1. 程式人生 > >[asp.net]登錄協同工作平臺安全解決方式

[asp.net]登錄協同工作平臺安全解決方式

mbed 存在 on() param 密鑰 聲明 wid ogr pos

版權聲明:本文為博主原創文章,未經博主同意不得轉載。 https://blog.csdn.net/david_520042/article/details/25372207

[摘要]公司領導說登錄驗證的安全性怎樣保證。建議採用UKEY驗證相似網銀解決,調用第三方YT公司產品。

解決方式:

技術分享圖片

前端頁面:

    <embed id="s_simnew61"  type="application/npsyunew6-plugin" hidden="true"> </embed><!--創建firefox,chrome等插件-->
    <script  type="text/javascript" language="javascript" >
        //載入皮膚
        var setTheme = function () {
            Ext.net.DirectMethods.GetThemeUrl(cbTheme.getValue(), {
                success: function (result) {
                    Ext.net.ResourceMgr.setTheme(result);
                }
            });
        };
        //回車出發
        document.onkeydown = function (event) {
            e = event ? event : (window.event ? window.event : null);
            if (e.keyCode == 13) {
                //運行的方法  
                //alert(‘回車檢測到了‘);
                //Ext.net.DirectMethods.Login();
                login();
            }
        }

        var digitArray = new Array(‘0‘, ‘1‘, ‘2‘, ‘3‘, ‘4‘, ‘5‘, ‘6‘, ‘7‘, ‘8‘, ‘9‘, ‘a‘, ‘b‘, ‘c‘, ‘d‘, ‘e‘, ‘f‘);
        function toHex(n) {
            var result = ‘‘
            var start = true;
            for (var i = 32; i > 0; ) {
                i -= 4;
                var digit = (n >> i) & 0xf;

                if (!start || digit != 0) {
                    start = false;
                    result += digitArray[digit];
                }
            }
            return (result == ‘‘ ? ‘0‘ : result);
        }

        var login = function () {
            var IsCheck = ‘N‘;
            if (window.location.host == "localhost:23111") {
                var DevicePath, ret, n, mylen;
                try {
                    //建立操作我們的鎖的控件對象。用於操作我們的鎖
                    var s_simnew61;

                    //創建插件或控件
                    if (navigator.userAgent.indexOf("MSIE") > 0 && !navigator.userAgent.indexOf("opera") > -1) {
                        s_simnew61 = new ActiveXObject("Syunew6A.s_simnew6");
                    }
                    else {
                        s_simnew61 = document.getElementById(‘s_simnew61‘);
                    }


                    //查找是否存在鎖,這裏使用了FindPort函數
                    DevicePath = s_simnew61.FindPort(0);
                    if (s_simnew61.LastError != 0) {
                        window.alert("沒有找到Ukey ,請插入UKey");
                        //window.location.href = "err.html";
                        return;
                    }

                    //這裏返回對隨機數的HASH結果
                    frmlogin.return_EncData.value = s_simnew61.EncString(frmlogin.rnd.value, DevicePath);
                    if (s_simnew61.LastError != 0) {
                        window.alert("Err to StrEnc,ErrCode is:" + s_simnew61.LastError.toString());
                        return;
                    }
                    IsCheck = ‘Y‘;

                    Ext.net.DirectMethods.Login(IsCheck);

                } catch (e) {
                    alert("您在使用外網訪問:" + e.name + ": " + e.message + "。

可能是沒有安裝相應的控件或插件"); } } else { Ext.net.DirectMethods.Login(IsCheck); } }; </script> <script type="text/javascript" language="javascript"> function reloadCode() { var obj = document.getElementById(‘imgCode‘); obj.src = "VerifyCode.aspx?"; } </script>

CS代碼:

SoftKey2K ytsoftkey;
       String KeyPath;
        private string _randomcode;
        /// <summary>
        /// 隨機數
        /// </summary>
        public string Randomcode
        {
            get { return _randomcode; }
            set { _randomcode = value; }
        }
        protected void Page_Load(object sender, EventArgs e)
        {
            if (!IsPostBack)
            {
                System.Random random = new System.Random();
                Session["rnd"] = rnd.Value = random.Next(0, 2147483646).ToString();
                Response.Cookies.Add(new HttpCookie("CheckCode", ""));
            }
        }

   
        [DirectMethod]
        public void Login(string IsCheck)
        {
            Check(IsCheck) ;
        
        }
        /// <summary>
        /// 登錄驗證
        /// </summary>
        /// <param name="IsCheck"></param>
        private void Check(string IsCheck) 
        {
            if (Request.Cookies["CheckCode"] == null)
            {

                Notification.Show(new NotificationConfig
                {
                    Title = "提醒",
                    Icon = Icon.Information,
                    Html = "<font style=‘color:red;‘>您的瀏覽器設置已被禁用 Cookies,您必須設置瀏覽器同意使用 Cookies 選項後才幹使用本系統。</font>"
                });
                return;
            }
            //驗證碼比較
            if (String.Compare(Request.Cookies["CheckCode"].Value.ToUpper(), this.txtVerifyCode.Text.ToString().Trim().ToUpper(), true) != 0)
            {
                this.txtVerifyCode.SetValue("");
                Notification.Show(new NotificationConfig
                {
                    Title = "提醒",
                    Icon = Icon.Information,
                    Html = "<font style=‘color:red;‘>驗證碼錯誤,請又一次輸入</font>"
                });
                X.AddScript("document.getElementById(‘imgCode‘).src=‘VerifyCode.aspx?

‘;"); return; } else { Utility.MD5 md5 = new Utility.MD5(); DzPlatForm.Model.Users user = new Model.Users(); user.USERNAME = Utility.Baseclass.SqlFilter(txtUserName.Text.Trim());//過濾危急字符 user.PASSWORD = md5.MD5Encrypt(txtPassWord.Text.Trim());// md5.MD5Encrypt(Utility.Baseclass.SqlFilter(txtPassWord.Text.Trim()));//password進行加密 string sql = "select * from [users] where id=1"; DataTable dt = DbHelperSQL.Query(sql, null).Tables[0]; DzPlatForm.BLL.UserBLL usermgr = new DzPlatForm.BLL.UserBLL(); string UserId = usermgr.LoginCheck(user); if (UserId != "") { Model.LoginLog lg = new Model.LoginLog(); lg.Name = txtUserName.Text.Trim(); lg.Browser = Utility.IpBrowserHelper.getBrowser(); lg.Ip = Utility.IpBrowserHelper.getIP(); lg.System = Utility.IpBrowserHelper.SystemCheck(); BLL.LoginBLL logmgr = new BLL.LoginBLL(); logmgr.LoginInfor(lg); usermgr.Record(); Model.Indentify idf = new Model.Indentify(); idf.Userid = int.Parse(UserId); BLL.IndentifyBLL idmgr = new BLL.IndentifyBLL(); idmgr.GetIndentify(idf); Session["userid"] = UserId; Session["UserCode"] = txtUserName.Text.Trim(); Session["UserName"] = idf.Name; Session["utype"] = idf.IsSystem; Session["uip"] = lg.Ip; //X.Msg.Show(new MessageBoxConfig //{ // Title = "請等待", // Message = "正在載入項", // ProgressText = "初始化中...", // Width = 300, // Progress = true, // Closable = false, // AnimEl = this.btnlogin.ClientID //}); //this.StartLongAction(); String strData, m_StrEnc, Key, Flag; Flag = IsCheck; //Key:即增強算法密鑰,這個要與設置在加密鎖中的密鑰一致 //增強算法密鑰能夠是每一把都不同樣,也能夠是都同樣,假設是不同樣的能夠依據username在從數據庫中獲取相應的增強算法密鑰,能夠依據安全性及自身詳細情況而定,這裏使用了一個固定的值 // Key = "1234567890ABCDEF1234567890ABCDEF"; Key = idf.UkeyCode; //strData:要進行加密的數據 strData = rnd.Value.Trim();//Session["rnd"].ToString(); //‘在server端對數據進行加密運算 m_StrEnc = Global.m_softkey.StrEnc(strData, Key); //比較client加密鎖返回的加密結果與服務端的加密結果是否相符,假設相符就覺得是合法用戶,因為使用了隨機數,從而實現了一次一密的高安全性,能夠用於高安全性的身份驗證 if (Flag == "N")//內網不須要比對 { Response.Redirect("Index.aspx"); } else { if (m_StrEnc == return_EncData.Value) { Response.Redirect("Index.aspx"); } else { Notification.Show(new NotificationConfig { Title = "提醒", Icon = Icon.Information, Html = "<font style=‘color:red;‘>該用戶不是合法用戶!</font>" }); } } } else { Notification.Show(new NotificationConfig { Title = "提醒", Icon = Icon.Information, Html = "<font style=‘color:red;‘>帳號或者password有誤,請又一次輸入!</font>" }); X.AddScript("document.getElementById(‘imgCode‘).src=‘VerifyCode.aspx?‘;"); } } } /// <summary> /// 開始計算任務 /// </summary> private void StartLongAction() { this.Session["Task1"] = 0; ThreadPool.QueueUserWorkItem(LongAction); this.TaskManager1.StartTask("Task1"); } /// <summary> /// 計時器 /// </summary> /// <param name="state"></param> private void LongAction(object state) { for (int i = 0; i < 100; i++) { Thread.Sleep(10); this.Session["Task1"] = i + 1; } this.Session.Remove("Task1"); } /// <summary> /// 刷新進度條 /// </summary> /// <param name="sender"></param> /// <param name="e"></param> protected void RefreshProgress(object sender, DirectEventArgs e) { object progress = this.Session["Task1"]; if (progress != null) { X.Msg.UpdateProgress(((int)progress) / 100f, string.Format(" {0} % {1}", progress.ToString(), 100)); } else { this.TaskManager1.StopTask("Task1"); X.MessageBox.Hide(); Response.Redirect("Index.aspx"); } } /// <summary> /// 更換皮膚 /// </summary> /// <param name="theme"></param> /// <returns></returns> public string GetThemeUrl(string theme) { Theme temp = (Theme)Enum.Parse(typeof(Theme), theme); this.Session["Ext.Net.Theme"] = temp; return (temp == Ext.Net.Theme.Default) ? "Default" : X.ResourceManager.GetThemeUrl(temp); } }


服務端代碼:Global.asax
        public class SoftKey
        {
            [DllImport("kernel32.dll")]
            public static extern int lstrlenA(string InString);
            [DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
            public static extern void CopyStringToByte(byte[] pDest, string pSourceg, int ByteLenr);
            [DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
            public static extern void CopyByteToString(StringBuilder pDest, byte[] pSource, int ByteLenr);

            //下面用於將16進制字符串轉化為無符號長整型
            private uint HexToInt(string s)
            {
                string[] hexch = { "0", "1", "2", "3", "4", "5", "6", "7",
								       "8", "9", "A", "B", "C", "D", "E", "F"};
                s = s.ToUpper();
                int i, j;
                int r, n, k;
                string ch;

                k = 1; r = 0;
                for (i = s.Length; i > 0; i--)
                {
                    ch = s.Substring(i - 1, 1);
                    n = 0;
                    for (j = 0; j < 16; j++)
                        if (ch == hexch[j])
                            n = j;
                    r += (n * k);
                    k *= 16;
                }
                return unchecked((uint)r);
            }


            public void EnCode(byte[] inb, byte[] outb, string Key)
            {

                UInt32 cnDelta, y, z, a, b, c, d, temp_2;
                UInt32[] buf = new UInt32[16];
                int n, i, nlen;
                UInt32 sum;
                //UInt32 temp, temp_1;
                string temp_string;


                cnDelta = 2654435769;
                sum = 0;

                nlen = Key.Length;
                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = Key.Substring(n - 1, 2);
                    buf[i] = HexToInt(temp_string);
                    i = i + 1;
                }
                a = 0; b = 0; c = 0; d = 0;
                for (n = 0; n <= 3; n++)
                {
                    a = (buf[n] << (n * 8)) | a;
                    b = (buf[n + 4] << (n * 8)) | b;
                    c = (buf[n + 4 + 4] << (n * 8)) | c;
                    d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
                }



                y = 0;
                z = 0;
                for (n = 0; n <= 3; n++)
                {
                    temp_2 = inb[n];
                    y = (temp_2 << (n * 8)) | y;
                    temp_2 = inb[n + 4];
                    z = (temp_2 << (n * 8)) | z;
                }


                n = 32;

                while (n > 0)
                {
                    sum = cnDelta + sum;

                    /*temp = (z << 4) & 0xFFFFFFFF;
                    temp = (temp + a) & 0xFFFFFFFF;
                    temp_1 = (z + sum) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp_1 = (z >> 5) & 0xFFFFFFFF;
                    temp_1 = (temp_1 + b) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp = (temp + y) & 0xFFFFFFFF;
                    y = temp & 0xFFFFFFFF;*/
                    y += ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);

                    /*temp = (y << 4) & 0xFFFFFFFF;
                    temp = (temp + c) & 0xFFFFFFFF;
                    temp_1 = (y + sum) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp_1 = (y >> 5) & 0xFFFFFFFF;
                    temp_1 = (temp_1 + d) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp = (z + temp) & 0xFFFFFFFF;
                    z = temp & 0xFFFFFFFF;*/
                    z += ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
                    n = n - 1;

                }

                for (n = 0; n <= 3; n++)
                {
                    outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
                    outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
                }

            }

            public void DeCode(byte[] inb, byte[] outb, string Key)
            {

                UInt32 cnDelta, y, z, a, b, c, d, temp_2;
                UInt32[] buf = new UInt32[16];
                int n, i, nlen;
                UInt32 sum;
                //UInt32 temp, temp_1;
                string temp_string;


                cnDelta = 2654435769;
                sum = 0xC6EF3720;

                nlen = Key.Length;
                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = Key.Substring(n - 1, 2);
                    buf[i] = HexToInt(temp_string);
                    i = i + 1;
                }
                a = 0; b = 0; c = 0; d = 0;
                for (n = 0; n <= 3; n++)
                {
                    a = (buf[n] << (n * 8)) | a;
                    b = (buf[n + 4] << (n * 8)) | b;
                    c = (buf[n + 4 + 4] << (n * 8)) | c;
                    d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
                }



                y = 0;
                z = 0;
                for (n = 0; n <= 3; n++)
                {
                    temp_2 = inb[n];
                    y = (temp_2 << (n * 8)) | y;
                    temp_2 = inb[n + 4];
                    z = (temp_2 << (n * 8)) | z;
                }


                n = 32;

                while (n-- > 0)
                {
                    z -= ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
                    y -= ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);
                    sum -= cnDelta;

                }

                for (n = 0; n <= 3; n++)
                {
                    outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
                    outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
                }

            }


            public string StrEnc(string InString, string Key)//使用增強算法。加密字符串
            {

                byte[] b, outb;
                byte[] temp = new byte[8], outtemp = new byte[8];
                int n, i, nlen, outlen;
                string outstring;


                nlen = lstrlenA(InString) + 1;
                if (nlen < 8)
                    outlen = 8;
                else
                    outlen = nlen;
                b = new byte[outlen];
                outb = new byte[outlen];

                CopyStringToByte(b, InString, nlen);

                b.CopyTo(outb, 0);

                for (n = 0; n <= outlen - 8; n = n + 8)
                {
                    for (i = 0; i < 8; i++) temp[i] = b[i + n];
                    EnCode(temp, outtemp, Key);
                    for (i = 0; i < 8; i++) outb[i] = outtemp[i];
                }

                outstring = "";
                for (n = 0; n <= outlen - 1; n++)
                {
                    outstring = outstring + outb[n].ToString("X2");
                }
                return outstring;
            }
            public string StrDec(string InString, string Key) //使用增強算法。加密字符串
            {
                byte[] b, outb;
                byte[] temp = new byte[8], outtemp = new byte[8];
                int n, i, nlen, outlen;
                string temp_string;
                StringBuilder c_str;


                nlen = InString.Length;
                if (nlen < 16) outlen = 16;
                outlen = nlen / 2;
                b = new byte[outlen];
                outb = new byte[outlen];

                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = InString.Substring(n - 1, 2);
                    b[i] = System.Convert.ToByte(HexToInt(temp_string));
                    i = i + 1;
                }

                b.CopyTo(outb, 0);

                for (n = 0; n <= outlen - 8; n = n + 8)
                {
                    for (i = 0; i < 8; i++) temp[i] = b[i + n];
                    DeCode(temp, outtemp, Key);
                    for (i = 0; i < 8; i++) outb[i] = outtemp[i];
                }

                c_str = new StringBuilder("", outlen);
                CopyByteToString(c_str, outb, outlen);
                return c_str.ToString();

            }


        }

唯一鎖寫入Ukey:

技術分享圖片

公網client:安裝插件

技術分享圖片

多文件安裝版+須要先插入UKEY

技術分享圖片

插入UKEY

技術分享圖片

登錄成功!

開始批量寫唯一鎖啦!

技術分享圖片


[asp.net]登錄協同工作平臺安全解決方式