Summary of the invention
The present invention just is being based on the problems referred to above, has proposed a kind of verification technique, can be according to user's needs, when execution needs operation that the input validation code just can carry out, significantly reduce the frequency of user's input validation code, and improve the fluency of online, promote the user and experience.
In view of this, the present invention proposes a kind of demo plant, comprising: acquiring unit, be used for obtaining last time proof procedure server and be sent to the random value of client, and the identifying code that obtains based on described random value and default operation function; Control unit is used for the preset instructions in this proof procedure identification user input, and makes described server use described random value to verify the described identifying code of inputting in described this proof procedure according to the preset instructions that identifies.
In this technical scheme, in some needs operation that the input validation code just can carry out, server can generate data (being random value) at random, bringing default operation function (irreversible and crack difficulty high) into calculates again, be verified code (such as numeral, Chinese character, symbol and/or letter), and then identifying code is converted into picture is sent to client, the content that the user shows in client input picture, server carries out verification to user's input message, judge whether user's input message equates with the result who random value is brought into default operation function gained, and then judge whether correctly input validation code of user.And when each operation, server can change by changing random value the output valve of default operation function, and the identifying code that need input when namely at every turn operating is different.
User (identifying code that input page shows is finished checking) in normal proof procedure, can obtain the random value of this proof procedure use and the identifying code of user's input in client, (also can be for the third time for the second time the user, the 4th is inferior) in the proof procedure, can be by the input preset instructions, make server not re-use the random value that this proof procedure should use, and use the random value that obtained in the proof procedure last time, and then the input identifying code that obtained in proof procedure last time, server can calculate the random value that has obtained by default operation function, draws the correct conclusion of user's input validation code.
Thereby in the operation that needs the input validation code just can carry out, if the user need to frequently carry out this operation, just can use this demo plant, make server when the user carries out this operation at every turn, can judge the user to input correct identifying code and allow this operation, and then avoid repeatedly the input validation code and can directly carry out this operation, improve the fluency of online, save user time.
In technique scheme, preferably, also comprise: memory cell is used for preserving described random value and described identifying code.
In technique scheme, preferably, described default operation function comprises hash function.
In technique scheme, preferably, described acquiring unit also is used for when described server is judged the described identifying code mistake of inputting at described this proof procedure, obtain the new random value that described server is sent to described client next time, and obtain new identifying code based on described new random value and described default operation function.
In this technical scheme, owing to can be regularly or change aperiodically and preset operation function in some website, so adopting fixing operation function and identifying code verifies, may good authentication after after a while, need in this case again to obtain new operation function and the corresponding new identifying code that server is sent to client, and again call new operation function according to user instruction and verify with the new identifying code of input.
In above-mentioned arbitrary technical scheme, preferably, also comprise: transmission unit, be used for according to described preset instructions, the described random value that adopted in the proof procedure described last time is transferred to described server or described client send request to described server, make described server that the described random value that described last time, proof procedure adopted is applied to described this proof procedure.
In this technical scheme, can be sent to by the random value that will obtain server or by sending request to server, server is applied in the random value that obtained in the proof procedure last time in this proof procedure.
According to another aspect of the invention, also proposed a kind of verification method, having comprised:step 202, obtain server in proof procedure last time and be sent to the random value of client and the identifying code that obtains based on described random value and default operation function; Step 204, in this proof procedure, the preset instructions of identification user input, the described identifying code that makes described server use described random value checking in described this proof procedure, to input.
In this technical scheme, in some needs operation that the input validation code just can carry out, server can generate data (being random value) at random, bringing default operation function (irreversible and crack difficulty high) into calculates again, be verified code (such as numeral, Chinese character, symbol and/or letter), and then identifying code is converted into picture is sent to client, the content that the user shows in client input picture, server carries out verification to user's input message, judge whether user's input message equates with the result who random value is brought into default operation function gained, and then judge whether correctly input validation code of user.And when each operation, server can change by changing random value the output valve of default operation function, and the identifying code that need input when namely at every turn operating is different.
User (identifying code that input page shows is finished checking) in normal proof procedure, can obtain the random value of this proof procedure use and the identifying code of user's input in client, (also can be for the third time for the second time the user, the 4th is inferior) in the proof procedure, can be by the input preset instructions, make server not re-use the random value that this proof procedure should use, and use the random value that obtained in the proof procedure last time, and then the input identifying code that obtained in proof procedure last time, server can calculate the random value that has obtained by default operation function, draws the correct conclusion of user's input validation code.
Thereby in the operation that needs the input validation code just can carry out, if the user need to frequently carry out this operation, just can use this demo plant, make server when the user carries out this operation at every turn, can judge the user to input correct identifying code and allow this operation, and then avoid repeatedly the input validation code and can directly carry out this operation, improve the fluency of online, save user time.
In technique scheme, preferably, describedstep 202 also comprises: preserve described random value and described identifying code.
In technique scheme, preferably, described default operation function comprises hash function.
In technique scheme, preferably, described step 204 also comprises, if in described this proof procedure, the described identifying code authentication failed of input, then obtain the new random value that described server is sent to described client next time, and obtain new identifying code based on described new random value and described default operation function.
In this technical scheme, owing to can be regularly or change aperiodically and preset operation function in some website, so adopting fixing operation function and identifying code verifies, may good authentication after after a while, need in this case again to obtain new operation function and the corresponding new identifying code that server is sent to client, and again call new operation function according to user instruction and verify with the new identifying code of input.
In above-mentioned arbitrary technical scheme, preferably, according to described preset instructions, the described random value that adopted in the proof procedure described last time is transferred to described server or described client send request to described server, make described server that the described random value that described last time, proof procedure adopted is applied to described this proof procedure.
In this technical scheme, can be sent to by the random value that will obtain server or by sending request to server, server is applied in the random value that obtained in the proof procedure last time in this proof procedure.
By above technical scheme, can be according to user's needs, when execution needs operation that the input validation code just can carry out, significantly reduce the frequency of user's input validation code, improve the fluency of online, promote the user and experience.
Embodiment
In order more clearly to understand above-mentioned purpose of the present invention, feature and advantage, below in conjunction with the drawings and specific embodiments the present invention is further described in detail.Need to prove that in the situation of not conflicting, the application's embodiment and the feature among the embodiment can make up mutually.
A lot of details have been set forth in the following description so that fully understand the present invention; but; the present invention can also adopt other to be different from other modes described here and implement, and therefore, protection scope of the present invention is not subjected to the restriction of following public specific embodiment.
Fig. 1 shows the according to an embodiment of the invention block diagram of demo plant.
As shown in Figure 1, demo plant 100 comprises according to an embodiment of the invention: acquiring unit 102, and be used for obtaining last time proof procedure server and be sent to the random value of client, and the identifying code that obtains based on random value and default operation function; Control unit 104 is used for the preset instructions in this proof procedure identification user input, and makes server use random value to verify the identifying code of inputting in this proof procedure according to the preset instructions that identifies.
In some needs operation that the input validation code just can carry out, server can generate data (being random value) at random, bringing default operation function (irreversible and crack difficulty high) into calculates again, be verified code (such as numeral, Chinese character, symbol and/or letter), be f (x) such as default operation function, random value is a, identifying code=f (a) so, and then the identifying code mother is converted into picture is sent to client, the content that the user shows in client input picture, server carries out verification to user's input message, judge whether user's input message equates with the result who random value is brought into default operation function gained, and then judge whether correctly input validation code of user.And when each operation, server can change by changing random value the output valve of default operation function, and the identifying code that need input when namely at every turn operating is different.
User (identifying code that input page shows is finished checking) in normal proof procedure, can obtain the random value of this proof procedure use and the identifying code of user's input in client, (also can be for the third time for the second time the user, the 4th is inferior) in the proof procedure, can be by the input preset instructions, make server not re-use the random value that this proof procedure should use, and use the random value that obtained in the proof procedure last time, and then the input identifying code that obtained in proof procedure last time, server can calculate the random value that has obtained by default operation function, draws the correct conclusion of user's input validation code.
Thereby in the operation that needs the input validation code just can carry out, if the user need to frequently carry out this operation, just can use demo plant 100, make server when the user carries out this operation at every turn, can judge the user to input correct identifying code and allow this operation, and then avoid repeatedly the input validation code and can directly carry out this operation, improve the fluency of online, save user time.
Preferably, demo plant 100 can also comprise according to an embodiment of the invention: memory cell 106 is used for preserving random value and identifying code.
Preferably, default operation function can be hash function.
Preferably, acquiring unit 102 also is used for when server is judged the identifying code mistake of inputting at this proof procedure, obtain the new random value that server is sent to client next time, and obtain new identifying code based on new random value and default operation function.
Owing to can be regularly or change aperiodically and preset operation function in some website, so adopting fixing operation function and identifying code verifies, may good authentication after after a while, need in this case again to obtain new operation function and the corresponding new identifying code that server is sent to client, and again call new operation function according to user instruction and verify with the new identifying code of input.
Preferably, demo plant 100 also comprises according to an embodiment of the invention: transmission unit 108, be used for according to preset instructions, the random value that adopted in the proof procedure last time is transferred to server or user end to server transmission request, make server that the random value that last time, proof procedure adopted is applied to this proof procedure.
Can be sent to by the random value that will obtain server or by sending request to server, server is applied in the random value that obtained in the proof procedure last time in this proof procedure.
Fig. 2 shows the according to an embodiment of the invention flow chart of verification method.
As shown in Figure 2, verification method comprises according to an embodiment of the invention: comprising:step 202, and obtain server in proof procedure last time and be sent to the random value of client and the identifying code that obtains based on random value and default operation function; Step 204, in this proof procedure, the preset instructions of identification user input, the identifying code that makes server use the random value checking in this proof procedure, to input.
In some needs operation that the input validation code just can carry out, server can generate data (being random value) at random, bringing default operation function (irreversible and crack difficulty high) into calculates again, be verified code (such as numeral, Chinese character, symbol and/or letter), be f (x) such as default operation function, random value is a, identifying code=f (a) so, and then identifying code is converted into picture is sent to client, the content that the user shows in client input picture, server carries out verification to user's input, judge whether user's input equates with the result who random value is brought into default operation function gained, and then judge whether correctly input validation code of user.And when each operation, server can change by changing random value the output valve of default operation function, and the identifying code that need input when namely at every turn operating is different.
User (identifying code that input page shows is finished checking) in normal proof procedure, can obtain the random value of this proof procedure use and the identifying code of user's input in client, (also can be for the third time for the second time the user, the 4th is inferior) in the proof procedure, can be by the input preset instructions, make server not re-use the random value that this proof procedure should use, and use the random value that obtained in the proof procedure last time, and then the input identifying code that obtained in proof procedure last time, server can calculate the random value that has obtained by default operation function, draws the correct conclusion of user's input validation code.
Thereby in the operation that needs the input validation code just can carry out, if the user need to frequently carry out this operation, just can use this verification method, make server when the user carries out this operation at every turn, can judge the user to input correct identifying code and allow this operation, and then avoid repeatedly the input validation code and can directly carry out this operation, improve the fluency of online, save user time.
Preferably,step 202 also comprises: preserve random value and identifying code.
Preferably, default operation function can be hash function.
Preferably, step 204 comprises that also if in this proof procedure, the identifying code authentication failed of input is then obtained the new random value that server is sent to client next time, and obtains new identifying code based on new random value and default operation function.
Owing to can be regularly or change aperiodically and preset operation function in some website, so adopting fixing operation function and identifying code verifies, may good authentication after after a while, need in this case again to obtain new operation function and the corresponding new identifying code that server is sent to client, and again call new operation function according to user instruction and verify with the new identifying code of input.
Preferably, according to preset instructions, the random value that adopted in the proof procedure last time is transferred to server or user end to server transmission request, make server that the random value that last time, proof procedure adopted is applied to this proof procedure.
Can be sent to by the random value that will obtain server or by sending request to server, server is applied in the random value that obtained in the proof procedure last time in this proof procedure.
Fig. 3 A to Fig. 3 D shows the according to an embodiment of the invention schematic diagram of register.
As shown in Figure 3A, during certain forum, need input account, password in the normal login process in login, and according to the prompting input validation code of identifying code picture, then click the login button and can login this forum.
Shown in Fig. 3 B, in login process as shown in Figure 3A, can access instruction input frame 302, and the identifying code that obtains this operation function that generates at random of server and be sent to client by inputting specific instruction, such as in instruction input frame 302, inputting:
curl?http://www.victim.org/get_code.php-c?cookie-o?auth.png
Can obtain the hash function among the $ savecookie(cookie) and $ authnum(identifying code), then the hash function and the identifying code that obtain in client storage, be a such as the random value that generates for this operations server, the default operation function that adopts is f (x), so corresponding identifying code is A=f (a), suppose that f (x) is hash function, a is the message of arbitrary length of input at random so, and A is through the Output rusults after the Hash operation.
Shown in Fig. 3 C, behind register as shown in Figure 3A, when again carrying out register, can access instruction input frame 302, then in instruction input frame 302, input preset instructions, make server in this proof procedure, use the random value that has obtained in as shown in Figure 3A the login process to verify, and then the identifying code that has obtained in the input login process as shown in Figure 3A can be by checking, such as input in instruction input frame 302:
$savecookie=294b506f05f896dcbb3a0dde86a5e36c
$num=9632
$username=bluestar
$password=007007
curl?http://www.victim.org/index.php-c?$username.cookie。
Can obtain ID and the initialization cookies of this session, hash function and corresponding identifying code comprising the required user name of login, password, cookie, then continue input in instruction input frame 302:
grep-v?authhash?$username.cookie>tmp.$username
Can ignore the random value corresponding to this session (even the random value that server does not adopt this proof procedure to generate is verified) that server is sent to client, be b such as the random value that generates for this operation, so corresponding identifying code is B=b), can not consider this random value b and the identifying code B that calculates based on this random value by above-mentioned instruction, then in the instruction input frame, input:
echo″www.victim.org?FALSE/FALSE?0?hash?$savecookie″>>tmp.$username。
Input (above-mentioned two instructions are the preset instructions that the user inputs) after the above-mentioned instruction, server is used carry out this checking such as the random value that has obtained among Fig. 3 B, be about to a and bring f (x) into, in instruction input frame 302, input at last:
mv?tmp.$username?$username.cookie
curl?http://www.victim.org/login.php?-b?$username.cookie?-c$username.cookie-d?username=$username-d?password=$password-d
authnum=$num。
Namely input the identifying code shown in Fig. 3 B, because server adopts the random value shown in Fig. 3 B to carry out this checking, so the identifying code shown in Fig. 3 B is verified and must be proved to be successful, i.e. the identifying code of client input is A, and server authentication f (a)=A sets up.
Shown in Fig. 3 D, after operating by said method, in login process subsequently, can directly click the login button logins, and need not again to input account, password and identifying code, in like manner, also can adopt said method for other operations that need the input validation code just can carry out, repeat the user that the input validation code just can operate for needs, can greatly improve the fluency of online.
More than be described with reference to the accompanying drawings technical scheme of the present invention, consider in the correlation technique, there is authentication mechanism in most of websites, some action need user input validation code just can be finished, cause the user when repeating this generic operation, need repeatedly input validation code, greatly the fluency of impact online.By technical scheme of the present invention, can be according to user's needs, when execution needs operation that the input validation code just can carry out, significantly reduce the frequency of user's input validation code, improve the fluency of online, promote the user and experience.
The above is the preferred embodiments of the present invention only, is not limited to the present invention, and for a person skilled in the art, the present invention can have various modifications and variations.Within the spirit and principles in the present invention all, any modification of doing, be equal to replacement, improvement etc., all should be included within protection scope of the present invention.