CN103428221A - Safety logging method, system and device of mobile application - Google Patents

The invention provides a safety logging method of a mobile application. The safety logging method includes the following steps that the encryption key arrangement is performed on the mobile application in a cloud server and a mobile terminal, and an encryption key is stored in the cloud server and the mobile terminal respectively; the cloud server receives a logging verification request sent by the mobile application, wherein the logging verification request comprises a user name and a first encryption string, and the first encryption string comprises information obtained after a user code is encrypted through the encryption key; the cloud server decrypts the first encryption string according to the encryption key so as to obtain the user code; the cloud server performs logging verification on the mobile terminal according to the user code. According to the safety logging method of the mobile application, through the encryption key arrangement, safety of a logging system on the mobile application is ensured, and user privacy is protected. The invention further discloses a safety logging system and the cloud server for the mobile application.

Safe login method, system and device to mobile application

Technical field

The present invention relates to mobile interconnection technique field, particularly a kind of safe login method, system and device to mobile application.

Background technology

The development of the Internet also is accompanied by the growth of network security threats.Service in a lot of websites needs the user just can use after logining, and in login process, needs account and the password of transmission user.The user login information that many hackers are transmitted by intercepting, malice is stolen user account and password, has threatened user's individual account number safety.

General traditional login system, when submitting user's logging request to, in order to guarantee the user cipher safe transmission, generally can adopt the data transmission mechanism based on ssl protocol, as adopted the https agreement.

Under mobile network at home, use the https consultation following fatal problem to occur:

(1), the gateway of some mobile operator do not support the https agreement, as CMWAP gateway early.

(2), because mobile network's transmission speed itself is slower, add three SSL handshake process of https agreement existence and https certificate checking procedure, and certification authentication mechanism all abroad, these all cause the upper https of use of mobile network consultation at home the problem that response speed is very slow to occur.

For fear of cause the user to experience sharply because of the problems referred to above, worsen, many movements are applied in while submitting user's logging request to all directly uses the http agreement.If process but user cipher is not done to respective encrypted, directly use the http agreement, user cipher is easy to be got by operations such as network packet capturings by the hacker, causes user profile to reveal, and threatens user information safety.In order to address this problem, great majority adopt the mobile application meeting of http agreement before sending logging request, first in client, by default fixed key, the password of user's input is done to symmetry or asymmetric encryption, then the password after encrypting is sent to service end, after service end receives the password of encryption, obtain the password of user's input by same fixed key deciphering, relatively carry out the validity of authentication of users password by the user's original password with the service end preservation.This mode has improved the fail safe of user cipher to a certain extent, but in fact, this login system is still safe not, and reason is as follows:

(1) if what adopt during the client encrypt user cipher is symmetric encipherment algorithm, the hacker can pass through reverse-engineering decompiling client-side program, know cryptographic algorithm details and default fixed key, serve, when the hacker obtains by the network packet capturing user cipher of encrypting, can obtain the real password of user according to corresponding decipherment algorithm.

(2) if what adopt during the client encrypt user cipher is rivest, shamir, adelman, the hacker can't utilize the method in () to obtain the real password of user.But the hacker can pass through the Replay Attack means, the user name obtained during by the network packet capturing and the password of encryption again are sent to service end and are logined, and obtain the subscriber sign-in conversation information that service end is returned, and obtain all operations power of user account.In like manner, during the customer end adopted symmetric encipherment algorithm, the hacker also can realize logining by this means victim's account.

To be client carrying out user cipher while encrypting to the main cause that the problems referred to above occur, the key adopted be immobilize, effectively permanent.Therefore account information is easily stolen, makes user profile reveal, and user account is endangered.

Summary of the invention

The present invention is intended at least solve one of technical problem existed in prior art.

For this reason, one object of the present invention is to propose a kind of safe login method for mobile application, by encrypted key exchange, guarantees the fail safe of the upper login system of mobile application, has protected privacy of user.

Second purpose of the present invention is to propose a kind of Security Login System for mobile application.

The 3rd purpose of the present invention is to propose a kind of cloud server.

For achieving the above object, the embodiment of first aspect present invention has proposed a kind of safe login method for mobile application, comprise the following steps: the mobile application in cloud server and mobile terminal is encrypted key agreement, and preserves encryption key respectively in described cloud server and mobile terminal; Described cloud server receives the login authentication request that described mobile application sends, and wherein, described login authentication request comprises user name and the first encryption string, and described first encrypts string comprises the information after by described encryption key, user cipher being encrypted; Described cloud server is encrypted string according to described encryption key to described first and is decrypted to obtain described user cipher; Described cloud server carries out login authentication according to described user cipher to described mobile terminal.

According to the safe login method for mobile application of the embodiment of the present invention, encryption key is stored in cloud server and mobile terminal through consultation, by encryption key, realizes encryption and decryption.The encryption key of consulting can personalize, even the password of encrypting is maliciously obtained also, can't obtain key, makes and adopts the http agreement to send request the fail safe that also can guarantee to move the login system in application, has protected privacy of user.

In one embodiment of the invention, described the first encryption string also comprises the information after by described encryption key, the current time being encrypted.

In one embodiment of the invention, also comprise: described cloud server is encrypted string according to described encryption key to described first and is decrypted to obtain the described current time; Described cloud server judged whether effectively according to the described current time; When judging, described cloud server returns to error message to described mobile terminal when invalid.During each login, the content of password encryption string effectively, can prevent Replay Attack to a certain extent in the configurable scope of time interval length.

In one embodiment of the invention, the mobile application in described cloud server and mobile terminal is encrypted key agreement and further comprises: store the acquiescence encryption key in described cloud server and mobile terminal; When described cloud server is logined for the first time at described mobile terminal, by described acquiescence encryption key and described mobile terminal, be encrypted key agreement.

The embodiment of second aspect present invention has proposed a kind of Security Login System for mobile application, comprises mobile terminal and cloud server.

Wherein, preserve respectively the encryption key after consulting in described cloud server and mobile terminal, wherein, described mobile terminal is for sending the login authentication request to described cloud server, wherein, described login authentication request comprises user name and the first encryption string, and described first encrypts string comprises the information after by described encryption key, user cipher being encrypted; Described cloud server is decrypted to obtain described user cipher for according to described encryption key, to described first, encrypting string, and according to described user cipher, described mobile terminal is carried out to login authentication.

According to the Security Login System for mobile application of the embodiment of the present invention, encryption key is stored in cloud server and mobile terminal through consultation, by encryption key, realizes encryption and decryption.The encryption key of consulting can personalize, even the password of encrypting is maliciously obtained also, can't obtain key, makes and adopts the http agreement to send request the fail safe that also can guarantee to move the login system in application, has protected privacy of user.

In one embodiment of the invention, described the first encryption string also comprises the information after by described encryption key, the current time being encrypted.

In one embodiment of the invention, described cloud server, also be decrypted to obtain the described current time for according to described encryption key, to described first, encrypting string, and judge whether effectively according to the described current time, and, when judgement is invalid, to described mobile terminal, return to error message.During each login, the content of password encryption string effectively, can prevent Replay Attack to a certain extent in the configurable scope of time interval length.

In one embodiment of the invention, store the acquiescence encryption key in described cloud server and mobile terminal, when described cloud server is logined for the first time at described mobile terminal, by described acquiescence encryption key and described mobile terminal, be encrypted key agreement.

The embodiment of third aspect present invention has proposed a kind of cloud server, preserve respectively the encryption key after consulting in described cloud server and mobile terminal, wherein, described cloud server comprises login authentication request receiving module, deciphering module and login authentication module.

Wherein, the login authentication request that login authentication request receiving module sends for receiving described mobile application, wherein, described login authentication request comprises user name and the first encryption string, and described first encrypts string comprises the information after by described encryption key, user cipher being encrypted; Deciphering module is decrypted to obtain described user cipher for according to described encryption key, to described first, encrypting string; The login authentication module is for carrying out login authentication according to described user cipher to described mobile terminal.

According to the cloud server of the embodiment of the present invention, encryption key is stored in cloud server and mobile terminal through consultation, by encryption key, realizes encryption and decryption.The encryption key of consulting can personalize, even the password of encrypting is maliciously obtained also, can't obtain key, makes and adopts the http agreement to send request the fail safe that also can guarantee to move the login system in application, has protected privacy of user.

In one embodiment of the invention, described the first encryption string also comprises the information after by described encryption key, the current time being encrypted.

In one embodiment of the invention, described deciphering module is encrypted to go here and there to described first according to described encryption key and is decrypted to obtain the described current time.

In one embodiment of the invention, described login authentication module judges whether effectively according to the described current time, when described cloud server judges, returns to error message to described mobile terminal when invalid.During each login, the content of password encryption string effectively, can prevent Replay Attack to a certain extent in the configurable scope of time interval length.

In one embodiment of the invention, store the acquiescence encryption key in described cloud server and mobile terminal, when described cloud server is logined for the first time at described mobile terminal, by described acquiescence encryption key and described mobile terminal, be encrypted key agreement.

Additional aspect of the present invention and advantage part in the following description provide, and part will become obviously from the following description, or recognize by practice of the present invention.

The accompanying drawing explanation

Above-mentioned and/or additional aspect of the present invention and advantage are from obviously and easily understanding becoming the description of embodiment in conjunction with following accompanying drawing, wherein:

Fig. 1 is the flow chart according to the safe login method for mobile application of the embodiment of the present invention;

Fig. 2 is the schematic flow sheet according to the encrypted key exchange of the embodiment of the present invention;

Fig. 3 is the schematic flow sheet according to the secure log of the embodiment of the present invention;

Fig. 4 is the structural representation according to the Security Login System for mobile application of the embodiment of the present invention; With

Fig. 5 is the structural representation according to the cloud server of the embodiment of the present invention.

Embodiment

Below describe embodiments of the invention in detail, the example of described embodiment is shown in the drawings, and wherein same or similar label means same or similar element or the element with identical or similar functions from start to finish.Be exemplary below by the embodiment be described with reference to the drawings, only for explaining the present invention, and can not be interpreted as limitation of the present invention.

Describe the safe login method for mobile application according to the embodiment of the present invention below with reference to Fig. 1, comprise the following steps:

Step S110: the mobile application in cloud server and mobile terminal is encrypted key agreement, and preserves encryption key in server and mobile terminal beyond the clouds respectively.

Wherein, the mobile application in cloud server and mobile terminal is encrypted key agreement and further comprises:

Step S111: store the acquiescence encryption key in cloud server and mobile terminal.

Step S112: when cloud server is logined for the first time at mobile terminal, by acquiescence encryption key and mobile terminal, be encrypted key agreement.

Step S120: cloud server receives the login authentication request that mobile application sends, and wherein, the login authentication request comprises user name and the first encryption string, and first encrypts string comprises the information after by encryption key, user cipher being encrypted.

Wherein, the first encryption string also comprises the information after by encryption key, the current time being encrypted.

Step S130: cloud server is decrypted to obtain user cipher according to encryption key to the first encryption string.

Step S140: cloud server carries out login authentication according to user cipher to mobile terminal.

In one embodiment of the invention, also comprise:

Step S151: cloud server is decrypted to obtain the current time to the first encryption string according to encryption key.

Step S152: cloud server judged whether effectively according to the current time.

Step S153: when cloud server judges, return to error message to mobile terminal when invalid.

Below take Fig. 2 and Fig. 3 as example realizes describing to this method complete skill, be understandable that, following implementation method only for illustrative purposes, is not limited to this according to embodiments of the invention.

This method comprises encrypted key exchange and two subprocess of login.

At first, the mobile application in cloud server and mobile terminal is encrypted key agreement, and preserves encryption key in server and mobile terminal beyond the clouds respectively.

Store the acquiescence encryption key in cloud server and mobile terminal.

When mobile terminal is logined for the first time, by acquiescence encryption key and mobile terminal, be encrypted key agreement when cloud server.

Concrete, as shown in Figure 2, the user can also arrange encryption key, comprises the steps:

Step S210: the user logins mobile application, enters the interface that encryption key is set.

Step S220: the mobile application in mobile terminal is sent to cloud server by the encryption key of user's input.

Step S230: cloud server is according to active user's login sessions acquisition of information user account information.

Step S240: cloud server is preserved the user encryption key received as the part of user account information, and returns to corresponding response message to mobile terminal.

Step S250: the mobile application in mobile terminal is cached to the encryption key of user's input in respective storage medium.

After mobile application key agreement preservation in cloud server and mobile terminal, the user can apply and be logined by movement, and flow process as shown in Figure 3.

Step S310: the user submits logging request to.

Step S311: the encryption key be buffered in the mobile terminal respective storage medium is read in mobile application.If encryption key does not exist, using the acquiescence encryption key preset as encryption key

Step S312: mobile application is done symmetric cryptography according to encryption key by information such as user cipher and current network times, obtains the first encryption string.

Step S313: mobile application is submitted the login authentication request to cloud server, and the login authentication request comprises the information such as user name and the first encryption string.

Step S320: cloud server reads user account information corresponding to user name from database, and wherein, user account information comprises user's password plaintext and the encryption key set in advance.

Step S321: cloud server judges whether user account exists.

Step S322_1: if there is no, return to error message.And execution step S330..

Step S330: mobile application, for error message, is carried out the relative users prompting and is processed, and the guiding user re-enters user name, password.

Step S322: if exist, if the not default encryption key of user, the acquiescence encryption key that cloud server judges to preset is as user's encryption key.Wherein, the acquiescence encryption key is identical with acquiescence encryption key default on mobile terminal.

Step S323: the cloud server judgement is decrypted the first encryption string according to encryption key, obtains the password of user's input and the network time value that mobile terminal provides.

Step S324: whether the user cipher that cloud server checking deciphering obtains is expressly identical with the password in user account information.

Step S325_1: if different, cloud server returns to error message.Skip to step S330.

Step S325: if identical, the cloud server current time judges whether effectively.Particularly, whether the network time that cloud server inspection deciphering obtains and the difference of current system timestamp be in default threshold values, if in threshold values be effective.

Step S326_1: if judge invalidly, cloud server returns to error message.Skip to step S330.

Step S327: if effectively, cloud server generates user's login sessions information and it is returned to mobile terminal according to described user account information.

Step S340: the mobile application in mobile terminal receives login sessions information, completes the respective handling after login.

Wherein, the current network time can be obtained from network time server by Network Time Protocol by mobile terminal, also can when returning to user's login interface, with page content, be returned together by cloud server, can be perhaps by mobile terminal before sending the logging request bag, by the network interaction with cloud server, obtain.The current system timestamp that cloud server obtains is general and network time synchronization.

In addition, during due to each login, in password encryption string content, all contain timestamp, and this timestamp is only within a certain period of time, effective in the configurable scope of this time interval length, so can prevent Replay Attack to a certain extent.Even be reproduced the verification also be difficult to by cloud server, thereby can't successfully login.And, because each user's encryption key is different, even the hacker obtains cryptographic algorithm by reverse-engineering, the password encryption string that also can't obtain packet capturing is decrypted the password that obtains the user.Further, even the hacker has been known cryptographic algorithm, and obtained user's password by other means, as long as he can't obtain user's encryption key, account that also can't login user.In theory, encryption key only has user, user's mobile terminal and cloud server just can obtain.Therefore, fail safe of the present invention is relatively very high.

The safe login method for mobile application according to the embodiment of the present invention; carry out secure log based on user-defined encryption key; make and adopt the http agreement to send request the fail safe that also can guarantee to move the login system in application, protected privacy of user.

First encrypts string also comprises the information after by encryption key, the current time being encrypted.

Below the native system complete skill is realized describing, be understandable that, following implementation method only for illustrative purposes, is not limited to this according to embodiments of the invention.

Native system comprises encrypted key exchange and two subprocess of login.

Step S420: cloud server 120 reads user account information corresponding to user name from database, and wherein, user account information comprises user's password plaintext and the encryption key set in advance.

Step S421: cloud server 120 judges whether user account exists.

Step S422_1: if there is no, return to error message.And execution step S430..

Step S430: mobile application, for error message, is carried out the relative users prompting and is processed, and the guiding user re-enters user name, password.

Step S424_1: if different, cloud server 120 returns to error message.Skip to step S430.

Step S424: if identical, 120 current time of cloud server judge whether effectively.Particularly, whether the difference that cloud server 120 checks network time that deciphering obtains and current system timestamp is in default threshold values, if in threshold values be effective.

Step S425_1: if judge invalidly, cloud server 120 returns to error message.Skip to step S330.

The Security Login System for mobile application according to the embodiment of the present invention; carry out secure log based on user-defined encryption key; make and adopt the http agreement to send request the fail safe that also can guarantee to move the login system in application, protected privacy of user.

Wherein, the first encryption string also comprises the information after by encryption key, the current time being encrypted.

Store the acquiescence encryption key in cloud server and mobile terminal, when cloud server is logined for the first time at mobile terminal, by acquiescence encryption key and mobile terminal, be encrypted key agreement.

Below the complete skill of this cloud server is realized describing, be understandable that, following realization only for illustrative purposes, is not limited to this according to embodiments of the invention.

This cloud server participates in encrypted key exchange and two subprocess of login in the technical program.

At first, the mobile application in cloud server and mobile terminal is encrypted key agreement, and preserves encryption key in server and mobile terminal beyond the clouds respectively.

Store the acquiescence encryption key in cloud server and mobile terminal.

When mobile terminal is logined for the first time, by acquiescence encryption key and mobile terminal, be encrypted key agreement when cloud server.

The user can also arrange encryption key, comprising: the user logins mobile application, enters the interface that encryption key is set; Mobile application in mobile terminal is sent to cloud server by the encryption key of user's input; Cloud server is according to active user's login sessions acquisition of information user account information; Cloud server is preserved the user encryption key received as the part of user account information, and returns to corresponding response message to mobile terminal: the mobile application in mobile terminal is cached to the encryption key of user's input in respective storage medium.

After mobile application key agreement preservation in cloud server and mobile terminal, the user can apply and be logined by movement, comprising:

The user submits logging request to.The encryption key be buffered in the mobile terminal respective storage medium is read in mobile application.If encryption key does not exist, using the acquiescence encryption key preset as encryption key.Mobile application is done symmetric cryptography according to encryption key by information such as user cipher and current network times, obtains the first encryption string.Mobile application is submitted the login authentication request to cloud server, and the login authentication request comprises the information such as user name and the first encryption string.

Mobile application in mobile terminal receives login sessions information, completes the respective handling after login.Mobile application, for error message, is carried out the relative users prompting and is processed, and the guiding user re-enters user name, password.

Wherein, the current network time can be obtained from network time server by Network Time Protocol by mobile terminal, also can when returning to user's login interface, with page content, be returned together by cloud server, can be perhaps by mobile terminal before sending the logging request bag, by the network interaction with cloud server, obtain.The current system timestamp that cloud server obtains is general and network time synchronization.

In addition, during due to each login, in password encryption string content, all contain timestamp, and this timestamp is only within a certain period of time, effective in the configurable scope of this time interval length, so can prevent Replay Attack to a certain extent.Even be reproduced the verification also be difficult to by cloud server, thereby can't successfully login.And, because each user's encryption key is different, even the hacker obtains cryptographic algorithm by reverse-engineering, the password encryption string that also can't obtain packet capturing is decrypted the password that obtains the user.Further, even the hacker has been known cryptographic algorithm, and obtained user's password by other means, as long as he can't obtain user's encryption key, account that also can't login user.In theory, encryption key only has user, user's mobile terminal and cloud server just can obtain.Therefore, fail safe of the present invention is relatively very high.

According to the cloud server of the embodiment of the present invention, carry out secure log based on user-defined encryption key, make and adopt the http agreement to send request the fail safe that also can guarantee to move the login system in application, protected privacy of user.

In the description of this specification, the description of reference term " embodiment ", " some embodiment ", " example ", " concrete example " or " some examples " etc. means to be contained at least one embodiment of the present invention or example in conjunction with specific features, structure, material or the characteristics of this embodiment or example description.In this manual, the schematic statement of above-mentioned term not necessarily referred to identical embodiment or example.And the specific features of description, structure, material or characteristics can be with suitable mode combinations in any one or more embodiment or example.

Although illustrated and described embodiments of the invention, for the ordinary skill in the art, be appreciated that without departing from the principles and spirit of the present invention and can carry out multiple variation, modification, replacement and modification to these embodiment, scope of the present invention is by claims and be equal to and limit.