CN207442908U - A network identity authentication device and a login device - Google Patents

Abstract

The utility model discloses a network identity authentication device includes internet access terminal and website server, still includes: the first server is connected with the internet access terminal and used for generating and sending registration information of a target website to the second server; and the second server is connected with the first server and the website server and used for sending an authentication request to the website server by using the registration information to complete authentication operation. The utility model discloses a network authentication device, first server can be for user's automatic generation different user names and passwords on each target website that needs to register, and the second server can be directly with the registration information who has user name and password send to the website server and accomplish the authentication operation, under the prerequisite of avoiding the password fatigue, has improved network authentication's security. The utility model also discloses a logger can realize above-mentioned technological effect equally.

Description

A network identity authentication device and a login device

technical field

The utility model relates to the technical field of information security technology control, in particular to a network identity authentication device and a login device.

Background technique

With the expansion of the scale of the Internet and the increase in user demand, the development of cyberspace brings us convenience and speed, but also brings new challenges to personal and national security and social stability. The traditional character-based "username-password "The network identity authentication management mechanism has become the current mainstream network identity authentication management mechanism because of its simple use, strong reliability, easy deployment, and low cost.

However, nowadays a single user needs to face the scenario of registering online identities on multiple websites and managing multiple online identities at the same time, which may encounter a series of serious network security threats such as password fatigue, phishing scams, and credential stuffing attacks.

For example, a user has registered network identities on multiple websites. In order to improve security, different user names and passwords need to be set for different network identities. For this reason, the user needs to memorize a lot of user names and passwords at the same time, which easily causes confusion of multiple user names and passwords, and the user experience is very poor. This is the so-called "password fatigue" problem.

For convenience, most users choose the same or similar user names and share a password, which is easy to remember but less secure. Once one account is stolen, all accounts are at risk of being leaked. Hackers can illegally obtain a large amount of user network identity information by trying to log in with leaked identity information or common passwords. This is the so-called "credential stuffing" attack.

Therefore, how to improve the security of network identity authentication under the premise of avoiding password fatigue is a problem to be solved by those skilled in the art.

Utility model content

The purpose of the utility model is to provide a network identity authentication device and a login device, which improve the security of network identity authentication on the premise of avoiding password fatigue.

In order to achieve the above purpose, the embodiment of the present utility model provides a network identity authentication device, which includes an Internet access terminal and a website server connected to the Internet access terminal, and also includes:

A first server that is connected to the Internet terminal and is used to generate and send registration information of the target website to the second server;

The second server is connected with the first server and the website server, and is used for sending an authentication request to the website server using the registration information to complete the authentication operation.

Wherein, the second server is directly connected to the website server, and is used to directly send the identity information of the target website and the registration information to the website server to complete the authentication operation.

Wherein, the second server is connected to the website server through the Internet access terminal, and is used to forward the identity information of the target website and the registration information to the Internet access terminal, so that the Internet access terminal can send the website server Complete the authentication operation.

Wherein, the second server includes an Internet terminal extension and an extension server;

The Internet terminal is extended to connect the Internet terminal and the first server;

The extension server is connected to the first server and the Internet access terminal extension.

To achieve the above object, an embodiment of the present utility model provides a log-in device, which includes the above-mentioned network identity authentication device, and is used to log in to a terminal device.

It can be seen from the above solutions that a network identity authentication device provided by the embodiment of the present invention includes an Internet terminal and a website server connected to the Internet terminal, and also includes: connected to the Internet terminal, used to generate and report to the second server The first server sending the registration information of the target website; the second server connected to the first server and the website server and used to send an authentication request to the website server using the registration information to complete the authentication operation.

In the network identity authentication device provided by the embodiment of the present invention, the first server can automatically generate different usernames and passwords for the user on each target website that needs to be registered, and the user does not need to remember these usernames and passwords. When using the target website, there is no need to download the required application program from the target website. The second server can directly send the registration information with the user name and password to the website server to complete the authentication operation, avoiding the collision attack caused by too similar user name and password. It can be seen that the network identity authentication device provided by the embodiment of the utility model improves the security of network identity authentication on the premise of avoiding password fatigue. The utility model also discloses a logger, which can also achieve the above-mentioned technical effects.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are only some embodiments of the utility model, and those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic structural diagram of a network identity authentication device disclosed in an embodiment of the present invention;

Fig. 2 is a schematic structural diagram of another network identity authentication device disclosed by the embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. example. Based on the embodiments of the present utility model, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the scope of protection of the present utility model.

The embodiment of the utility model discloses a network identity authentication device, which improves the security of the network identity authentication on the premise of avoiding password fatigue.

Referring to Fig. 1, Fig. 1 is a schematic structural diagram of a network identity authentication device disclosed in an embodiment of the present invention, as shown in Fig. 1, it includes an Internet terminal 101 and a website server 102 connected to the Internet terminal 101, and also includes:

A first server 103 connected to the Internet access terminal for generating and sending the registration information of the target website to the second server;

The second server 104 is connected with the first server and the website server, and is used to use the registration information to send an authentication request to the website server to complete the authentication operation.

In this embodiment, the specific workflow of the network identity authentication device is as follows:

S1: the first server obtains the identity information and registration rules of the target website through the Internet terminal;

The purpose of this step is to obtain the identity information and registration rules of the target website, so that the subsequent steps can automatically generate the registration information of the target website according to the registration rules. The registration information can include the user name and password to log in to the target website, and access the target site.

In a specific implementation, the Internet terminal obtains the identity information and registration rules of the target website through the website server, and sends the identity information and registration rules to the first server. The identity information includes the URL and session information of the target website.

It can be understood that there are many ways for the first server to obtain the identity information and registration rules of the target website, which are not specifically limited here, and those skilled in the art can choose flexibly according to the actual situation. For example, the second server obtains the identity information and registration rules of the target website according to the target website requested by the Internet terminal, and generates a corresponding QR code automatically or when the user clicks on the input box and sends it back to the Internet terminal for display. A two-dimensional code, establishes a secure connection with the second server, and obtains the identity information and registration rules of the target website from the second server through the secure connection.

As another example, the first server first establishes a secure connection with the second server, and the second server obtains the identity information and registration rules of the target website according to the target website requested by the Internet terminal, and then clicks the corresponding input box on the page on the Internet terminal when the user clicks , sending the identity information and registration rules of the target website to the first server through a secure connection.

It should be noted that there are many ways to establish a secure connection in the above examples, which are not specifically limited here. For example, the first server may establish a secure connection with the second server by logging into the second server. As another example, the second server obtains its identity information according to the target website requested by the Internet access terminal, generates a unique session identifier (sessionID), and generates a two-dimensional code containing the unique session identifier, and the first server scans the two-dimensional code The unique session identifier is obtained by means of the method, and the unique session identifier is sent to the second server. The second server checks the received unique session identifier. If the verification is successful, the first server and the second server are completed. An operation that establishes a secure connection between servers.

The first server is a computer system that can be trusted by the user and helps the user to automatically generate account information. It should be noted that each user can authorize multiple first servers, but one first server can only serve one user.

In this step, by default, the first server has been authorized and activated by the user. Wherein, there may be multiple ways for the user to activate the first server, which are not specifically limited here. For example, the user can set a master password for the first server, and activate the first server by inputting the master password. For another example, the user may activate the first server by inputting authorized biometrics, which may include user's iris information, fingerprint information, audio information, etc., which are not specifically limited herein.

After the first server acquires the identity information and registration rules of the target website through the Internet access terminal, it may further include a step of judging whether the target website is a phishing website according to the identity information. Of course, those skilled in the art can choose any method to judge whether the target website is a phishing website, which is within the scope of protection of the embodiments of the present invention. For example, the feature vector of the target website can be extracted by a feature extractor, and the obtained feature vector can be input into a trained classifier for classification, so as to determine whether the target website is a phishing website. When the target website is a phishing website, an alarm prompt can be sent to the user through the Internet terminal. It is understandable that there are various forms of alarm prompts, such as pop-up prompt box, audio, etc., which are not specifically limited here.

S2: Obtain the registration information of the target website according to the identity information, or generate the registration information according to the registration rules;

In a specific implementation, the first server can replace the user to automatically complete the generation of account information (that is, user name and password), and the website server needs to send the information required for registration (such as email address, mobile phone number, etc.) and the rules for user name and password. It is required to inform the first server in an agreed (such as JSON) format. If necessary, the first server can obtain the required information (including the serial number of the first server's software and hardware, etc.) from other channels according to the requirements of the server, and use The information generates a user name and password according to the rules required by the server, together with other information provided by the user (of course, other information automatically obtained by the first server may also be included), to generate the required registration information of the target website.

It should be noted that the first server can also manage the registered network identity of the user. The user's registered network identity information, that is, the user name and password of the registered website can be stored in the first server, and the user can add a new registered account at any time or delete an old registered account and store it in the cloud and multiple first Backup and synchronization between servers.

Before generating the registration information, the first server may find the registered network identity information of the user of the target website according to the identity information and directly execute S3 to complete the login authentication operation. Of course, even if the first server has found one or more historical registration information registered by the target website, the user can still choose to generate a new registration information of the target website according to the registration rules, and then execute S3 to complete the registration Authentication operation.

S3: Send the identity information and the registration information to a second server, so that the second server uses the identity information and the registration information to send an authentication request to the website server to complete the authentication operation.

In a specific implementation, the function of the second server is to send an authentication request to the website server, and the authentication request may be a registration request or a login request. Therefore, before the above-mentioned step of generating the registration information of the target website according to the registration rules, it also includes the step of inquiring whether there is historical registration information of the target website in the identity information table according to the identity information; The historical registration information is used as the login information of the target website, and the identity information and the historical registration information are sent to the second server, so that the second server uses the identity information and the historical registration information to send The website server sends a login request to complete the authentication operation, if not, execute the step of generating the registration information of the target website according to the registration rules.

It can be understood that the user can automatically modify the historical registration information in the identity information table at any time through the first server. The first server first establishes a secure connection with the second server, and obtains the identity information of the website to be modified through the secure connection, the first server queries according to the identity information and automatically modifies the historical registration of the website to be modified according to the registration rules Information, sending the identity information and the modified registration information to the website server through the second server, and the website server notifies the Internet access terminal whether the modification is successful or not after completing the modification of the registration information. It should be noted that the way to establish a secure connection here is similar to the above, and will not be repeated here.

Before the second server uses the identity information and the registration information to send an authentication request to the website server to complete the authentication operation, it may also include a step of judging whether any request including the authentication request is an illegal or malicious request, when the When the registration request is an illegal or malicious request, a warning prompt can be sent to the administrator. It is understandable that there are various forms of warning prompts, such as a pop-up prompt box, audio, etc., which are not specifically limited here. If the registration request is not an illegal or malicious request, execute the step of sending a registration request to the website server by the second server using the identity information and the registration information to complete the authentication operation.

It can be understood that there are many ways to detect malicious requests, which are not specifically limited here. For example, a pre-summarized rule set is used to detect requests; or a classifier trained by a machine learning algorithm is used for detection. The second server first checks and filters the registration and login requests from the first server, so as to improve server efficiency and reduce server pressure. Some websites with a high concentration of login requests (such as "12306", etc.) may have some users who frequently log in and register multiple accounts to engage in illegal activities (such as "scalpers" swiping tickets, etc.). In addition, frequent login attempts are also a common means for attackers to implement "credential stuffing attacks". Under these circumstances, the second server will receive a large number of registration and login requests from the first server within a short period of time. By analyzing the information source parameters contained in these request information, it can be identified whether these requests come from the same first server. If the second server finds that the same first server requests to log in or create a new account on the site server multiple times within a certain period of time, the second server will automatically filter out all requests from the first server and temporarily block the account. first server. The registration and login requests transmitted through the second server will be regarded as legal and valid by the website server, and will be fully responded to and processed by the website server. The processed request result will be fed back to the first server and the user's Internet access terminal for the user to perform the next operation.

It can be seen that when the second server implements the function of monitoring and filtering malicious registration and login requests, the verification code does not need to continue to exist, and the user experience in the registration and login process will be further improved. When the website server is attacked, the second server can automatically take protection plans (such as temporarily prohibiting the login function of relevant or all network identities, requiring more authentication information, etc.) and notify the website administrator and users to take relevant measures (such as changing password).

It should be noted that the second server may be deployed on the website server side, or may be deployed on the Internet terminal side. Specifically, when the second server is deployed on the website server side, the second server is closely connected to the website server, and can directly transmit the identity information and registration information of the target website to the website server to complete the authentication operation. When the second server is deployed on the side of the Internet terminal, the second server needs to establish a secure connection with the first server first, and the first server sends the identity information and registration information of the target website to the second server through the secure connection, and the second server then The identity information and registration information of the target website are sent to the Internet terminal, and finally the Internet terminal sends an authentication request to the website server to complete the authentication operation.

In the network identity authentication device provided by the embodiment of the present invention, the first server can automatically generate different usernames and passwords for the user on each target website that needs to be registered, and the user does not need to remember these usernames and passwords. When using the target website, there is no need to download the required application program from the target website. The second server can directly send the registration information with the user name and password to the website server to complete the authentication operation, avoiding the collision attack caused by too similar user name and password. It can be seen that the network identity authentication device provided by the embodiment of the utility model improves the security of network identity authentication on the premise of avoiding password fatigue.

The embodiment of the utility model discloses a network identity authentication method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. specific:

Referring to FIG. 2, FIG. 2 is a schematic structural diagram of another network identity authentication device disclosed in the embodiment of the present invention. As shown in FIG. 2, it includes an Internet access terminal 201 and a website server 202, and also includes:

A first server 203 connected to the Internet access terminal for generating and sending the registration information of the target website to the second server;

Connected to the first server, connected to the website server through the Internet access terminal, and used to forward the identity information of the target website and the registration information to the Internet access terminal, so that the Internet access terminal can send information to the website The second server 204 that the server completes the authentication operation.

On the basis of the above embodiments, as a preferred implementation manner, the second server includes an Internet terminal extension and an extension server;

The Internet terminal is extended to connect the Internet terminal and the first server;

The extension server is connected to the first server and the Internet access terminal extension.

The present application also provides a log-in device, which includes the network identity authentication device provided in the above embodiment, and is used to log in to a terminal device.

In the login device provided by the embodiment of the present invention, the first server can automatically generate different usernames and passwords for the user on each target website that needs to be registered, and the user does not need to remember these usernames and passwords. When the user does not need to download the required application program from the target website, the second server can directly send the registration information with the user name and password to the website server to complete the authentication operation, avoiding the credential stuffing attack caused by too similar user name and password. It can be seen that the network identity authentication device provided by the embodiment of the utility model improves the security of network identity authentication on the premise of avoiding password fatigue.

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other.

The above description of the disclosed embodiments enables those skilled in the art to realize or use the utility model. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Each embodiment in the description is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for relevant details, please refer to the description of the method part. It should be pointed out that those skilled in the art can make some improvements and modifications to the application without departing from the principles of the application, and these improvements and modifications also fall within the protection scope of the claims of the application.

It should also be noted that in this specification, relative terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that these entities or operations There is no such actual relationship or order between the operations. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

Claims (5)

1. a kind of network ID authentication device, the Website server being connected including access terminals and with the access terminals is special Sign is, including：

It is connected with the access terminals, for generating and being sent to second server the first service of the log-on message of targeted website Device；

It is connected with the first server and the Website server, for utilizing the log-on message to the Website server Send the second server that certification request completes authentication operation.

2. network ID authentication device according to claim 1, which is characterized in that the second server directly with the net Site server is connected, for the identity information of the targeted website and the log-on message directly to be sent to the website service Device completes authentication operation.

3. network ID authentication device according to claim 1, which is characterized in that the second server passes through the online Terminal is connected with the Website server, for forwarding the identity information of the targeted website and the note to the access terminals Volume information, so that the access terminals complete authentication operation to the Website server.

4. network ID authentication device according to claim 3, which is characterized in that the second server includes access terminals Extension and expansion service device；

The access terminals extension connects the access terminals and the first server；

The expansion service device connects the first server and access terminals extension.

5. a kind of logger, which is characterized in that including the network ID authentication device as described in claim any one of 1-4, be used for Registration terminal equipment.