentication random number and the authentication random number are The punctured random numbers are encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page, and uses the received The original login password decrypts the authentication random number and the punched random number returned by the server, generates authentication information according to the decrypted authentication random number and the punched random number, and sends the authentication information and the new login password to the server; After receiving the authentication information and the new login password sent by the terminal, the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal to the new login password when the authentication is passed. . The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

The present disclosure further provides a terminal. Referring to FIG. 7, FIG. 7 is a schematic diagram of a functional module of a first embodiment of the present disclosure. The terminal proposed by the present disclosure includes the following modules.

The first sending module 110 is configured to send a login page request to the server.

In this embodiment, the login authentication method can be used for the web UI login authentication method. The login page request can be used to log in to the web UI authentication request.

The first receiving module 120 is configured to receive, by the server, a login page that is returned based on the login page request, an encrypted authentication random number, and a punctured random number, and the authentication random number and the punctured random number both utilize pre-stored The login password corresponding to the terminal is encrypted.

The first generation module 130 is configured to: after receiving the login password input by the user based on the login page, The received login password decrypts the authentication random number and the punched random number returned by the server, and generates authentication information according to the decrypted authentication random number and the punched random number.

The first sending module 110 is further configured to send the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication passes.

The terminal provided by the present disclosure sends a login page request to the server, and receives a login page returned by the server based on the login page request, an encrypted authentication random number, and a punctured random number, and receives the user based on the login page. After inputting the login password, decrypting the authentication random number and the punching random number returned by the server by using the received login password, and generating authentication information according to the decrypted authentication random number and the punched random number, and then the terminal will The authentication information is sent to the server for the server to authenticate the received authentication information, and allows the terminal to log in when the authentication is passed. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

Further, based on the first embodiment of the present disclosure, the present disclosure further provides a second embodiment of the terminal. Referring to FIG. 8, FIG. 8 is a schematic diagram of the refinement function module of the first generation module in the second embodiment of the present disclosure. . In the second embodiment, the first generation module 130 includes a first calculation unit 131 configured to calculate a digest value of the decrypted authentication random number. In this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms. The first calculating unit 131 is further configured to calculate the punching position and the punching length according to the decrypted punching random number. It can be understood that the puncturing length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

The first generating unit 132 is configured to delete data corresponding to the punching position and the punching length of the digest value, and advance other data after the deleted data to the punching length to generate a Describe the authentication information.

The present disclosure further provides a server. Referring to FIG. 9, FIG. 9 is a schematic diagram of a function module of a first embodiment of the present disclosure. The server provided by the present disclosure includes a first returning module 210, and is configured to receive a login page sent by the terminal. After the request, the login page, the encrypted authentication random number, and the punctured random number are returned to the terminal, and the authentication random number and the punctured random number are encrypted by using the pre-stored login password corresponding to the terminal. After receiving the login password input by the user based on the login page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received login password, and according to the decrypted authentication random number and playing The hole random number generates authentication information and transmits the authentication information to the server.

The server further includes a first authentication module 220 configured to, after receiving the authentication information sent by the terminal, authenticate the received authentication information, and allow the terminal to log in when the authentication is passed.

The server provided by the present disclosure returns a login page, an encrypted authentication random number, and a punctured random number to the terminal after receiving the login page request sent by the terminal, and the authentication random number and the puncturing random number are utilized by the server. The pre-stored login password corresponding to the terminal is encrypted, so that after receiving the login password input by the user based on the login page, the terminal uses the received login password to return the authentication random number to the server. The hole random number is decrypted, and the authentication information is generated according to the decrypted authentication random number and the punctured random number, and the authentication information is sent to the server; after receiving the authentication information sent by the terminal, the server receives the authentication information. The authentication is performed and the terminal is allowed to log in when the authentication is passed. The present disclosure generates authentication information by using an authentication random number and a punctured random number, and authenticates The random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, effectively avoiding the leakage of the Web UI login password and improving the security of the Web UI login.

Further, based on the first embodiment of the present disclosure, the present disclosure further provides a second embodiment of the server. Referring to FIG. 10, FIG. 10 is a schematic diagram of a refinement function module of the authentication module in the second embodiment of the disclosure server. In the second embodiment, the first authentication module 220 includes: a second calculating unit 221 configured to calculate a digest value of the pre-stored authentication random number. In this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms.

The second calculating unit 221 may further be configured to calculate the punching position and the punching length according to the pre-stored punching random number. It can be understood that the puncturing length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

The first authentication module 220 further includes a second generating unit 222, configured to delete data corresponding to the punching position and the punching length of the digest value, and advance other data after the deleted data. Puncturing length to generate an authentication digest value.

The first authentication module 220 further includes an authentication unit 223 configured to compare the authentication digest value with the received authentication information, and if they are consistent, determine that the authentication is passed.

The present disclosure further provides a terminal. Referring to FIG. 11, FIG. 11 is a schematic diagram of a function module of a third embodiment of the present disclosure. The terminal provided by the present disclosure includes: a second sending module 310, configured to send a login password modification page request to the server. . In this embodiment, the login password modification authentication method can be used for the Web UI login password modification authentication method. The login password modification page request can modify the authentication request for the web UI login password.

The terminal further includes a second receiving module 320, configured to receive, by the server, a login password modification page, an encrypted authentication random number, and a punctured random number returned according to the login password modification page request, and the authentication random number and the punching random number The numbers are all encrypted using the pre-stored original login password corresponding to the terminal.

The terminal further includes a second generating module 330, configured to: after receiving the original login password and the new login password input by the user based on the login password modification page, using the received original login password to return the authentication random number to the server The punctured random number is decrypted, and the authentication information is generated according to the decrypted authentication random number and the punctured random number.

Optionally, the generating the authentication information according to the decrypted authentication random number and the punctured random number includes the following steps.

The second sending module 310 is further configured to send the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and pre-stores the pre-stored original corresponding to the terminal when the authentication is passed. The login password is updated to the new login password.

The terminal provided by the disclosure sends a login password modification page request to the server through the terminal, and receives a login password modification page returned by the server based on the login password modification page request, the encrypted authentication random number and the punched random number, and receives at the terminal. After the user enters the original login password and the new login password based on the login password modification page, the authenticated random number and the punched random number returned by the server are decrypted by using the received original login password, and are randomly selected according to the decrypted authentication. The number and the punctured random number generate authentication information, and then send the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and pre-stores the pre-stored corresponding to the terminal when the authentication is passed. The original login password is updated to the new login password. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

The present disclosure further provides a server. Referring to FIG. 12, FIG. 12 is a schematic diagram of functional modules of a third embodiment of the present disclosure. The server proposed by the present disclosure includes the following modules.

The second returning module 410 is configured to: after receiving the login password modification page request sent by the terminal, return a login password modification page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching The random number is encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page, and uses the received The original login password decrypts the authentication random number and the punched random number returned by the server, generates authentication information according to the decrypted authentication random number and the punched random number, and sends the authentication information and the new login password to the server;

The second authentication module 420 is configured to, after receiving the authentication information and the new login password sent by the terminal, authenticate the received authentication information, and store the pre-stored original login password corresponding to the terminal when the authentication is passed. Update to the new login password.

Optionally, the authenticating the received authentication information includes the following steps.

The digest value of the pre-stored authentication random number is calculated; in this embodiment, the algorithm for calculating the digest value may be MD5 or SHA-1 or other algorithms.

The punching position and the punching length are calculated according to the pre-stored punching random number; it can be understood that the punching length can be measured in bytes or in bits. That is, the puncturing length can be the number of punctured bytes or the number of punctured bits.

The server provided by the disclosure, after receiving the login password modification page request sent by the terminal, returns a login password modification page, an encrypted authentication random number and a punched random number to the terminal, and the authentication random number and the punching The random number is encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page, and uses the received The original login password decrypts the authentication random number and the punched random number returned by the server, generates authentication information according to the decrypted authentication random number and the punched random number, and sends the authentication information and the new login password to the server; the server is After receiving the authentication information and the new login password sent by the terminal, the received authentication information is authenticated, and the pre-stored original login password corresponding to the terminal is updated to the new login password when the authentication is passed. The present disclosure generates authentication information by using the authentication random number and the punctured random number, and the authentication random number and the punctured random number are encrypted by using the login password, so that the attacker cannot crack the login password through the HASH dictionary attack, thereby effectively avoiding the Web UI login. The password is leaked to improve the security of the web UI login.

It is to be understood that the term "comprises", "comprising", or any other variants thereof, is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes those elements. It also includes other elements that are not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The above-mentioned serial numbers of the embodiments of the present disclosure are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the present disclosure, which is essential or contributes to the related art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, CD-ROM). The instructions include a number of instructions for causing a terminal device (which may be a cell phone, computer, server, air conditioner, or network device, etc.) to perform the methods described in various embodiments of the present disclosure.

The above is only a preferred embodiment of the present disclosure, and is not intended to limit the scope of the patents of the present disclosure, and the equivalent structure or equivalent process transformations made by the present disclosure and the contents of the drawings may be directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present disclosure.

Claims

A login authentication method, including:

The terminal sends a login page request to the server;

The terminal receiving server returns a login page, an encrypted authentication random number, and a punctured random number based on the login page request, and the authentication random number and the punctured random number are both performed by using a pre-stored login password corresponding to the terminal. encryption;

After receiving the login password input by the user based on the login page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received login password, and according to the decrypted authentication random number and punching Generate random authentication information;

The terminal sends the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication is passed.
The login authentication method according to claim 1, wherein the step of generating authentication information according to the decrypted authentication random number and the punctured random number comprises:

Calculating a digest value of the decrypted authentication random number;

Calculating the punching position and the punching length according to the decrypted random number of punching holes;

Data corresponding to the punching position and the punching length of the digest value is deleted, and other data after the deleted data is advanced by the punching length to generate the authentication information.
The login authentication method of claim 1, further comprising:

After receiving the login page request sent by the terminal, the server returns a login page, an encrypted authentication random number, and a punctured random number to the terminal, and the authentication random number and the punctured random number are both pre-stored and corresponding to the terminal. The login password is encrypted, so that the terminal decrypts the authentication random number and the punched random number returned by the server by using the received login password after receiving the login password input by the user based on the login page, and Generating authentication information according to the decrypted authentication random number and the punctured random number, and transmitting the authentication information to the server;

After receiving the authentication information sent by the terminal, the server authenticates the received authentication information and allows the terminal to log in when the authentication is passed.
The login authentication method according to claim 3, wherein the step of authenticating the received authentication information comprises:

Calculating a digest value of the pre-stored authentication random number;

Calculating the punching position and the punching length according to the pre-stored random number of punching holes;

Deleting the data corresponding to the punching position and the punching length of the digest value, and moving the other data after the deleted data to the punching length to generate an authentication digest value;

The authentication digest value is compared with the received authentication information, and if they are consistent, the authentication is determined to pass.
The login authentication method of claim 1, further comprising:

The terminal sends a login password modification page request to the server;

Receiving, by the terminal receiving server, a login password modification page, an encrypted authentication random number, and a punching random number, which are returned by the login password modification page request, and the authentication random number and the punching random number are both pre-stored and corresponding to the terminal The original login password is encrypted;

After receiving the original login password and the new login password input by the user based on the login password modification page, the terminal decrypts the authentication random number and the punched random number returned by the server by using the received original login password, according to the decryption. The authentication random number and the punctured random number generate authentication information;

Sending the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal to the new login password when the authentication is passed.
The login authentication method of claim 5, further comprising:

After receiving the login password modification page request sent by the terminal, the server returns a login password modification page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching random number both use the pre-stored The original login password corresponding to the terminal is encrypted, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page, and returns the original login password to the server. Decrypting the authentication random number and the punctured random number, generating authentication information according to the decrypted authentication random number and the punctured random number, and transmitting the authentication information and the new login password to the server;

After receiving the authentication information and the new login password sent by the terminal, the server authenticates the received authentication information, and updates the pre-stored original login password corresponding to the terminal to the new login password when the authentication is passed. .
A terminal comprising:

a first sending module, configured to send a login page request to the server;

The first receiving module is configured to receive, by the server, a login page that is returned based on the login page request, an encrypted authentication random number, and a punctured random number, and the authentication random number and the punctured random number are both pre-stored and The login password corresponding to the terminal is encrypted;

The first generating module is configured to: after receiving the login password input by the user based on the login page, decrypt the authentication random number and the punching random number returned by the server by using the received login password, and according to the decrypted The authentication random number and the punched random number generate authentication information;

The first sending module is further configured to send the authentication information to the server, so that the server authenticates the received authentication information, and allows the terminal to log in when the authentication passes.
The terminal of claim 7, wherein the first generation module comprises:

a first calculating unit, configured to calculate a digest value of the decrypted authentication random number;

The first calculating unit is further configured to calculate a punching position and a punching length according to the decrypted punching random number;

a first generating unit, configured to delete data corresponding to the punching position and the punching length of the digest value, and advance other data after the deleted data to the punching length to generate the Certification Information.
A server that includes:

The first returning module is configured to: after receiving the login page request sent by the terminal, return a login page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching random number are both pre-stored And the login password corresponding to the terminal is encrypted, so that after the terminal receives the login password input by the user based on the login page, the terminal uses the received login password to return the authentication random number and punched by the server. Decrypting the random number, and generating authentication information according to the decrypted authentication random number and the punctured random number, and transmitting the authentication information to the server;

The first authentication module is configured to, after receiving the authentication information sent by the terminal, authenticate the received authentication information, and allow the terminal to log in when the authentication is passed.
The server of claim 9, wherein the first authentication module comprises:

a second calculating unit, configured to calculate a digest value of the pre-stored authentication random number;

The second calculating unit is further configured to calculate a punching position and a punching length according to the pre-stored punching random number;

a second generating unit, configured to delete data corresponding to the punching position and the punching length of the digest value, and advance other data after the deleted data to the punching length to generate an authentication digest value;

The authentication unit is configured to compare the authentication digest value with the received authentication information, and if they are consistent, determine that the authentication is passed.
The terminal of claim 7, further comprising:

a second sending module, configured to send a login password modification page request to the server;

The second receiving module is configured to receive, by the server, a login password modification page, an encrypted authentication random number, and a punched random number returned according to the login password modification page request, and the authentication random number and the punching random number are both pre-stored Encrypting the original login password corresponding to the terminal;

a second generating module, configured to: after receiving the original login password and the new login password input by the user based on the login password modification page, using the received original login password to return the authentication random number and the punching random number to the server Decrypting, generating authentication information according to the decrypted authentication random number and the punching random number;

The second sending module is further configured to send the authentication information and the new login password to the server, so that the server authenticates the received authentication information, and pre-stores the original login corresponding to the terminal when the authentication is passed. The password is updated to the new login password.
The server of claim 9 further comprising:

The second returning module is configured to: after receiving the login password modification page request sent by the terminal, return a login password modification page, an encrypted authentication random number, and a punched random number to the terminal, and the authentication random number and the punching random number The number is encrypted by using the pre-stored original login password corresponding to the terminal, so that the terminal receives the original login password and the new login password input by the user based on the login password modification page, and uses the received original The login password decrypts the authentication random number and the punched random number returned by the server, generates authentication information according to the decrypted authentication random number and the punched random number, and sends the authentication information and the new login password to the server;

The second authentication module is configured to: after receiving the authentication information and the new login password sent by the terminal, authenticating the received authentication information, and updating the pre-stored original login password corresponding to the terminal when the authentication is passed For the new login password.