[置顶] [asp.net]登录协同工作平台安全解决方案

[摘要]公司领导说登录验证的安全性如何保证，建议采用UKEY验证类似网银解决，调用第三方YT公司产品。

解决方案：

前端页面：

    <embed id="s_simnew61"  type="application/npsyunew6-plugin" hidden="true"> </embed><!--创建firefox,chrome等插件-->
    <script  type="text/javascript" language="javascript" >
        //加载皮肤
        var setTheme = function () {
            Ext.net.DirectMethods.GetThemeUrl(cbTheme.getValue(), {
                success: function (result) {
                    Ext.net.ResourceMgr.setTheme(result);
                }
            });
        };
        //回车出发
        document.onkeydown = function (event) {
            e = event ? event : (window.event ? window.event : null);
            if (e.keyCode == 13) {
                //执行的方法  
                //alert('回车检测到了');
                //Ext.net.DirectMethods.Login();
                login();
            }
        }

        var digitArray = new Array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f');
        function toHex(n) {
            var result = ''
            var start = true;
            for (var i = 32; i > 0; ) {
                i -= 4;
                var digit = (n >> i) & 0xf;

                if (!start || digit != 0) {
                    start = false;
                    result += digitArray[digit];
                }
            }
            return (result == '' ? '0' : result);
        }

        var login = function () {
            var IsCheck = 'N';
            if (window.location.host == "localhost:23111") {
                var DevicePath, ret, n, mylen;
                try {
                    //建立操作我们的锁的控件对象，用于操作我们的锁
                    var s_simnew61;

                    //创建插件或控件
                    if (navigator.userAgent.indexOf("MSIE") > 0 && !navigator.userAgent.indexOf("opera") > -1) {
                        s_simnew61 = new ActiveXObject("Syunew6A.s_simnew6");
                    }
                    else {
                        s_simnew61 = document.getElementById('s_simnew61');
                    }


                    //查找是否存在锁,这里使用了FindPort函数
                    DevicePath = s_simnew61.FindPort(0);
                    if (s_simnew61.LastError != 0) {
                        window.alert("没有找到Ukey ,请插入UKey");
                        //window.location.href = "err.html";
                        return;
                    }

                    //这里返回对随机数的HASH结果
                    frmlogin.return_EncData.value = s_simnew61.EncString(frmlogin.rnd.value, DevicePath);
                    if (s_simnew61.LastError != 0) {
                        window.alert("Err to StrEnc,ErrCode is:" + s_simnew61.LastError.toString());
                        return;
                    }
                    IsCheck = 'Y';

                    Ext.net.DirectMethods.Login(IsCheck);

                } catch (e) {
                    alert("您在使用外网访问：" + e.name + ": " + e.message + "。可能是没有安装相应的控件或插件");
                }
            } else {
                Ext.net.DirectMethods.Login(IsCheck);
            }

        };
    </script>
    <script type="text/javascript" language="javascript">
        function reloadCode() {
            var obj = document.getElementById('imgCode');
            obj.src = "VerifyCode.aspx?";
        }

    </script>

CS代码：

SoftKey2K ytsoftkey;
       String KeyPath;
        private string _randomcode;
        /// <summary>
        /// 随机数
        /// </summary>
        public string Randomcode
        {
            get { return _randomcode; }
            set { _randomcode = value; }
        }
        protected void Page_Load(object sender, EventArgs e)
        {
            if (!IsPostBack)
            {
                System.Random random = new System.Random();
                Session["rnd"] = rnd.Value = random.Next(0, 2147483646).ToString();
                Response.Cookies.Add(new HttpCookie("CheckCode", ""));
            }
        }

   
        [DirectMethod]
        public void Login(string IsCheck)
        {
            Check(IsCheck) ;
        
        }
        /// <summary>
        /// 登录验证
        /// </summary>
        /// <param name="IsCheck"></param>
        private void Check(string IsCheck) 
        {
            if (Request.Cookies["CheckCode"] == null)
            {

                Notification.Show(new NotificationConfig
                {
                    Title = "提醒",
                    Icon = Icon.Information,
                    Html = "<font style='color:red;'>您的浏览器设置已被禁用 Cookies，您必须设置浏览器允许使用 Cookies 选项后才能使用本系统。</font>"
                });
                return;
            }
            //验证码比较
            if (String.Compare(Request.Cookies["CheckCode"].Value.ToUpper(), this.txtVerifyCode.Text.ToString().Trim().ToUpper(), true) != 0)
            {
                this.txtVerifyCode.SetValue("");
                Notification.Show(new NotificationConfig
                {
                    Title = "提醒",
                    Icon = Icon.Information,
                    Html = "<font style='color:red;'>验证码错误，请重新输入</font>"
                });
                X.AddScript("document.getElementById('imgCode').src='VerifyCode.aspx?';");
                return;


            }
            else
            {
                Utility.MD5 md5 = new Utility.MD5();
                DzPlatForm.Model.Users user = new Model.Users();
                user.USERNAME = Utility.Baseclass.SqlFilter(txtUserName.Text.Trim());//过滤危险字符
                user.PASSWORD = md5.MD5Encrypt(txtPassWord.Text.Trim());// md5.MD5Encrypt(Utility.Baseclass.SqlFilter(txtPassWord.Text.Trim()));//密码进行加密

                string sql = "select * from [users] where id=1";
                DataTable dt = DbHelperSQL.Query(sql, null).Tables[0];

                DzPlatForm.BLL.UserBLL usermgr = new DzPlatForm.BLL.UserBLL();
                string UserId = usermgr.LoginCheck(user);

                if (UserId != "")
                {

                    Model.LoginLog lg = new Model.LoginLog();
                    lg.Name = txtUserName.Text.Trim();
                    lg.Browser = Utility.IpBrowserHelper.getBrowser();
                    lg.Ip = Utility.IpBrowserHelper.getIP();
                    lg.System = Utility.IpBrowserHelper.SystemCheck();
                    BLL.LoginBLL logmgr = new BLL.LoginBLL();
                    logmgr.LoginInfor(lg);
                    usermgr.Record();

                    Model.Indentify idf = new Model.Indentify();
                    idf.Userid = int.Parse(UserId);
                    BLL.IndentifyBLL idmgr = new BLL.IndentifyBLL();
                    idmgr.GetIndentify(idf);
                    Session["userid"] = UserId;
                    Session["UserCode"] = txtUserName.Text.Trim();
                    Session["UserName"] = idf.Name;
                    Session["utype"] = idf.IsSystem;
                    Session["uip"] = lg.Ip;


                    //X.Msg.Show(new MessageBoxConfig
                    //{
                    //    Title = "请等待",
                    //    Message = "正在加载项",
                    //    ProgressText = "初始化中...",
                    //    Width = 300,
                    //    Progress = true,
                    //    Closable = false,
                    //    AnimEl = this.btnlogin.ClientID
                    //});

                    //this.StartLongAction();
                    String strData, m_StrEnc, Key, Flag;

                    Flag = IsCheck;
                    //Key：即增强算法密钥，这个要与设置在加密锁中的密钥一致
                    //增强算法密钥可以是每一把都不相同，也可以是都相同，如果是不相同的可以根据用户名在从数据库中获取对应的增强算法密钥，可以根据安全性及自身具体情况而定，这里使用了一个固定的值
                   // Key = "1234567890ABCDEF1234567890ABCDEF";
                    Key = idf.UkeyCode;
                    //strData：要进行加密的数据
                    strData = rnd.Value.Trim();//Session["rnd"].ToString();
                    //'在服务器端对数据进行加密运算
                    m_StrEnc = Global.m_softkey.StrEnc(strData, Key);
                    //比较客户端加密锁返回的加密结果与服务端的加密结果是否相符，如果相符就认为是合法用户，由于使用了随机数，从而实现了一次一密的高安全性，可以用于高安全性的身份验证
                    if (Flag == "N")//内网不需要比对
                    {
                        Response.Redirect("Index.aspx");
                    }
                    else
                    {
                        if (m_StrEnc == return_EncData.Value)
                        {

                            Response.Redirect("Index.aspx");
                        }
                        else
                        {
                            Notification.Show(new NotificationConfig
                            {
                                Title = "提醒",
                                Icon = Icon.Information,
                                Html = "<font style='color:red;'>该用户不是合法用户!</font>"
                            });
                        }

                    }

                }
                else
                {

                    Notification.Show(new NotificationConfig
                    {
                        Title = "提醒",
                        Icon = Icon.Information,
                        Html = "<font style='color:red;'>帐号或者密码有误,请重新输入!</font>"

                    });
                    X.AddScript("document.getElementById('imgCode').src='VerifyCode.aspx?';");
                }

            }
        }
        /// <summary>
        /// 开始计算任务
        /// </summary>
        private void StartLongAction()
        {
            this.Session["Task1"] = 0;
            ThreadPool.QueueUserWorkItem(LongAction);

            this.TaskManager1.StartTask("Task1");
        }
        /// <summary>
        /// 计时器
        /// </summary>
        /// <param name="state"></param>
        private void LongAction(object state)
        {
            for (int i = 0; i < 100; i++)
            {
                Thread.Sleep(10);
                this.Session["Task1"] = i + 1;
            }
            this.Session.Remove("Task1");
        }
        /// <summary>
        /// 刷新进度条
        /// </summary>
        /// <param name="sender"></param>
        /// <param name="e"></param>
        protected void RefreshProgress(object sender, DirectEventArgs e)
        {
            object progress = this.Session["Task1"];
            if (progress != null)
            {
                X.Msg.UpdateProgress(((int)progress) / 100f, string.Format(" {0} % {1}", progress.ToString(), 100));
            }
            else
            {
                this.TaskManager1.StopTask("Task1");
                X.MessageBox.Hide();
                Response.Redirect("Index.aspx");
            }
        }
        /// <summary>
        /// 更换皮肤
        /// </summary>
        /// <param name="theme"></param>
        /// <returns></returns>
        public string GetThemeUrl(string theme)
        {
            Theme temp = (Theme)Enum.Parse(typeof(Theme), theme);
            this.Session["Ext.Net.Theme"] = temp;
            return (temp == Ext.Net.Theme.Default) ? "Default" : X.ResourceManager.GetThemeUrl(temp);
        }

    }

服务端代码：Global.asax

        public class SoftKey
        {
            [DllImport("kernel32.dll")]
            public static extern int lstrlenA(string InString);
            [DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
            public static extern void CopyStringToByte(byte[] pDest, string pSourceg, int ByteLenr);
            [DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory")]
            public static extern void CopyByteToString(StringBuilder pDest, byte[] pSource, int ByteLenr);

            //以下用于将16进制字符串转化为无符号长整型
            private uint HexToInt(string s)
            {
                string[] hexch = { "0", "1", "2", "3", "4", "5", "6", "7",
								       "8", "9", "A", "B", "C", "D", "E", "F"};
                s = s.ToUpper();
                int i, j;
                int r, n, k;
                string ch;

                k = 1; r = 0;
                for (i = s.Length; i > 0; i--)
                {
                    ch = s.Substring(i - 1, 1);
                    n = 0;
                    for (j = 0; j < 16; j++)
                        if (ch == hexch[j])
                            n = j;
                    r += (n * k);
                    k *= 16;
                }
                return unchecked((uint)r);
            }


            public void EnCode(byte[] inb, byte[] outb, string Key)
            {

                UInt32 cnDelta, y, z, a, b, c, d, temp_2;
                UInt32[] buf = new UInt32[16];
                int n, i, nlen;
                UInt32 sum;
                //UInt32 temp, temp_1;
                string temp_string;


                cnDelta = 2654435769;
                sum = 0;

                nlen = Key.Length;
                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = Key.Substring(n - 1, 2);
                    buf[i] = HexToInt(temp_string);
                    i = i + 1;
                }
                a = 0; b = 0; c = 0; d = 0;
                for (n = 0; n <= 3; n++)
                {
                    a = (buf[n] << (n * 8)) | a;
                    b = (buf[n + 4] << (n * 8)) | b;
                    c = (buf[n + 4 + 4] << (n * 8)) | c;
                    d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
                }



                y = 0;
                z = 0;
                for (n = 0; n <= 3; n++)
                {
                    temp_2 = inb[n];
                    y = (temp_2 << (n * 8)) | y;
                    temp_2 = inb[n + 4];
                    z = (temp_2 << (n * 8)) | z;
                }


                n = 32;

                while (n > 0)
                {
                    sum = cnDelta + sum;

                    /*temp = (z << 4) & 0xFFFFFFFF;
                    temp = (temp + a) & 0xFFFFFFFF;
                    temp_1 = (z + sum) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp_1 = (z >> 5) & 0xFFFFFFFF;
                    temp_1 = (temp_1 + b) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp = (temp + y) & 0xFFFFFFFF;
                    y = temp & 0xFFFFFFFF;*/
                    y += ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);

                    /*temp = (y << 4) & 0xFFFFFFFF;
                    temp = (temp + c) & 0xFFFFFFFF;
                    temp_1 = (y + sum) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp_1 = (y >> 5) & 0xFFFFFFFF;
                    temp_1 = (temp_1 + d) & 0xFFFFFFFF;
                    temp = (temp ^ temp_1) & 0xFFFFFFFF;
                    temp = (z + temp) & 0xFFFFFFFF;
                    z = temp & 0xFFFFFFFF;*/
                    z += ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
                    n = n - 1;

                }

                for (n = 0; n <= 3; n++)
                {
                    outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
                    outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
                }

            }

            public void DeCode(byte[] inb, byte[] outb, string Key)
            {

                UInt32 cnDelta, y, z, a, b, c, d, temp_2;
                UInt32[] buf = new UInt32[16];
                int n, i, nlen;
                UInt32 sum;
                //UInt32 temp, temp_1;
                string temp_string;


                cnDelta = 2654435769;
                sum = 0xC6EF3720;

                nlen = Key.Length;
                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = Key.Substring(n - 1, 2);
                    buf[i] = HexToInt(temp_string);
                    i = i + 1;
                }
                a = 0; b = 0; c = 0; d = 0;
                for (n = 0; n <= 3; n++)
                {
                    a = (buf[n] << (n * 8)) | a;
                    b = (buf[n + 4] << (n * 8)) | b;
                    c = (buf[n + 4 + 4] << (n * 8)) | c;
                    d = (buf[n + 4 + 4 + 4] << (n * 8)) | d;
                }



                y = 0;
                z = 0;
                for (n = 0; n <= 3; n++)
                {
                    temp_2 = inb[n];
                    y = (temp_2 << (n * 8)) | y;
                    temp_2 = inb[n + 4];
                    z = (temp_2 << (n * 8)) | z;
                }


                n = 32;

                while (n-- > 0)
                {
                    z -= ((y << 4) + c) ^ (y + sum) ^ ((y >> 5) + d);
                    y -= ((z << 4) + a) ^ (z + sum) ^ ((z >> 5) + b);
                    sum -= cnDelta;

                }

                for (n = 0; n <= 3; n++)
                {
                    outb[n] = System.Convert.ToByte((y >> (n * 8)) & 255);
                    outb[n + 4] = System.Convert.ToByte((z >> (n * 8)) & 255);
                }

            }


            public string StrEnc(string InString, string Key)//使用增强算法，加密字符串
            {

                byte[] b, outb;
                byte[] temp = new byte[8], outtemp = new byte[8];
                int n, i, nlen, outlen;
                string outstring;


                nlen = lstrlenA(InString) + 1;
                if (nlen < 8)
                    outlen = 8;
                else
                    outlen = nlen;
                b = new byte[outlen];
                outb = new byte[outlen];

                CopyStringToByte(b, InString, nlen);

                b.CopyTo(outb, 0);

                for (n = 0; n <= outlen - 8; n = n + 8)
                {
                    for (i = 0; i < 8; i++) temp[i] = b[i + n];
                    EnCode(temp, outtemp, Key);
                    for (i = 0; i < 8; i++) outb[i] = outtemp[i];
                }

                outstring = "";
                for (n = 0; n <= outlen - 1; n++)
                {
                    outstring = outstring + outb[n].ToString("X2");
                }
                return outstring;
            }
            public string StrDec(string InString, string Key) //使用增强算法，加密字符串
            {
                byte[] b, outb;
                byte[] temp = new byte[8], outtemp = new byte[8];
                int n, i, nlen, outlen;
                string temp_string;
                StringBuilder c_str;


                nlen = InString.Length;
                if (nlen < 16) outlen = 16;
                outlen = nlen / 2;
                b = new byte[outlen];
                outb = new byte[outlen];

                i = 0;
                for (n = 1; n <= nlen; n = n + 2)
                {
                    temp_string = InString.Substring(n - 1, 2);
                    b[i] = System.Convert.ToByte(HexToInt(temp_string));
                    i = i + 1;
                }

                b.CopyTo(outb, 0);

                for (n = 0; n <= outlen - 8; n = n + 8)
                {
                    for (i = 0; i < 8; i++) temp[i] = b[i + n];
                    DeCode(temp, outtemp, Key);
                    for (i = 0; i < 8; i++) outb[i] = outtemp[i];
                }

                c_str = new StringBuilder("", outlen);
                CopyByteToString(c_str, outb, outlen);
                return c_str.ToString();

            }


        }

唯一锁写入Ukey:

公网客户端：安装插件

多文件安装版+需要先插入UKEY

插入UKEY

登录成功！

开始批量写唯一锁啦！