CN113626802B - Login verification system and method for equipment password - Google Patents
Login verification system and method for equipment password Download PDFInfo
- Publication number
- CN113626802B CN113626802B CN202110965611.XA CN202110965611A CN113626802B CN 113626802 B CN113626802 B CN 113626802B CN 202110965611 A CN202110965611 A CN 202110965611A CN 113626802 B CN113626802 B CN 113626802B
- Authority
- CN
- China
- Prior art keywords
- hash value
- value
- hash
- target
- user account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
- G06F21/46—Structures or tools for the administration of authentication by designing passwords or checking the strength of passwords
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
Abstract
The application provides a login verification system and a login verification method for equipment passwords, wherein a client of the system is used for acquiring a user account number and the equipment passwords to be subjected to login verification and sending the user account number to a system server; the system server is used for determining a target Salt value and a target hash value corresponding to the user account from the database, and returning the target Salt value to the client; the client is used for determining a set Salt value, obtaining a first hash value according to the set Salt value and the equipment password, carrying out hash operation according to the first hash value and a target Salt value to obtain a second hash value, encrypting the first hash value by using the second hash value as a sharing secret key, and sending a ciphertext to the system server; and the system server decrypts the ciphertext by using the target hash value, performs hash operation by using the target Salt value and the obtained first hash value to obtain a verification hash value, and compares the verification hash value with the target hash value to verify whether the equipment password is correct.
Description
Technical Field
The application relates to the field of data security, in particular to a login verification system and method for equipment passwords.
Background
The data information is used as a resource, and the universality, the sharing property, the value-added property, the treatability and the multiple-effect usability of the data information make the data information have a special significance for human beings. The essence of data information security is to protect information resources in an information system or an information network from various types of threats, interference and destruction, i.e. to guarantee the security of the information.
With the development of information technology, more and more units provide services for users and collect information of the users and store the information by utilizing a database, but data leakage events are endless for various reasons (such as that the units are not well supervised and are hacked). In the case of severe data leakage (e.g., database data leakage), a large amount of user data flows out.
Due to the difference of unit data protection measures (some units store the user's password in the clear, some units store the user's password in the MD5 value, some other modes store the user's password, such as hash value, etc.), under the condition of user data leakage, some user account passwords (even secret protection problems) are exposed, and the risk of the user account is extremely high; some users' passwords can be broken at less cost and are also technically very efficient (e.g., for passwords stored with MD5 values, they can be broken by means of a look-up table). Moreover, due to individual differences of users (habit of setting passwords, simplicity or complexity, whether a plurality of different accounts correspond to the same password, and the like), the password of the system user for cracking other units in the collision library has realizability, so that the data leakage range and risk are further diffused.
Therefore, how to protect the data security of the user, especially the account password security of the user, is a problem to be solved in the present day.
Disclosure of Invention
The embodiment of the application aims to provide a login verification system and a login verification method for equipment passwords, so that the data security of a user, particularly the security of the passwords of the user, is effectively ensured.
In order to achieve the above object, embodiments of the present application are realized by:
in a first aspect, an embodiment of the present application provides a login verification system for a device password, including a client, a system server, and a database, where the client is configured to obtain a user account to be login verified and the device password, and send the user account to the system server; the system server is used for determining a target Salt value and a target hash value corresponding to the user account from the database and returning the target Salt value to the client, wherein the database stores a group of Salt values and hash values which are uniquely corresponding to each user account; the client is further configured to determine a pre-stored set Salt value, perform a hash operation according to the set Salt value and the device password to obtain a first hash value, perform a hash operation according to the first hash value and the target Salt value to obtain a second hash value, encrypt the user account, the first hash value, the timestamp and the random number by using the second hash value as a shared secret key to obtain an encrypted ciphertext, and send the encrypted ciphertext to the system server; the system server is further configured to decrypt the encrypted ciphertext using the target hash value; if the system server fails in decryption, login failure information indicating login verification failure is returned to the client; and if the system server successfully decrypts, obtaining the user account, the first hash value, the timestamp and the random number, carrying out hash operation by using the target Salt value and the first hash value to obtain a verification hash value, comparing the verification hash value with the target hash value, and verifying whether the equipment password is correct.
In the embodiment of the application, the client sends the user account to the system server, and requests the corresponding target Salt value from the system server (the system server can determine the target Salt value and the target hash value corresponding to the user account from the database). And then, the client can determine a pre-stored set Salt value, perform hash operation according to the set Salt value and the equipment password to obtain a first hash value, perform hash operation according to the first hash value and the target Salt value to obtain a second hash value, encrypt the user account, the first hash value, the timestamp and the random number by using the second hash value as a sharing secret key to obtain an encrypted ciphertext, and send the encrypted ciphertext to the system server. At this time, the system server may decrypt the encrypted ciphertext using the target hash value (i.e., the shared key); if the system server fails to decrypt (the encrypted ciphertext sent by the client indicates that the shared secret key used by the system server is the second hash value obtained by calculation after the wrong equipment password is encrypted and is inconsistent with the target hash value stored by the system server), login failure information indicating that login verification fails is returned to the client. If the system server decrypts successfully, a user account, a first hash value, a time stamp and a random number are obtained, hash operation is carried out by using the target Salt value and the first hash value to obtain a verification hash value (the calculation mode is consistent with the mode of calculating the second hash value by the client), the verification hash value is compared with the target hash value, and whether the equipment password is correct or not is verified. If the device password is correct, the verification hash value calculated by the system server should be consistent with the target hash value, so that the reliability of system login verification can be still ensured under the condition that the target hash value is leaked (the client can use the target hash value as a sharing secret key for encryption). In addition, the login verification system of the equipment password can still maintain a reliable confidentiality effect when facing serious data leakage conditions such as database data leakage and the like: firstly, the whole login verification adopts two-stage salt hash operation, so that the data security in the login verification process can be ensured very reliably. Secondly, setting a Salt value to be stored in a client of user equipment, wherein when the condition of database data leakage is faced, a target Salt value is exposed, but the set Salt value is not exposed, based on the fact, assuming that a man-in-the-middle owns all data of a system Server and is used for impersonating a real Server, the first hash value subjected to Salt hash calculation can be decrypted from an encrypted ciphertext at most, but the first hash value cannot decrypt the equipment password. Therefore, the device password cannot be easily leaked (the condition of violent cracking is not excluded, namely the cracking is carried out in a traversing mode, but the difficulty is extremely high). Therefore, the login verification system of the device password can effectively ensure the safety of the device password of the user, and can effectively ensure that the device password of the user is not exposed even if the device password faces extreme data leakage conditions (such as database data leakage).
With reference to the first aspect, in a first possible implementation manner of the first invention, the system server is further in communication connection with an external auxiliary server, and after the system server verifies that the device password is correct, the system server is further configured to send prompt information to the auxiliary server, where the prompt information characterizes that the user account is logged in; and after receiving the prompt information, the auxiliary server is used for acquiring historical login information of the user account and updating the target Salt value or the set Salt value based on the historical login information.
In this implementation, after the system server verifies that the device password is correct, a prompt (indicating that the user account has been logged in) may be sent to the auxiliary server; after receiving the prompt information, the auxiliary server may obtain historical login information (such as login times, or last login time, or marked login time) of the user account, and update the target Salt value or the fixed Salt value based on the historical login information. By dynamically updating the target Salt value or setting the Salt value, it is possible to cope with a part of the hidden trouble caused by the fact that the user does not change the password frequently. In addition, in the case of more extreme data leakage (for example, not only database data leakage but also the preset Salt value pre-stored by the client of the user equipment is exposed for some reasons), the target Salt value or the preset Salt value can be dynamically updated, so that the security of the equipment password can be ensured. And the protection of the device password can prevent other people from being used for knocking against the device password of other accounts of the user and further diffusing the range of data leakage. In this case, even if the auxiliary server is down due to a problem and cannot be used, the normal login verification process of the login verification system for the device password is not affected (that is, the login verification system for the device password can perform login verification normally, and only during the failure of the auxiliary server, the target Salt value or the update of the set Salt value cannot be performed). After updating the target Salt value or setting the Salt value, the auxiliary server can delete the generated new Salt value (or new hash value), and when the auxiliary server is attacked and cracked, the auxiliary server cannot cause negative effects such as data leakage and the like on a login verification system of the equipment password.
With reference to the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, when the history login information meets a first condition, the auxiliary server is further configured to establish communication with a client of the binding device based on a MAC address of the user account binding device, and generate a new Salt value to send the new Salt value to the client of the binding device; the client of the binding device is configured to update the set Salt value based on the new Salt value, perform hash operation according to the updated set Salt value and the device password to obtain a new first hash value, encrypt the user account, the new first hash value, the timestamp and the random number by using the current second hash value as a shared secret key to obtain a new encrypted ciphertext, and send the new encrypted ciphertext to the system server; the system server is configured to decrypt the new encrypted ciphertext by using the current second hash value to obtain the user account, a new first hash value, a timestamp and a random number, perform hash operation based on the new first hash value and the current target Salt value to obtain a new second hash value, and update the target hash value corresponding to the user account based on the new second hash value.
In this implementation manner, the MAC address of the user account binding device (may be referred to as a user device) may be used to establish communication between the auxiliary server and the corresponding client (the client of the binding device), so that the generated new Salt value is sent to the client to update the pre-stored set Salt value (note that, after the set Salt value is updated here, the first hash value of the client may be changed, and at this time, the second hash value is not calculated, but the original second hash value is used as a shared secret key to encrypt, so as to ensure encrypted communication with the system server). The system server can also decrypt the encrypted ciphertext by using the original second hash value to obtain a new first hash value, and at the moment, the system server can calculate the new second hash value based on the first hash value and the target Salt value stored by the first hash value, so that the original target hash value is updated, and the encrypted ciphertext can be decrypted by using the updated target hash value in the next login verification. Therefore, the preset Salt value pre-stored by the client can be safely and effectively updated, and the protection of the equipment password is enhanced.
With reference to the first possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, when the history login information meets the second condition, the auxiliary server is further configured to generate a new Salt value and send the new Salt value to the system server; and the system server is used for carrying out hash operation to obtain a new second hash value based on the new Salt value and the first hash value obtained by the login verification decryption, and updating the target Salt value and the target hash value corresponding to the user account based on the new second hash value and the new Salt value.
In this implementation, the auxiliary server is configured to generate a new Salt value and send the new Salt value to the system server; the system server is used for carrying out hash operation to obtain a new second hash value based on the new Salt value and the first hash value obtained by the login verification decryption, and updating the target Salt value and the target hash value corresponding to the user account based on the new second hash value and the new Salt value. In this case, updating of the target Salt value and the target hash value can be simply and reliably achieved. When the client performs login verification next time, the updated target Salt value can be acquired from the system server to perform encryption operation and encryption communication, so that the second hash value generated by the client and the server of the system is kept consistent in the verification process (under the condition that the equipment password is correct), and the login verification is completed.
With reference to the first aspect, in a fourth possible implementation manner of the first aspect, a specific manner of performing, by the client, a hash operation to obtain a first hash value according to the set Salt value and the device password is: and after the device password is encrypted by utilizing a secure hash algorithm, carrying out slow hash operation by utilizing the set Salt value and the encrypted device password to obtain the first hash value.
In this implementation, the client encrypts the device password using a secure hash algorithm (e.g., an encryption method such as md5, SHA-256, SHA-512, etc.), and then performs a slow hash operation using the set Salt value and the encrypted device password to obtain the first hash value. Thus, the security of the encryption transmission process can be ensured (hijacking is effectively prevented), and the slow hash operation can effectively prevent cracking (the cracking takes very long time and can be regarded as being incapable of cracking) under the condition that the first hash value is exposed. And the calculation process of the slow hash operation is carried out at the client, so that the pressure of the system server can be relieved.
With reference to the first aspect, in a fifth possible implementation manner of the first aspect, the encrypting, by the client, the user account, the first hash value, the timestamp, and the random number using the second hash value as a sharing key, includes: and performing AES encryption on the user account, the first hash value, the timestamp and the random number by using the second hash value as a sharing secret key to obtain an encrypted ciphertext.
In the implementation manner, the second hash value is used as the sharing secret key between the client and the system server to carry out AES encryption on the user account, the first hash value, the time stamp and the random number, so that the encryption reliability can be effectively ensured. And, the time stamp may be used to prevent record playback attacks.
With reference to the first aspect, in a sixth possible implementation manner of the first aspect, the specific manner in which the system server compares the verification hash value with the target hash value to verify whether the device password is correct is: and comparing the verification hash value with the target hash value by adopting a comparison function with constant time, and verifying whether the equipment password is correct.
In this implementation, a comparison function that is constant in time is used to compare the verification hash value with the target hash value to verify whether the device password is correct. Thus, heuristic attacks can be effectively prevented.
In a second aspect, an embodiment of the present application provides a login verification method of a device password, which is applied to an auxiliary server in a login verification system of a device password in any one of first to third possible implementation manners of the first aspect, where the method includes: receiving prompt information sent by the system server, wherein the prompt information characterizes that the user account is logged in; and acquiring historical login information of the user account, and updating the target Salt value or the set Salt value based on the historical login information.
In order to make the above objects, features and advantages of the present application more comprehensible, preferred embodiments accompanied with figures are described in detail below.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and should not be considered as limiting the scope, and other related drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic diagram of a login verification system for a device password according to an embodiment of the present application.
Fig. 2 is an interaction diagram of operations of objects in a login verification system for a device password according to an embodiment of the present application.
Icon: 10-a login verification system of the equipment password; 11-client; 12-a system server; 13-a database; 20-auxiliary server.
Detailed Description
The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.
Referring to fig. 1, fig. 1 is a schematic diagram of a login verification system 10 for device password according to an embodiment of the present application. In the present embodiment, the login authentication system 10 of the device password may include a client 11, a system server 12, and a database 13. The client 11 interacts with a system server 12, which interacts with a database 13. The client 11 and the system server 12 may be connected to the auxiliary server 20 in communication.
By way of example, the client 11 may be a client 11 program installed in a user device, and the user device may be a smart terminal device, such as a personal computer, tablet, smart phone, etc., which is not limited herein.
The system server 12 is illustratively primarily used to provide services to users through communication with the clients 11. And the server may also access the database 13 to obtain data (e.g., data such as a target Salt value and a target hash value) stored by the database 13. The system server 12 may be a cloud server, a web server, a server cluster, etc., and is not limited herein.
Illustratively, the database 13 is primarily used to store data, for example, the database 13 may store a unique set of Salt values and hash values for each user account. Of course, the database 13 may also store personal data for each user. The database 13 may include a plurality of sub-databases, the Salt value and the hash value, and the personal data of the user, and may be stored in a combined manner or may be stored separately, depending on the actual need.
In this embodiment, the auxiliary server 20 may be a single server, or may be any assigned server in a server cluster, which is not limited herein. For example, for different situations, the server cluster may determine any currently available server that can perform a task as the auxiliary server 20 serving the user account, which is given by way of example only and not limitation.
The following describes the operation of the login authentication system 10 for a device password:
referring to fig. 2, fig. 2 is an interaction diagram of the operations of objects in the login verification system 10 for a device password according to an embodiment of the present application.
In this embodiment, when a user logs in, the client 11 may be configured to obtain a user account number and a device password to be logged in for verification, and send the user account number to the system server 12. Here, the user account may be encrypted or not encrypted, which is not limited herein.
The system server 12 may be configured to determine a target Salt value and a target hash value corresponding to the user account from the database 13, and return the target Salt value to the client 11, where the database 13 stores a set of Salt values and hash values corresponding to each user account uniquely.
Then, the client 11 may further determine a pre-stored set Salt value (pre-stored in the client 11), perform a hash operation according to the set Salt value and the device password to obtain a first hash value, perform a hash operation according to the first hash value and the target Salt value to obtain a second hash value, encrypt the user account, the first hash value, the timestamp and the random number by using the second hash value as the sharing key to obtain an encrypted ciphertext, and send the encrypted ciphertext to the system server 12.
Based on this, the system server 12 may decrypt the encrypted ciphertext using the target hash value; if the decryption by the system server 12 fails, login failure information indicating that the login authentication fails is returned to the client 11. If the system server 12 decrypts successfully, it obtains the user account, the first hash value, the timestamp and the random number, and performs hash operation by using the target Salt value and the first hash value to obtain a verification hash value, and compares the verification hash value with the target hash value to verify whether the equipment password is correct.
The system server 12 decrypts the encrypted ciphertext using the target hash value (i.e., the shared key), and if the system server 12 fails to decrypt (i.e., the encrypted ciphertext transmitted by the client 11 indicates that the shared key used by the encrypted ciphertext is the second hash value calculated after the wrong device password has been encrypted, and is inconsistent with the target hash value stored by the system server 12), login failure information indicating that login verification has failed is returned to the client 11. If the system server 12 decrypts successfully, it obtains the user account, the first hash value, the timestamp and the random number, and performs hash operation by using the target Salt value and the first hash value to obtain a verification hash value (the calculation mode is consistent with the mode of calculating the second hash value by the client 11), and compares the verification hash value with the target hash value to verify whether the device password is correct. If the device password is correct, the verification hash value calculated by the system server 12 should be consistent with the target hash value, so that the reliability of system login verification can be still ensured under the condition that the target hash value leaks (the client 11 can encrypt by using the target hash value as a sharing secret key).
In addition, the login verification system 10 of the device password can still maintain reliable confidentiality effect when facing serious data leakage conditions such as data leakage of the database 13: firstly, the whole login verification adopts two-stage salt hash operation, so that the data security in the login verification process can be ensured very reliably. Secondly, the set Salt value is stored in the client 11 of the user equipment, when the data of the database 13 is leaked, the target Salt value is exposed, but the set Salt value is not exposed, based on the fact that the intermediate has all the data of the system Server 12 and is used for impersonating the real Server, the first hash value after the Salt hash calculation can be decrypted from the encrypted ciphertext at most, but the first hash value cannot decrypt the equipment password. Therefore, the device password cannot be easily leaked (the condition of violent cracking is not excluded, namely the cracking is carried out in a traversing mode, but the difficulty is extremely high). The login verification system 10 of the device password can effectively ensure the security of the device password of the user, and can effectively ensure that the device password of the user is not exposed even in the face of extreme data leakage conditions (such as data leakage of the database 13).
In this embodiment, the specific manner in which the client 11 performs the hash operation to obtain the first hash value according to the set Salt value and the device password may be: after the device password is encrypted by using a secure hash algorithm (such as an encryption method of md5, SHA-256, SHA-512 and the like), a slow hash operation is performed by using the set Salt value and the encrypted device password, so as to obtain a first hash value.
For example, the calculation is performed in this way:
SH1＝bcrypt(SHA256(P)，Salt1，X)， (1)
where SH1 represents a first hash value, P represents a device password, bcrypt represents a slow hash function, SHA256 represents an encryption function, salt1 represents a set Salt value, and X represents an adjustment parameter of the slow hash function, for example, 10, 5, 100, or the like, taking 10 as an example, and is not limited herein.
The client 11 encrypts the device password by using a secure hash algorithm (for example, encryption methods such as md5, SHA-256, SHA-512, etc.), and then performs a slow hash operation by using the set Salt value and the encrypted device password to obtain a first hash value. Thus, the security of the encryption transmission process can be ensured (hijacking is effectively prevented), and the slow hash operation can effectively prevent cracking (the cracking takes very long time and can be regarded as being incapable of cracking) under the condition that the first hash value is exposed. Further, the calculation process of the slow hash operation is performed at the client 11, and the pressure of the system server 12 can be reduced.
In this embodiment, the specific manner in which the client 11 performs the hash operation to obtain the second hash value according to the first hash value and the target Salt value may be: and (3) performing salted hash operation on the target Salt value and the first hash value by using a secure hash algorithm (such as encryption methods of md5, SHA-256, SHA-512 and the like) to obtain a second hash value.
For example, the calculation is performed in this way:
SH2＝SHA256(SH1+Salt2)， (2)
where SH2 represents the second hash value and Salt2 represents the target Salt value.
The device password is encrypted through double salt adding hash, so that the safety of the device password can be effectively ensured, the cracking difficulty is increased, and the situation that the device password is cracked can be effectively avoided even under the condition of data leakage.
In this embodiment, the client 11 encrypts the user account, the first hash value, the timestamp and the random number by using the second hash value as the sharing key, and the specific manner of obtaining the encrypted ciphertext may be: the client 11 encrypts the user account, the first hash value, the time stamp, and the random number by AES (Advanced Encryption Standard ) using the second hash value as a shared key, to obtain an encrypted ciphertext.
For example, SH2 (second hash value) is used as a shared key (which may be understood as a negotiation key) of AES, for SH1 (first hash value), ID (user account), time (timestamp), randKey (random number), and the like:
Ticket＝AES(SH2，SH1+ID+Time+RandKey)， (3)
AES(SH2，Ticket)， (4)
Wherein, socket represents encrypted ciphertext, AES represents encryption function, SH1 and SH2 represent first hash value and second hash value respectively, ID represents user account, time represents timestamp, randKey represents random number generated by random function, sharedKey represents shared key.
AES encryption is performed on the user account, the first hash value, the timestamp and the random number by using the second hash value as a shared secret key between the client 11 and the system server 12, so that encryption reliability can be effectively ensured. And, the time stamp may be used to prevent record playback attacks.
In this embodiment, the specific manner of decrypting the encrypted ciphertext by the system server 12 using the target hash value may be: the system server 12 decrypts the received encrypted ciphertext using the target hash value as the shared key, resulting in a decrypted plaintext.
For example, the decryption process is:
Documents＝D(SH Aim ，Ticket)， (5)
wherein Documents represent plaintext, D represents decryption function, SH Aim To share a key, the Ticket is ciphertext. The decrypted Documents include SH1 (first hash value), ID (user account), time (Time stamp), randKey (random number), and the like.
Thus, the system server 12 can implement decryption of the encrypted ciphertext.
In addition, the specific manner of performing the hash operation by using the target Salt value and the first hash value by the system server 12 to obtain the verification hash value may be: the system server 12 performs a hash operation based on the target Salt value and the first hash value in accordance with the agreed calculation manner (in accordance with the manner in which the second hash value is calculated by the client 11) to obtain a verification hash value.
For example, the system server 12 may calculate the verification hash value in this manner:
SH Test ＝SHA256(SH1+Salt Aim )， (6)
wherein SH Test Representing the verification hash value, SHA256 represents the encryption function, SH1 represents the first hash value, salt Aim Indicating the target Salt value.
In the process of comparing the verification hash value with the target hash value by the system server 12, a comparison function with constant time can be adopted to compare the verification hash value with the target hash value, so that whether the device password is correct or not can be verified, and heuristic attack can be effectively prevented.
To further enhance the protection of the device password from the user account in the login authentication system 10, the set Salt value and/or the target Salt value may be dynamically updated with the auxiliary server 20.
Specifically, referring to fig. 2, the embodiment of the present application further provides a login verification method of the device password, which is applied to the auxiliary server 20 in the login verification system 10 of the device password. The login verification method of the device password may include step S10 and step S20.
Step S10: and receiving prompt information sent by the system server, wherein the prompt information characterizes that the user account is logged in.
Step S20: and acquiring historical login information of the user account, and updating the target Salt value or the set Salt value based on the historical login information.
After the system server 12 verifies that the device password is correct, the system server 12 may also send a prompt to the auxiliary server 20, where the prompt characterizes that the user account is logged in. Based on this, the assist server 20 may perform step S10.
In this embodiment, the auxiliary server 20 may receive the prompt message sent by the system server 12. After receiving the prompt message, the auxiliary server 20 may execute step S20.
In this embodiment, the auxiliary server 20 obtains historical login information (such as the login times, or the login time, the login duration, etc.) of the user account. In the present embodiment, the number of logins (may be the number of logins recorded by the system server 12 or the number of logins recorded by the auxiliary server 20 itself) is taken as an example, but the present application should not be limited thereto, and the historical login information here may be a login duration, a marked login time, or the like, for example.
The assist server 20 may then update the target Salt value or set the Salt value based on the history log information.
By dynamically updating the target Salt value or setting the Salt value, it is possible to cope with a part of the hidden trouble caused by the fact that the user does not change the password frequently. In addition, in the case of more extreme data leakage (for example, not only the database 13 is data-leaked, but also the preset Salt value pre-stored in the client 11 of the user device is exposed for some reasons), the target Salt value or the preset Salt value can be dynamically updated, so that the security of the device password can be ensured. And the protection of the device password can prevent other people from being used for knocking against the device password of other accounts of the user and further diffusing the range of data leakage. In this case, even if the auxiliary server 20 is down due to a problem and cannot be used, the normal login verification process of the login verification system 10 for the device password is not affected (that is, the login verification system 10 for the device password can perform login verification normally, and only during the failure of the auxiliary server 20, the target Salt value or the set Salt value cannot be updated). After updating the target Salt value or setting the Salt value, the assist server 20 can delete the generated new Salt value (or new hash value), and even when the assist server 20 is hacked, the login authentication system 10 for the device password is not adversely affected by data leakage or the like. If the system server 12 is broken, but the authority of updating the target Salt value and the set Salt value is on the auxiliary server 20, the updating of the target Salt value and the set Salt value is not affected, so that the equipment password is continuously protected, and the breaking difficulty of the equipment password is improved.
For example, the assist server 20 may determine whether it satisfies the first condition or the second condition based on the history login information.
Taking the example that the historical login information includes login times, the first condition may be that the login times meet n×100 times, and the second condition may be that the login times meet n×10 times; alternatively, the first condition may be that the number of times of registration satisfies an odd number of times, the second condition may be that the number of times of registration satisfies an even number of times, and the like, and is not limited thereto, as long as the frequency of actually updating the target Salt value and setting the Salt value is required. In addition, when the historical login information includes a login duration, the first condition may be that the login duration satisfies n×100 hours, and the second condition may be that the login duration satisfies n×50 hours. Or, when the history login information includes a marked login time, it may be determined that a difference between the current time and the marked login time is greater than 5 days (10 days, 30 days, etc.), and the first condition is satisfied; the difference between the current time and the login time of the mark is determined to be more than 20 days (40 days, 60 days, etc.), and the second condition is satisfied based on the actual requirement. Here, n is a positive integer. For convenience of explanation, in this embodiment, the first condition is satisfied when the number of logins is odd, and the second condition is satisfied when the number of logins is even.
In this embodiment, when the history login information satisfies the first condition, the auxiliary server 20 may establish communication with the client 11 of the binding device based on the MAC address of the binding device of the user account, and generate a new Salt value to send the new Salt value to the client 11 of the binding device.
Based on this, the client 11 of the binding device may update the set Salt value according to the received new Salt value, perform hash operation according to the updated set Salt value and the device password to obtain a new first hash value, and encrypt the user account, the new first hash value, the timestamp and the random number with the current second hash value (the second hash value used when the second hash value is still used in the login verification) as the shared secret key to obtain a new encrypted ciphertext, and send the new encrypted ciphertext to the system server 12. The specific encryption process is referred to above, and will not be described here again.
Then, the system server 12 may decrypt the new encrypted ciphertext using the current second hash value to obtain the user account, the new first hash value, the timestamp, and the random number. Then, the system server 12 may perform a hash operation based on the new first hash value and the current target Salt value to obtain a new second hash value, and update the target hash value corresponding to the user account based on the new second hash value. Thereby, the assist server 20 can update the set Salt value.
By using the MAC address of the user account binding device (which may be referred to as a user device), communication between the auxiliary server 20 and the corresponding client 11 (the client 11 of the binding device) is established, so that the generated new Salt value is sent to the client 11 to update the pre-stored set Salt value (note that, after the set Salt value is updated here, the first hash value of the client 11 is changed, and at this time, the second hash value is not calculated, but the original second hash value is used as a shared secret key to encrypt, so as to ensure encrypted communication with the system server 12). The system server 12 may decrypt the encrypted ciphertext using the original second hash value to obtain a new first hash value, and at this time, the system server 12 may calculate the new second hash value based on the first hash value and the target Salt value stored therein, thereby updating the original target hash value, so that the encrypted ciphertext may be decrypted using the updated target hash value in the next login verification. Therefore, the preset Salt value pre-stored by the client 11 can be safely and effectively updated, and the protection of the equipment password is enhanced.
In this embodiment, when the history log-in information satisfies the second condition, the assist server 20 may generate a new Salt value and transmit the new Salt value to the system server 12.
The system server 12 may be configured to perform a hash operation based on the new Salt value and the first hash value obtained by the login verification and decryption to obtain a new second hash value, and update the target Salt value and the target hash value corresponding to the user account based on the new second hash value and the new Salt value.
In this case, updating of the target Salt value and the target hash value can be simply and reliably achieved. When the client 11 performs login verification next time, the updated target Salt value can be obtained from the system server 12 to perform encryption operation and encryption communication, so that (under the condition that the device password is correct), the second hash value generated by the client 11 and the server of the system is kept consistent in the verification process, and the login verification is completed. And using the odd-even number of the login times as the judgment basis of the first condition and the second condition, updating of the set Salt value (and the target hash value) and the target Salt value (and the target hash value) can be staggered, and calculation pressures for updating the set Salt value (and the target hash value) and the target Salt value (and the target hash value) can be effectively shared and shared in the subsequent process of successful login verification each time. In addition, the updating mode is equivalent to that the target hash value used by the system server in each login verification process is different, and even if the database data is leaked, the equipment password can be effectively protected.
In addition, the auxiliary server 20 in the present embodiment does not participate in the calculation process, and therefore, the requirement for the auxiliary server 20 is low, and the configuration of the operating environment of the auxiliary server 20 can be very simple. Of course, in other possible implementations, the auxiliary server 20 may also participate in the calculation, for example, when updating the target Salt value, the first hash value of the login verification may be obtained from the system server 12, and then the generated new Salt value is utilized to perform a hash operation on the first hash value to obtain a new second hash value, and the new Salt value and the new second hash value are sent to the system server 12 for updating, so that an operation process required by the system server 12 for updating is not needed to reduce the operation pressure of the system server 12, which is not limited herein.
In summary, the embodiment of the application provides a login verification system and method for a device password, where the client 11 sends a user account to the system server 12, and requests a corresponding target Salt value from the system server 12 (the system server 12 may determine the target Salt value and the target hash value corresponding to the user account from the database 13). Then, the client 11 may determine a pre-stored set Salt value, perform a hash operation according to the set Salt value and the device password to obtain a first hash value, perform a hash operation according to the first hash value and the target Salt value to obtain a second hash value, encrypt the user account, the first hash value, the timestamp and the random number by using the second hash value as the shared secret key to obtain an encrypted ciphertext, and send the encrypted ciphertext to the system server 12. At this time, the system server 12 may decrypt the encrypted ciphertext using the target hash value (i.e., the shared key); if the system server 12 fails to decrypt (the encrypted ciphertext sent by the client 11 indicates that the shared key used by the encrypted ciphertext is the wrong device password, and the second hash value obtained by calculation after encryption is inconsistent with the target hash value stored by the system server 12), login failure information indicating that login verification fails is returned to the client 11. If the system server 12 decrypts successfully, it obtains the user account, the first hash value, the timestamp and the random number, and performs hash operation by using the target Salt value and the first hash value to obtain a verification hash value (the calculation mode is consistent with the mode of calculating the second hash value by the client 11), and compares the verification hash value with the target hash value to verify whether the device password is correct. If the device password is correct, the verification hash value calculated by the system server 12 should be consistent with the target hash value, so that the reliability of system login verification can be still ensured under the condition that the target hash value leaks (the client 11 can encrypt by using the target hash value as a sharing secret key). Moreover, the login verification system 10 of the device password can still maintain reliable confidentiality effect when facing serious data leakage conditions such as data leakage of the database 13: firstly, the whole login verification adopts two-stage salt hash operation, so that the data security in the login verification process can be ensured very reliably. Secondly, the set Salt value is stored in the client 11 of the user equipment, when the data of the database 13 is leaked, the target Salt value is exposed, but the set Salt value is not exposed, based on the fact that the intermediate has all the data of the system Server 12 and is used for impersonating the real Server, the first hash value after the Salt hash calculation can be decrypted from the encrypted ciphertext at most, but the first hash value cannot decrypt the equipment password. Therefore, the device password cannot be easily leaked (the condition of violent cracking is not excluded, namely the cracking is carried out in a traversing mode, but the difficulty is extremely high). Therefore, the login verification system 10 of the device password can effectively ensure the security of the device password of the user, and can also effectively ensure that the device password of the user is not exposed even if the device password faces extreme data leakage conditions (such as data leakage of the database 13).
In this document, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.
The foregoing is merely exemplary embodiments of the present application and is not intended to limit the scope of the present application, and various modifications and variations may be suggested to one skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.
Claims (8)
1. A login verification system of equipment passwords is characterized by comprising a client, a system server and a database,
the client is used for acquiring a user account number and a device password to be logged in and verified, and sending the user account number to the system server;
the system server is used for determining a target Salt value and a target hash value corresponding to the user account from the database and returning the target Salt value to the client, wherein the database stores a group of Salt values and hash values which are uniquely corresponding to each user account;
The client is further configured to determine a pre-stored set Salt value, perform a hash operation according to the set Salt value and the device password to obtain a first hash value, perform a hash operation according to the first hash value and the target Salt value to obtain a second hash value, encrypt the user account, the first hash value, the timestamp and the random number by using the second hash value as a shared secret key to obtain an encrypted ciphertext, and send the encrypted ciphertext to the system server;
the system server is further configured to decrypt the encrypted ciphertext using the target hash value; if the system server fails in decryption, login failure information indicating login verification failure is returned to the client; and if the system server successfully decrypts, obtaining the user account, the first hash value, the timestamp and the random number, carrying out hash operation by using the target Salt value and the first hash value to obtain a verification hash value, comparing the verification hash value with the target hash value, and verifying whether the equipment password is correct.
2. The login authentication system for a device password as recited in claim 1, wherein said system server is further communicatively connected to an external auxiliary server, wherein after said system server verifies that said device password is correct,
The system server is further used for sending prompt information to the auxiliary server, wherein the prompt information characterizes that the user account is logged in;
and after receiving the prompt information, the auxiliary server is used for acquiring historical login information of the user account and updating the target Salt value or the set Salt value based on the historical login information.
3. The login authentication system for a device password as recited in claim 2, wherein when said history login information satisfies a first condition,
the auxiliary server is further used for establishing communication with the client of the binding equipment based on the MAC address of the binding equipment of the user account, generating a new Salt value and sending the new Salt value to the client of the binding equipment;
the client of the binding device is configured to update the set Salt value based on the new Salt value, perform hash operation according to the updated set Salt value and the device password to obtain a new first hash value, encrypt the user account, the new first hash value, the timestamp and the random number by using the current second hash value as a shared secret key to obtain a new encrypted ciphertext, and send the new encrypted ciphertext to the system server;
The system server is configured to decrypt the new encrypted ciphertext by using the current second hash value to obtain the user account, a new first hash value, a timestamp and a random number, perform hash operation based on the new first hash value and the current target Salt value to obtain a new second hash value, and update the target hash value corresponding to the user account based on the new second hash value.
4. The login authentication system for a device password as recited in claim 2, wherein when said history login information satisfies a second condition,
the auxiliary server is also used for generating a new Salt value and sending the new Salt value to the system server;
and the system server is used for carrying out hash operation to obtain a new second hash value based on the new Salt value and the first hash value obtained by the login verification decryption, and updating the target Salt value and the target hash value corresponding to the user account based on the new second hash value and the new Salt value.
5. The login verification system of the device password according to claim 1, wherein the specific way for the client to perform hash operation to obtain the first hash value according to the set Salt value and the device password is as follows:
And after the device password is encrypted by utilizing a secure hash algorithm, carrying out slow hash operation by utilizing the set Salt value and the encrypted device password to obtain the first hash value.
6. The login verification system according to claim 1, wherein the client encrypts the user account, the first hash value, the timestamp and the random number by using the second hash value as a shared secret key, and the specific manner of obtaining the encrypted ciphertext is:
and performing AES encryption on the user account, the first hash value, the timestamp and the random number by using the second hash value as a sharing secret key to obtain an encrypted ciphertext.
7. The login authentication system for a device password according to claim 1, wherein the specific way for the system server to compare the authentication hash value with the target hash value to verify whether the device password is correct is:
and comparing the verification hash value with the target hash value by adopting a comparison function with constant time, and verifying whether the equipment password is correct.
8. A login verification method of a device password, characterized by being applied to an auxiliary server in a login verification system of a device password as claimed in any one of claims 2 to 4, the method comprising:
Receiving prompt information sent by the system server, wherein the prompt information characterizes that the user account is logged in;
and acquiring historical login information of the user account, and updating the target Salt value or the set Salt value based on the historical login information.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110965611.XA CN113626802B (en) | 2021-08-23 | 2021-08-23 | Login verification system and method for equipment password |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110965611.XA CN113626802B (en) | 2021-08-23 | 2021-08-23 | Login verification system and method for equipment password |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113626802A CN113626802A (en) | 2021-11-09 |
| CN113626802B true CN113626802B (en) | 2023-05-12 |
Family
ID=78387163
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110965611.XA Active CN113626802B (en) | 2021-08-23 | 2021-08-23 | Login verification system and method for equipment password |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113626802B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114169013B (en) * | 2021-12-06 | 2022-07-01 | 镁佳(北京)科技有限公司 | User registration and verification method and system |
| CN114499859A (en) * | 2022-03-22 | 2022-05-13 | 深圳壹账通智能科技有限公司 | Password verification method, device, equipment and storage medium |
| CN115955307B (en) * | 2023-03-10 | 2023-05-23 | 江西曼荼罗软件有限公司 | User password salification protection method and device, readable storage medium and electronic equipment |
| CN117579254B (en) * | 2024-01-16 | 2024-03-12 | 金财数科(北京)信息技术有限公司 | Encryption method, system and device for data transmission |
Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107369125A (en) * | 2017-06-13 | 2017-11-21 | 重庆第二师范学院 | Robust watermarking detection method and device for data flow |
| CN107733656A (en) * | 2017-10-23 | 2018-02-23 | 北京深思数盾科技股份有限公司 | A kind of cipher authentication method and device |
| CN107911343A (en) * | 2017-10-27 | 2018-04-13 | 深圳英飞拓科技股份有限公司 | The password storage verification method and device of safety |
| CN110990809A (en) * | 2019-11-26 | 2020-04-10 | 卓尔购信息科技(武汉)有限公司 | Password salting verification method and system based on workload |
| CN111538983A (en) * | 2020-07-03 | 2020-08-14 | 杭州摸象大数据科技有限公司 | User password generation method and device, computer equipment and storage medium |
| CN111611576A (en) * | 2020-04-30 | 2020-09-01 | 南京南瑞继保工程技术有限公司 | Account key verification method and device and computer storage medium |
| CN111917535A (en) * | 2020-06-30 | 2020-11-10 | 山东信通电子股份有限公司 | Data encryption storage method and device and server |
| CN112487383A (en) * | 2020-11-17 | 2021-03-12 | 重庆第二师范学院 | Computer system for ensuring information safety and control method thereof |
| CN113254989A (en) * | 2021-04-27 | 2021-08-13 | 支付宝(杭州)信息技术有限公司 | Fusion method and device of target data and server |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7228417B2 (en) * | 2002-02-26 | 2007-06-05 | America Online, Inc. | Simple secure login with multiple-authentication providers |
| US9813414B2 (en) * | 2015-11-30 | 2017-11-07 | International Business Machines Corporation | Password-based management of encrypted files |
| CN105743638B (en) * | 2016-05-13 | 2018-10-23 | 江苏中天科技软件技术有限公司 | Method based on B/S architecture system client authorization certifications |
| US9961053B2 (en) * | 2016-05-27 | 2018-05-01 | Dropbox, Inc. | Detecting compromised credentials |
| US11005650B2 (en) * | 2016-10-19 | 2021-05-11 | Stripe, Inc. | Systems and methods for data management and the use of salts and keys in data encryption/decryption |
| US10554630B2 (en) * | 2017-01-04 | 2020-02-04 | Facebook, Inc. | Systems and methods for secure password transmission and verification |
| CN106656476B (en) * | 2017-01-18 | 2020-12-01 | 腾讯科技（深圳）有限公司 | Password protection method and device and computer readable storage medium |
-
2021
- 2021-08-23 CN CN202110965611.XA patent/CN113626802B/en active Active
Patent Citations (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107369125A (en) * | 2017-06-13 | 2017-11-21 | 重庆第二师范学院 | Robust watermarking detection method and device for data flow |
| CN107733656A (en) * | 2017-10-23 | 2018-02-23 | 北京深思数盾科技股份有限公司 | A kind of cipher authentication method and device |
| CN107911343A (en) * | 2017-10-27 | 2018-04-13 | 深圳英飞拓科技股份有限公司 | The password storage verification method and device of safety |
| CN110990809A (en) * | 2019-11-26 | 2020-04-10 | 卓尔购信息科技(武汉)有限公司 | Password salting verification method and system based on workload |
| CN111611576A (en) * | 2020-04-30 | 2020-09-01 | 南京南瑞继保工程技术有限公司 | Account key verification method and device and computer storage medium |
| CN111917535A (en) * | 2020-06-30 | 2020-11-10 | 山东信通电子股份有限公司 | Data encryption storage method and device and server |
| CN111538983A (en) * | 2020-07-03 | 2020-08-14 | 杭州摸象大数据科技有限公司 | User password generation method and device, computer equipment and storage medium |
| CN112487383A (en) * | 2020-11-17 | 2021-03-12 | 重庆第二师范学院 | Computer system for ensuring information safety and control method thereof |
| CN113254989A (en) * | 2021-04-27 | 2021-08-13 | 支付宝(杭州)信息技术有限公司 | Fusion method and device of target data and server |
Non-Patent Citations (3)
| Title |
|---|
| A password stretching method using user specific salts;ChangHee Lee,Heejo Lee;《Proceedings of the 16th international conference on World Wide Web》;1215-1216 * |
| 一种带有盐度值的安全哈希加密算法的设计与实现;李兴望，陈磊松，周小方;《漳州师范学院学报 自然科学版》(第02期);49-52 * |
| 邹晓兵. 工程教育下的计算机科学与技术专业课程体系建设探索.《科学大众(科学教育) 》.2019,(第07期),161+21. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113626802A (en) | 2021-11-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113626802B (en) | Login verification system and method for equipment password | |
| CN106104562B (en) | System and method for securely storing and recovering confidential data | |
| US7139917B2 (en) | Systems, methods and software for remote password authentication using multiple servers | |
| US6539479B1 (en) | System and method for securely logging onto a remotely located computer | |
| US6883095B2 (en) | System and method for password throttling | |
| US20170244687A1 (en) | Techniques for confidential delivery of random data over a network | |
| US9491174B2 (en) | System and method for authenticating a user | |
| CN108418691A (en) | Dynamic network identity identifying method based on SGX | |
| CN110505055B (en) | External network access identity authentication method and system based on asymmetric key pool pair and key fob | |
| CN106790045B (en) | distributed virtual machine agent device based on cloud environment and data integrity guarantee method | |
| CN105681470A (en) | Communication method, server and terminal based on hypertext transfer protocol | |
| Wang et al. | Secure password-based remote user authentication scheme against smart card security breach | |
| KR100777317B1 (en) | Incorporating shared randomness into distributed cryptography | |
| CN110519222B (en) | External network access identity authentication method and system based on disposable asymmetric key pair and key fob | |
| WO2021109817A1 (en) | Key update method, data decryption method, and digital signature authentication method | |
| CN115473655B (en) | Terminal authentication method, device and storage medium for access network | |
| CN108900595B (en) | Method, device and equipment for accessing data of cloud storage server and computing medium | |
| Chase et al. | Acsesor: A new framework for auditable custodial secret storage and recovery | |
| CN114553566A (en) | Data encryption method, device, equipment and storage medium | |
| CN112260831A (en) | Security authentication method based on dynamic key | |
| US11509468B2 (en) | Method and system for verifying secret decryption capability of escrow agents | |
| CN111031075B (en) | Network service security access method, terminal, system and readable storage medium | |
| Zhu et al. | Improvement upon mutual password authentication scheme | |
| ALnwihel et al. | A Novel Cloud Authentication Framework | |
| Lin et al. | A Certificate Management Mechanism Using Distributed Ledger |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |