Method for pass user to realize safety login application client and system thereof

Abstract

The invention discloses a method for a pass user to realize safety login application client and a system thereof. The method is characterized by: integrating security controls published by a pass service center on an application client, starting the application client and inputting an account and a password in a security control interface displayed by the application client; acquiring the password by using the security control, carrying out encryption according to a preset encryption algorithm and a stored secret key so as to obtain a cipher and sending the account and the cipher to an application platform server through the application client; forwarding an authentication request to the pass service center by using the application platform; extracting a stored clear-text password according to the account by using the pass service center, carrying out encryption processing which is consistent to the security controls the clear-text password, comparing the encrypted password with the received cipher; if the password is the same with the cipher, passing the authentication. By using the method and the system of the invention, a safety application problem of a pass account service provider under the condition that a network authentication system is mutually independent with a Internet application system can be solved.

Description

Technical field [0001] The invention belongs to the network security authentication technology in the field of Internet communication, and relates to related content such as Internet passes, software control integration, security encryption technology and the like. Background technique [0002] An Internet pass means that a user who has a specific pass account can use all Internet network services related to the pass, which avoids the cumbersome management of accounts and passwords that require multiple registrations and multiple logins when users visit multiple websites. At present, Microsoft, Yahoo, Sina, Tencent, etc., as well as China Mobile, China Telecom and other service providers are promoting the Internet pass business, providing a service experience of "one account, unified authentication, and full network access". The pass account application of major service providers is not limited to web browser login access, but also extends to application client login access (such...

AI Technical Summary

Problems solved by technology

However, when a passport user logs in to access Internet services based on the application client, if the client directly receives the user's keyed passport account number and static password, and then the application background server forwards it to the passport service center for login authentication, in this scenario the client is completely conditional to record all The account number and password for successfully logging in to the application through the client, especially if the client software has been cracked by hackers, or the client is owned by a third-party partner, the consequences of this type of security risk will be fatal

[0005] At present, related technologies related to Internet account and password security mainly focus on software anti-hacking and anti-trojan horses, flexible encryption of user data, temporary or dynamic password mechanisms, etc., but the basic premise is that the authentication system function is provided by the application service system itself, so the user password It is visible and trustworthy to the application client, which is different from the user password protection goal of the public account service provider

Images