[asp.net]登錄協同工作平臺安全解決方式
[摘要]公司領導說登錄驗證的安全性怎樣保證。建議採用UKEY驗證相似網銀解決，調用第三方YT公司產品。
解決方式：
前端頁面：
CS代碼：<embed id="s_simnew61" type="application/npsyunew6-plugin" hidden="true"> </embed><!--創建firefox,chrome等插件--> <script type="text/javascript" language="javascript" > //載入皮膚 var setTheme = function () { Ext.net.DirectMethods.GetThemeUrl(cbTheme.getValue(), { success: function (result) { Ext.net.ResourceMgr.setTheme(result); } }); }; //回車出發 document.onkeydown = function (event) { e = event ? event : (window.event ? window.event : null); if (e.keyCode == 13) { //運行的方法 //alert(‘回車檢測到了‘); //Ext.net.DirectMethods.Login(); login(); } } var digitArray = new Array(‘0‘, ‘1‘, ‘2‘, ‘3‘, ‘4‘, ‘5‘, ‘6‘, ‘7‘, ‘8‘, ‘9‘, ‘a‘, ‘b‘, ‘c‘, ‘d‘, ‘e‘, ‘f‘); function toHex(n) { var result = ‘‘ var start = true; for (var i = 32; i > 0; ) { i -= 4; var digit = (n >> i) & 0xf; if (!start || digit != 0) { start = false; result += digitArray[digit]; } } return (result == ‘‘ ? ‘0‘ : result); } var login = function () { var IsCheck = ‘N‘; if (window.location.host == "localhost:23111") { var DevicePath, ret, n, mylen; try { //建立操作我們的鎖的控件對象。用於操作我們的鎖 var s_simnew61; //創建插件或控件 if (navigator.userAgent.indexOf("MSIE") > 0 && !navigator.userAgent.indexOf("opera") > -1) { s_simnew61 = new ActiveXObject("Syunew6A.s_simnew6"); } else { s_simnew61 = document.getElementById(‘s_simnew61‘); } //查找是否存在鎖,這裏使用了FindPort函數 DevicePath = s_simnew61.FindPort(0); if (s_simnew61.LastError != 0) { window.alert("沒有找到Ukey ,請插入UKey"); //window.location.href = "err.html"; return; } //這裏返回對隨機數的HASH結果 frmlogin.return_EncData.value = s_simnew61.EncString(frmlogin.rnd.value, DevicePath); if (s_simnew61.LastError != 0) { window.alert("Err to StrEnc,ErrCode is:" + s_simnew61.LastError.toString()); return; } IsCheck = ‘Y‘; Ext.net.DirectMethods.Login(IsCheck); } catch (e) { alert("您在使用外網訪問：" + e.name + ": " + e.message + "。可能是沒有安裝相應的控件或插件"); } } else { Ext.net.DirectMethods.Login(IsCheck); } }; </script> <script type="text/javascript" language="javascript"> function reloadCode() { var obj = document.getElementById(‘imgCode‘); obj.src = "VerifyCode.aspx?"; } </script>
SoftKey2K ytsoftkey;
String KeyPath;
private string _randomcode;
/// <summary>
/// 隨機數
/// </summary>
public string Randomcode
{
get { return _randomcode; }
set { _randomcode = value; }
}
protected void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
{
System.Random random = new System.Random();
Session["rnd"] = rnd.Value = random.Next(0, 2147483646).ToString();
Response.Cookies.Add(new HttpCookie("CheckCode", ""));
}
}
[DirectMethod]
public void Login(string IsCheck)
{
Check(IsCheck) ;
}
/// <summary>
/// 登錄驗證
/// </summary>
/// <param name="IsCheck"></param>
private void Check(string IsCheck)
{
if (Request.Cookies["CheckCode"] == null)
{
Notification.Show(new NotificationConfig
{
Title = "提醒",
Icon = Icon.Information,
Html = "<font style=‘color:red;‘>您的瀏覽器設置已被禁用 Cookies，您必須設置瀏覽器同意使用 Cookies 選項後才幹使用本系統。</font>"
});
return;
}
//驗證碼比較
if (String.Compare(Request.Cookies["CheckCode"].Value.ToUpper(), this.txtVerifyCode.Text.ToString().Trim().ToUpper(), true) != 0)
{
this.txtVerifyCode.SetValue("");
Notification.Show(new NotificationConfig
{
Title = "提醒",
Icon = Icon.Information,
Html = "<font style=‘color:red;‘>驗證碼錯誤，請又一次輸入</font>"
});
X.AddScript("document.getElementById(‘imgCode‘).src=‘VerifyCode.aspx?‘;");
return;
}
else
{
Utility.MD5 md5 = new Utility.MD5();
DzPlatForm.Model.Users user = new Model.Users();
user.USERNAME = Utility.Baseclass.SqlFilter(txtUserName.Text.Trim());//過濾危急字符
user.PASSWORD = md5.MD5Encrypt(txtPassWord.Text.Trim());// md5.MD5Encrypt(Utility.Baseclass.SqlFilter(txtPassWord.Text.Trim()));//password進行加密
string sql = "select * from [users] where id=1";
DataTable dt = DbHelperSQL.Query(sql, null).Tables[0];
DzPlatForm.BLL.UserBLL usermgr = new DzPlatForm.BLL.UserBLL();
string UserId = usermgr.LoginCheck(user);
if (UserId != "")
{
Model.LoginLog lg = new Model.LoginLog();
lg.Name = txtUserName.Text.Trim();
lg.Browser = Utility.IpBrowserHelper.getBrowser();
lg.Ip = Utility.IpBrowserHelper.getIP();
lg.System = Utility.IpBrowserHelper.SystemCheck();
BLL.LoginBLL logmgr = new BLL.LoginBLL();
logmgr.LoginInfor(lg);
usermgr.Record();
Model.Indentify idf = new Model.Indentify();
idf.Userid = int.Parse(UserId);
BLL.IndentifyBLL idmgr = new BLL.IndentifyBLL();
idmgr.GetIndentify(idf);
Session["userid"] = UserId;
Session["UserCode"] = txtUserName.Text.Trim();
Session["UserName"] = idf.Name;
Session["utype"] = idf.IsSystem;
Session["uip"] = lg.Ip;
//X.Msg.Show(new MessageBoxConfig
//{
// Title = "請等待",
// Message = "正在載入項",
// ProgressText = "初始化中...",
// Width = 300,
// Progress = true,
// Closable = false,
// AnimEl = this.btnlogin.ClientID
//});
//this.StartLongAction();
String strData, m_StrEnc, Key, Flag;
Flag = IsCheck;
//Key：即增強算法密鑰，這個要與設置在加密鎖中的密鑰一致
//增強算法密鑰能夠是每一把都不同樣，也能夠是都同樣，假設是不同樣的能夠依據username在從數據庫中獲取相應的增強算法密鑰，能夠依據安全性及自身詳細情況而定，這裏使用了一個固定的值
// Key = "1234567890ABCDEF1234567890ABCDEF";
Key = idf.UkeyCode;
//strData：要進行加密的數據
strData = rnd.Value.Trim();//Session["rnd"].ToString();
//‘在server端對數據進行加密運算
m_StrEnc = Global.m_softkey.StrEnc(strData, Key);
//比較client加密鎖返回的加密結果與服務端的加密結果是否相符，假設相符就覺得是合法用戶，因為使用了隨機數，從而實現了一次一密的高安全性，能夠用於高安全性的身份驗證
if (Flag == "N")//內網不須要比對
{
Response.Redirect("Index.aspx");
}
else
{
if (m_StrEnc == return_EncData.Value)
{
Response.Redirect("Index.aspx");
}
else
{
Notification.Show(new NotificationConfig
{
Title = "提醒",
Icon = Icon.Information,
Html = "<font style=‘color:red;‘>該用戶不是合法用戶!</font>"
});
}
}
}
else
{
Notification.Show(new NotificationConfig
{
Title = "提醒",
Icon = Icon.Information,
Html = "<font style=‘color:red;‘>帳號或者password有誤,請又一次輸入!</font>"
});
X.AddScript("document.getElementById(‘imgCode‘).src=‘VerifyCode.aspx?‘;");
}
}
}
/// <summary>
/// 開始計算任務
/// </summary>
private void StartLongAction()
{
this.Session["Task1"] = 0;
ThreadPool.QueueUserWorkItem(LongAction);
this.TaskManager1.StartTask("Task1");
}
/// <summary>
/// 計時器
/// </summary>
/// <param name="state"></param>
private void LongAction(object state)
{
for (int i = 0; i < 100; i++)
{
Thread.Sleep(10);
this.Session["Task1"] = i + 1;
}
this.Session.Remove("Task1");
}
/// <summary>
/// 刷新進度條
/// </summary>
/// <param name="sender"></param>
/// <param name="e"></param>
protected void RefreshProgress(object sender, DirectEventArgs e)
{
object progress = this.Session["Task1"];
if (progress != null)
{
X.Msg.UpdateProgress(((int)progress) / 100f, string.Format(" {0} % {1}", progress.ToString(), 100));
}
else
{
this.TaskManager1.StopTask("Task1");
X.MessageBox.Hide();
Response.Redirect("Index.aspx");
}
}
/// <summary>
/// 更換皮膚
/// </summary>
/// <param name="theme"></param>
/// <returns></returns>
public string GetThemeUrl(string theme)
{
Theme temp = (Theme)Enum.Parse(typeof(Theme), theme);
this.Session["Ext.Net.Theme"] = temp;
return (temp == Ext.Net.Theme.Default) ? "Default" : X.ResourceManager.GetThemeUrl(temp);
}
}
服務端代碼：Global.asax
public class SoftKey
{
[DllImport("kernel32.dll")]
public static extern int lstrlenA(string InString);
[DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
public static extern void CopyStringToByte(byte[] pDest, string pSourceg, int ByteLenr);
[DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
public static extern void CopyByteToString(StringBuilder pDest, byte[] pSource, int ByteLenr);
//下面用於將16進制字符串轉化為無符號長整型
private uint HexToInt(string s)
{
string[] hexch = { "0", "1", "2", "3", "4", "5", "6", "7",
"8", "9", "A", "B", "C", "D", "E", "F"};
s = s.ToUpper();
int i, j;
int r, n, k;
string ch;
k = 1; r = 0;
for (i = s.Length; i > 0; i--)
{
ch = s.Substring(i - 1, 1);
n = 0;
for (j = 0; j < 16; j++)
if (ch == hexch[j])
n = j;
r += (n * k);
k *= 16;
}
return unchecked((uint)r);
}
public void EnCode(byte[] inb, byte[] outb, string Key)
{
UInt32 cnDelta, y, z, a, b, c, d, temp_2;
UInt32[] buf = new UInt32[16];
int n, i, nlen;
UInt32 sum;
//UInt32 temp, temp_1;
string temp_string;
cnDelta = 2654435769;
sum = 0;
nlen = Key.Length;
i = 0;
for (n = 1; n <= nlen; n = n + 2)
{
temp_string = Key.Substring(n - 1, 2);
buf[i] = HexToInt(temp_string);
i = i + 1;
}
a = 0; b = 0; c = 0; d = 0;
for (n = 0; n <= 3; n++)
{
a = (buf[n] << (n * 8)) | a;
b = (buf[n + 4] << (n * 8)) | b;
c = (buf[n + 4 + 4] << (n * 8)) | c;
d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
}
y = 0;
z = 0;
for (n = 0; n <= 3; n++)
{
temp_2 = inb[n];
y = (temp_2 << (n * 8)) | y;
temp_2 = inb[n + 4];
z = (temp_2 << (n * 8)) | z;
}
n = 32;
while (n > 0)
{
sum = cnDelta + sum;
/*temp = (z << 4) & 0xFFFFFFFF;
temp = (temp + a) & 0xFFFFFFFF;
temp_1 = (z + sum) & 0xFFFFFFFF;
temp = (temp ^ temp_1) & 0xFFFFFFFF;
temp_1 = (z >> 5) & 0xFFFFFFFF;
temp_1 = (temp_1 + b) & 0xFFFFFFFF;
temp = (temp ^ temp_1) & 0xFFFFFFFF;
temp = (temp + y) & 0xFFFFFFFF;
y = temp & 0xFFFFFFFF;*/
y += ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);
/*temp = (y << 4) & 0xFFFFFFFF;
temp = (temp + c) & 0xFFFFFFFF;
temp_1 = (y + sum) & 0xFFFFFFFF;
temp = (temp ^ temp_1) & 0xFFFFFFFF;
temp_1 = (y >> 5) & 0xFFFFFFFF;
temp_1 = (temp_1 + d) & 0xFFFFFFFF;
temp = (temp ^ temp_1) & 0xFFFFFFFF;
temp = (z + temp) & 0xFFFFFFFF;
z = temp & 0xFFFFFFFF;*/
z += ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
n = n - 1;
}
for (n = 0; n <= 3; n++)
{
outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
}
}
public void DeCode(byte[] inb, byte[] outb, string Key)
{
UInt32 cnDelta, y, z, a, b, c, d, temp_2;
UInt32[] buf = new UInt32[16];
int n, i, nlen;
UInt32 sum;
//UInt32 temp, temp_1;
string temp_string;
cnDelta = 2654435769;
sum = 0xC6EF3720;
nlen = Key.Length;
i = 0;
for (n = 1; n <= nlen; n = n + 2)
{
temp_string = Key.Substring(n - 1, 2);
buf[i] = HexToInt(temp_string);
i = i + 1;
}
a = 0; b = 0; c = 0; d = 0;
for (n = 0; n <= 3; n++)
{
a = (buf[n] << (n * 8)) | a;
b = (buf[n + 4] << (n * 8)) | b;
c = (buf[n + 4 + 4] << (n * 8)) | c;
d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
}
y = 0;
z = 0;
for (n = 0; n <= 3; n++)
{
temp_2 = inb[n];
y = (temp_2 << (n * 8)) | y;
temp_2 = inb[n + 4];
z = (temp_2 << (n * 8)) | z;
}
n = 32;
while (n-- > 0)
{
z -= ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
y -= ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);
sum -= cnDelta;
}
for (n = 0; n <= 3; n++)
{
outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
}
}
public string StrEnc(string InString, string Key)//使用增強算法。加密字符串
{
byte[] b, outb;
byte[] temp = new byte[8], outtemp = new byte[8];
int n, i, nlen, outlen;
string outstring;
nlen = lstrlenA(InString) + 1;
if (nlen < 8)
outlen = 8;
else
outlen = nlen;
b = new byte[outlen];
outb = new byte[outlen];
CopyStringToByte(b, InString, nlen);
b.CopyTo(outb, 0);
for (n = 0; n <= outlen - 8; n = n + 8)
{
for (i = 0; i < 8; i++) temp[i] = b[i + n];
EnCode(temp, outtemp, Key);
for (i = 0; i < 8; i++) outb[i] = outtemp[i];
}
outstring = "";
for (n = 0; n <= outlen - 1; n++)
{
outstring = outstring + outb[n].ToString("X2");
}
return outstring;
}
public string StrDec(string InString, string Key) //使用增強算法。加密字符串
{
byte[] b, outb;
byte[] temp = new byte[8], outtemp = new byte[8];
int n, i, nlen, outlen;
string temp_string;
StringBuilder c_str;
nlen = InString.Length;
if (nlen < 16) outlen = 16;
outlen = nlen / 2;
b = new byte[outlen];
outb = new byte[outlen];
i = 0;
for (n = 1; n <= nlen; n = n + 2)
{
temp_string = InString.Substring(n - 1, 2);
b[i] = System.Convert.ToByte(HexToInt(temp_string));
i = i + 1;
}
b.CopyTo(outb, 0);
for (n = 0; n <= outlen - 8; n = n + 8)
{
for (i = 0; i < 8; i++) temp[i] = b[i + n];
DeCode(temp, outtemp, Key);
for (i = 0; i < 8; i++) outb[i] = outtemp[i];
}
c_str = new StringBuilder("", outlen);
CopyByteToString(c_str, outb, outlen);
return c_str.ToString();
}
}唯一鎖寫入Ukey:
公網client：安裝插件
多文件安裝版+須要先插入UKEY
插入UKEY
登錄成功！
開始批量寫唯一鎖啦！
[asp.net]登錄協同工作平臺安全解決方式