Web system oriented logging-in method

Abstract

The invention relates to a Web system oriented logging-in method. The method comprises the following steps: when a user employs a browser to access a Web system which is not logged-in, the Web system submits session identification data between the browser and the Web system and a temporary stored identifier of the session identification data to a mobile logging-in server for temporary storage, meanwhile displays the temporary stored identifier in a form of bar codes through a user browser; a mobile logging-in assistant in a user mobile terminal obtains the temporary stored identifier through scanning the bar codes and submits the temporary stored identifier to the mobile logging-in server; after completion of identity authentication of the user, the mobile logging-in server replaces the user to log-in the Web system by using the session identification data corresponding to the temporary stored identifier, or returns the session identification data corresponding to the temporary stored identifier to the mobile logging-in assistant for logging-in the Web system, or encrypts the session identification data corresponding to the temporary stored identifier by using a user encryption key and then returns the session identification data corresponding to the temporary stored identifier to the mobile logging-in assistant for logging-in the Web system after the session identification data are decrypted.

Description

technical field [0001] The invention belongs to the technical field of information security, in particular to a web system-oriented login method. Background technique [0002] Users of network information or application systems may encounter the following problems when accessing network information or application systems. [0003] First, when a user uses a public computer to log in to the information or application system to be accessed in a public environment such as an Internet cafe, such as logging in to QQ or online games, since the public computer may be installed with a Trojan horse, the account name and password of the user logging in to the system may be monitored, The risk of theft (even dynamic passwords cannot avoid this security risk). [0004] The second is that users have account names and passwords to remember in different information or application systems. If there are too many account names and passwords, it is easy to forget and confuse them. [0005] Th...

AI Technical Summary

Problems solved by technology

[0003] First, when a user uses a public computer to log in to the information or application system to be accessed in a public environment such as an Internet cafe, such as logging in to QQ or online games, since the public computer may be installed with a Trojan horse, the account name and password of the user logging in to the system may be monitored, The risk of theft (even dynamic passwords cannot avoid this security risk)

[0004] The second is that users have account names and passwords to remember in different information or application systems. If there are too many account names and passwords, it is easy to forget and confuse them.

[0005] Third, in some occasions with high security requirements, users need to use cryptographic hardware such as USB Keys that store digital certificates and private keys, but if there are multiple USB Key cryptographic hardware that needs to be carried, it will cause inconvenience to users

The biggest feature of 201510472645.X is that it is easy to implement, and the Web system authenticates the user login in the original way. However, there is also a problem in the solution in 201510472645.X, that is, the session identification data is returned to the browser in plain text and Via browser page display, this puts session ID data at risk of being stolen (from the page) by maliciously injected scripts

But there are also some problems in this scheme: the one, the user will input the user's account name in the Web system or an identity mark of the user in the browser, which brings additional troubles to the user; Entering the user's account name in the Web system through the browser will cause the leakage of user information and leave clues for the attacker to crack the account password. The corresponding password password of the same or similar account name to guess the password password of the user in the web system to be logged in (so-called credential stuffing)