WO2015101332A1

WO2015101332A1 - Password classification management method and system

Info

Publication number: WO2015101332A1
Application number: PCT/CN2014/095930
Authority: WO
Inventors: 玄立永
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2013-12-31
Filing date: 2014-12-31
Publication date: 2015-07-09
Also published as: CN104753677B; CN104753677A

Abstract

A password classification management method, comprising the following steps: receiving a secondary password setting request of a current login account; verifying whether a password used during login of the current login account is a primary password; and after the verification has passed, receiving an input secondary password and permission corresponding to the secondary password, and storing correlations among the current login account, the secondary password and the corresponding permission, wherein the primary password and the secondary password are two types of passwords of the account, and one primary password corresponds to one or more secondary passwords. In the method, when a certain account is logged in using a primary password, a secondary password of the account and permission corresponding to the secondary password can be set, so that the user information can be prevented from being divulged or the account password can be prevented from being tampered with when the account is logged in using the secondary password. Therefore, the method and system can improve the information security when multiple users share the same account. In addition, also provided is a password classification management system.

Description

Password hierarchical management method and system

The present application claims priority to Chinese Patent Application No. 20131075470, filed on Dec. 31, 2013, the entire disclosure of which is incorporated herein by reference.

[Technical Field]

The present application relates to the field of Internet and computer technologies, and in particular, to a password hierarchical management method and system, and to a computer storage medium including instructions for performing a password hierarchical management method.

【Background technique】

With the development of Internet technology and computer technology, various web application services have prospered unprecedentedly, and people use various web application services provided by various service platforms for social, entertainment, work and learning activities. Before the user first uses the web application service provided by a certain service platform, the user account needs to be registered on the service platform, and the account name and password are input in the process of registering the user account. Each time the user uses the web application service provided by the service platform, the user must enter the registered account name and password to log in to the service platform and enter the application service page.

Generally, an account name in the existing service platform corresponds to a password. After the user logs in using a valid account name and password, the service platform provides the user with all service functions of the service platform. However, a password leak has a very large risk, such as leaking all users' information, and allowing the password thief to tamper with the password arbitrarily, or stealing the password to complete any user behavior.

[Summary of the Invention]

Based on this, it is necessary to provide a password hierarchical management method that can improve information security.

A password hierarchical management method includes:

Receiving a secondary password setting request of the current login account;

Verify whether the current login account is used to log in to the master password;

After the verification is passed, receiving the input secondary password and the permission corresponding to the secondary password, and storing the correspondence between the current login account, the secondary password, and the corresponding authority;

The master password and the secondary password are two password types of an account, and one master password corresponds to one or more secondary passwords.

In addition, it is necessary to provide a password hierarchical management system that can improve information security.

A password hierarchical management system comprising:

a receiving module, configured to receive a secondary password setting request of the currently logged in account;

An authentication module, configured to verify whether the current login account is used to log in or not;

The receiving module is further configured to: after the verification is passed, receive the input secondary password and the permission corresponding to the secondary password;

Corresponding relationship storage module, configured to store a correspondence between the current login account, the secondary password, and the corresponding authority;

Further, a computer readable storage medium is also provided.

One or more computer readable storage media containing computer executable instructions for performing the cryptographic hierarchical management method described above.

The password classification management method and system and the executable instruction for executing the password hierarchical management method in the computer readable storage medium, after receiving the secondary password setting request of the current login account, verifying whether the current login account is used to log in or not. After the verification is passed, the input secondary password and the corresponding password of the secondary password are received, and the correspondence between the current login account secondary password and the corresponding authority is stored. In the above method and system, when an account is logged in using the master password, the sub password of the account can be set and the permission corresponding to the sub password can be set. It can improve information security. For example, it can prevent the account from leaking user information or tampering with the account password when logging in with the secondary password, thereby improving information security.

[Description of the Drawings]

1 is a schematic flowchart of a password hierarchical management method in a specific embodiment;

2 is a schematic flowchart of a process of providing a corresponding function according to a password according to a password hierarchical management method in a specific embodiment;

3 is a schematic diagram of interaction between a secondary password and a permission setting process of the password hierarchical management method in the specific embodiment;

4 is a schematic diagram of interaction of a process for providing a corresponding function according to a password according to a password hierarchical management method in a specific embodiment;

FIG. 5 is a schematic structural diagram of a password hierarchical management system in a specific embodiment; FIG.

6 is a schematic structural diagram of a password hierarchical management system in a specific embodiment;

7 is a schematic structural diagram of a password hierarchical management system in a specific embodiment;

FIG. 8 is a schematic diagram of an exemplary computer system environment in which embodiments of the present application can be implemented.

【detailed description】

In order to make the objects, technical solutions, and advantages of the present application more comprehensible, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The components and components in the present application may be present in a single form or in multiple forms, and the present application is not limited thereto. The steps in the present application are arranged by reference numerals, but are not intended to limit the order of the steps. The relative order of the steps may be adjusted unless the order of the steps is explicitly stated or the execution of the steps requires other steps as a basis. It will be understood that the term "and/or" as used herein relates to and encompasses any and all possible combinations of one or more of the associated listed items.

In the password classification management method and system of the present application, hierarchical management of the primary password and the secondary password is involved. The master password and the secondary password are the master-slave relationship, that is, if there is no master password, there will be no secondary password in the system, and one master password corresponds to one or more secondary passwords.

For example, when the password hierarchical management method and the system are applied to the account password system, the master password may be the login password of the account, and the secondary password may be other passwords manually set after the account is registered by using the master password. The login password of the account can be the password entered when registering an account. The above descriptions of the primary password and the secondary password are only examples. The primary password, the type of the secondary password, and the setting manner are not limited. For example, the primary password may also be other types of passwords, such as an account authentication password, such as a secondary password. It can also be the password generated by the system at the same time as the login password of the master password.

In the embodiment shown in FIG. 1, a password hierarchical management method includes:

S102. Receive a secondary password setting request of the current login account.

The secondary password setting request is a request to set a secondary password.

S104. Verify whether the current login account is used to log in or not.

The master password and the secondary password are the two password types of the account, and one master password corresponds to one or more secondary passwords.

If the password entered when the account is logged in is the primary password, it means that the current login account uses the master password.

In one embodiment, S104 may prompt to input the master password and verify whether the entered password is a legitimate master password, and if so, determine that the current login account is used to log in using the master password. Because if the currently entered password is a legal master password, it means that the master password can also be entered when the account is logged in. Therefore, it can be verified whether the current login password is a valid master password to verify whether the current login account is used for login. password.

In another embodiment, before S104, the password classification management method further includes the step of: when the account is logged in with a valid master password, marking the current login account to use the master password when logging in. In this embodiment, S104 may check whether the current login account is useful to indicate that the primary password is used when logging in, and if so, determine that the current login account is used to log in using the master password. In one embodiment, if the current login account is logged in without using a master password, the process may end.

S106. When the current login account is logged in, the master password is used, and the input secondary password and the password corresponding to the secondary password are received.

In one embodiment, the secondary password may be prompted and prompted to set the permissions corresponding to the secondary password. Different permissions correspond to different functions. The function corresponding to the permission can be set and stored in advance.

S108. Store a correspondence between a current login account, a secondary password, and a corresponding permission.

In an embodiment, the correspondence between the current login account and the secondary password may be stored, and the correspondence between the secondary password and the authority may be stored.

In an embodiment, the password classification management method further includes a process of modifying a secondary password corresponding authority, the process comprising the steps of: receiving a request for modifying a permission corresponding to the secondary password; and verifying whether the current login account is used to log in or not. After the verification is passed, the modified authority of the input is received, and the correspondence between the secondary password and the modified authority is stored.

The request for modifying the permission corresponding to the secondary password includes the information of the secondary password and the modified authority. The original authority corresponding to the secondary password included in the request may be queried in the correspondence table of the secondary password and the authority, and the original authority is modified to the modified authority included in the request; or the record corresponding to the secondary password included in the request is deleted. And add a record containing the secondary password and the modified permissions.

In an embodiment, the password classification management method further includes a process of modifying a secondary password, and the process includes the following steps:

Receiving a request to modify the secondary password;

Verify the type of password used to log in to the current login account;

If the type of the password used is the primary password, the original password to be modified and the corresponding new secondary password are received, and the correspondence between the current login account, the original secondary password, and the corresponding authority is changed to the current login account. Correspondence between the new secondary password and the corresponding authority;

If the type of the password used is a secondary password, the new secondary password entered is received, and the correspondence between the original secondary password and the new secondary password used in the login is saved, and the current login account is re-registered with the primary password; When re-login with the master password, send a modification sub-password approval request to the login client. The approval request includes the original secondary password and the new secondary password; receive the approval result sent by the login client; modify the original secondary password or abort the modification according to the approval result. Original secondary password.

In an embodiment, if the approval result indicates that the modification is allowed, the correspondence between the current login account, the original secondary password, and the corresponding permission is changed to a correspondence between the current login account, the new secondary password, and the corresponding authority. And the correspondence between the original secondary password and the new secondary password used in the saved login is deleted; if the approval result indicates that the modification is not allowed, the correspondence between the original secondary password and the new secondary password used in the saved login is deleted.

In the above embodiment, the secondary password can be modified according to requirements, for example, the secondary password is modified into a better memory sequence, and the rights corresponding to the original secondary password are retained, thereby providing operational convenience.

In the embodiment shown in FIG. 2, the foregoing password classification management method further includes the steps of:

S202. Receive a login request, where the login request includes an account and a password.

S204. Verify the legality and type of the password included in the login request.

In an embodiment, the correspondence between the account and the master password and the correspondence between the account and the secondary password are respectively stored in two different data tables, and S204 can be searched in the data table of the correspondence between the account and the master password. The password corresponding to the account included in the login request, if the search is successful, matches the found password with the password included in the login request. If the matching is consistent, it is determined that the password included in the login request is legal and the password type is dominant. If the password is inconsistent, it is determined that the password included in the login request is not a valid password; if the search fails, the password corresponding to the account included in the login request is searched in the data table corresponding to the storage account and the secondary password. If the search succeeds, the password that is found is matched with the password included in the login request. If the matching is consistent, the password included in the login request is legal and the password type is a secondary password. If the search fails, the login request is included. The password is not a valid password.

In another embodiment, the correspondence between the account number and the password (including the primary password and the secondary password) can be stored in a data table, and a field marking the password type is added to the data table. The field of the tag password type may be a Boolean type, which is used to indicate whether it is a master password (or to indicate whether it is a secondary password); if the field is yes, it is a master password (or a secondary password). The field of the tag password type may also be a string type, which is used to represent the password parameter of the password, and the permission parameter may be understood as the name of the password; when the primary password and the secondary password are stored, the primary password and the secondary password may be set. The prefix characters of the permission parameters are different. For example, the permission parameter corresponding to the primary password starts with “main”, and the permission parameter corresponding to the secondary password starts with “sub”; or, since there is only one primary password, the permission parameter may not be set when the primary password is stored. The permission parameter is set when the secondary password is stored. The foregoing S204 may search for an account included in the login request in a data table that stores the correspondence between the account and the password, and obtain a corresponding password, and match the obtained password with the password included in the login request, and if the matching is inconsistent, determine the login. The password included in the request is not a valid password; if the matching is consistent, it is determined according to the corresponding field of the marked primary password and the secondary password that the password included in the login request is a primary password or a secondary password.

S206. If the password included in the login request is legal, obtain the corresponding permission according to the type of the password, and provide a corresponding function according to the corresponding permission.

Obtaining the corresponding permission according to the type of the password includes the following steps: if the password included in the login request is a secondary password, querying the permission corresponding to the password included in the login request; if the password included in the login request is the primary password, obtaining the default primary The password corresponding to the password. In one embodiment, the default master password corresponds to all permissions, as there is no need to restrict permissions for the master password.

If the password included in the login request is neither the legal master password nor the legal secondary password of the account included in the login request, the password input error may be prompted.

In an embodiment, after the step S106, the password grading management method further includes the steps of: generating a privilege parameter corresponding to the secondary password; S108, comprising: storing a correspondence between the current login account, the secondary password, and the corresponding privilege parameter, and storing The correspondence between the permission parameters and the corresponding permissions.

The permission parameter is a symbol name or a numeric serial number for identifying the secondary password, and the permission parameter of the secondary password can be understood as the name of the secondary password, and the permission parameters corresponding to the different secondary passwords are different. The correspondence between the current login account, the secondary password and the corresponding permission parameter, and the correspondence between the permission parameter and the authority may be stored in two different data tables, respectively.

In this embodiment, the step of querying the password corresponding to the password included in the login request includes: obtaining a permission parameter corresponding to the password included in the login request, and querying the permission corresponding to the permission parameter.

In this embodiment, in the process of modifying the corresponding password of the secondary password, the step of storing the correspondence between the secondary password and the modified authority is: obtaining the permission parameter corresponding to the secondary password, and storing the correspondence between the obtained permission parameter and the modified authority relationship. The original authority corresponding to the obtained permission parameter may be queried in the correspondence table between the permission parameter and the permission, and the original authority is modified to the modified permission included in the request; or the record corresponding to the obtained permission parameter is deleted, and the inclusion and acquisition are added. The permission parameters are recorded with the modified permissions.

In the embodiment, in the process of modifying the secondary password, the step of modifying the correspondence between the current login account, the original secondary password, and the corresponding authority to the correspondence between the current login account, the new secondary password, and the corresponding permission is performed. The relationship between the current login account, the original secondary password, and the corresponding permission parameter is changed to the correspondence between the current login account, the new secondary password, and the corresponding permission parameter.

Because the password involves the security of the user information, the password needs a higher storage security level. In this embodiment, the password and the authority are separately stored and managed, and the secondary password and the authority are corresponding through the intermediate permission parameter, so that the password is safely implemented separately. Storage management can not only ensure the security of user passwords, but also reduce storage management costs.

When a user may need to work with other users to complete the task on the service platform, the user can restrict the use of all service functions by other users who log in to the service platform through the setting of the secondary password and the permission. That is, other users who log in to the service platform can only use certain service functions of the service platform, rather than all service functions, by virtue of the account name and the secondary password.

In one embodiment, a password hierarchical management method runs on a client, an application server, a password storage server, and a rights storage server. The password hierarchical management method includes a secondary password and a permission setting process, and FIG. 3 is the password classification. The interaction code of the secondary password and the permission setting process of the management method, the secondary password and permission setting process includes the following steps:

(1) The application server receives a secondary password setting request of the current login account sent by the client.

(2) The application server sends an instruction to the client to input the master password. The client prompts for the master password and sends the entered master password to the application server. The application server sends the current login account and the entered master password to the password storage server. The password storage server verifies whether the input master password is the legal master password of the current login account according to the correspondence between the pre-stored account and the master password. If yes, the verification succeeds, and if not, the verification fails; the verification result is sent to the application server. .

(3) If the application server receives the verification pass result, the client is sent an instruction to input the sub password and the authority corresponding to the sub password. The client can prompt for the secondary password and prompt for the permission corresponding to the secondary password. The further application server receives the input secondary password and the permission corresponding to the secondary password from the client.

(4) The application server generates a permission parameter corresponding to the secondary password; sends the current login account, the secondary password, and the corresponding permission parameter to the password storage server, and sends the permission parameter and the corresponding permission to the permission storage server. The password storage server stores the correspondence between the current login account, the secondary password, and the corresponding permission parameter, and returns a result of the storage success or failure to the application server; the correspondence between the permission storage server storage permission parameter and the corresponding permission, and The application server returns the result of the storage success or not.

Because the password involves the security of the user information, the password needs a higher storage security level. In this embodiment, the password and the authority are respectively stored in the password storage server and the rights storage server, and the secondary password and the authority are corresponding through the intermediate permission parameter. It is convenient to implement a high-security storage management for the password separately, that is, the security of the user password can be ensured, and the storage management cost can be reduced.

In an embodiment, the password classification management method further includes a process of providing a corresponding service according to the password, and FIG. 4 is an interaction diagram of the process of providing the corresponding service according to the password according to the password classification management method, and the process of providing the corresponding service according to the password includes the following steps. :

(1) The application server receives a login request sent by the client, and the login request includes an account number and a password. Further, the application server sends the account and password included in the login request to the password storage server.

(2) The password storage server queries the master password corresponding to the account included in the login request, and checks whether the password included in the login request matches the master password, and if so, the verification result that matches the password included in the login request with the master password. Return to the application server, if not, query the secondary password corresponding to the account included in the login request, and check whether the password included in the login request matches the secondary password. If the password included in the login request matches the secondary password, the corresponding permission parameter is obtained, and the permission parameter is sent to the permission storage server; the permission storage server queries the permission corresponding to the permission parameter, and returns the queried authority to the application server. If the password included in the login request does not match the secondary password, the password storage server returns the verification result that the password included in the login request is not a valid password to the application server.

(3) If the application server receives the verification result that the password included in the login request returned by the password storage server matches the master password, the client provides the service corresponding to all the rights. If the application server receives the queried permission returned by the privilege storage server, the corresponding function is provided to the client according to the privilege. If the application server receives the verification result that the password included in the login request returned by the password storage server is not a valid password, the application server sends a password error message to the client; the client may prompt the password input error.

In the embodiment shown in FIG. 5, a password hierarchical management system includes a receiving module 502, an identity verification module 504, and a corresponding relationship storage module 506, where:

The receiving module 502 is configured to receive a secondary password setting request of the currently logged in account.

The password entered when registering an account can be referred to as the master password of the account. After the registration is successful, the other password set after logging in using the account can be referred to as the secondary password of the account. The secondary password setting request is a request to set a secondary password.

The authentication module 504 is configured to verify whether the current login account is used as a master password; the master password and the secondary password are two password types of the account, and one master password corresponds to one or more secondary passwords.

In an embodiment, the password classification management system further includes a prompting module (not shown) for prompting to input a master password, and the identity verification module 504 can verify whether the entered password is a legal master password, and if so, determining Verification passed. Because if the currently entered password is a legal master password, it means that the master password can also be entered when the account is logged in. Therefore, it can be verified whether the current login password is a valid master password to verify whether the current login account is used for login. password.

In another embodiment, the password classification management system further includes a marking module, configured to mark the current login account to use the master password when the account is logged in with a valid master password. In this embodiment, the identity verification module 504 can check whether the current login account is useful to indicate that the login uses the master password.

The receiving module 502 is further configured to: after the verification is passed, receive the input secondary password and the permission corresponding to the secondary password. If it is verified that the current login account is using the master password identity, the verification is passed.

In an embodiment, the prompting module may prompt to input a secondary password and prompt to set a permission corresponding to the secondary password. Different permissions correspond to different functions. In an embodiment, the password classification management system further includes a function setting module, configured to preset and save a function corresponding to the permission.

The correspondence relationship storage module 506 stores the correspondence between the current login account, the secondary password, and the corresponding authority.

In an embodiment, the correspondence storage module 506 can store the correspondence between the current login account and the secondary password, and store the correspondence between the secondary password and the permission.

In an embodiment, the receiving module 502 is further configured to receive a request for modifying the permission corresponding to the secondary password; the identity verification module 504 is further configured to verify whether the current login account is used to log in, and the receiving module 502 is further configured to verify After the pass, the input modified permission is received; the corresponding relationship storage module 506 is further configured to store the correspondence between the secondary password and the modified authority.

The request for modifying the permission corresponding to the secondary password includes the information of the secondary password and the modified authority. The correspondence relationship storage module 506 can query the original authority corresponding to the secondary password included in the request in the correspondence table of the secondary password and the authority, and modify the original authority to the modified authority included in the request; or, the correspondence relationship storage module 506 can Delete the record corresponding to the secondary password included in the request, and add a record containing the secondary password and the modified authority.

In an embodiment, the receiving module 502 is further configured to receive a request for modifying a secondary password; the identity verification module 504 is further configured to verify a type of a password used when the current login account is logged in;

The receiving module 502 is further configured to: if the type of the used password is a primary password, receive the input original secondary password to be modified and the corresponding new secondary password, and the corresponding relationship storage module 506 is further configured to use the current login account and the original secondary password. And the corresponding relationship between the corresponding rights is modified to be a correspondence between the current login account, the new secondary password, and the corresponding permission;

The receiving module 502 is further configured to: if the type of the used password is a secondary password, receive the input new secondary password, and the corresponding relationship storage module 506 is further configured to save the correspondence between the original secondary password and the new secondary password used in the login; In this embodiment, the password classification management apparatus further includes a monitoring module and a sending module (not shown), the monitoring module waits for the current login account to re-log in with the master password; and the sending module is configured to log in again with the master password when the current login account is re-registered. And sending a modified secondary password approval request to the login client, where the approval request includes the original secondary password and the new secondary password; the receiving module 502 is further configured to receive the approval result sent by the login client; the correspondence storage module 506 is further configured to The result of the approval is to modify the original secondary password or to abort the original secondary password. If the result of the approval indicates that the modification is allowed, the correspondence storage module 506 modifies the correspondence between the current login account, the original secondary password, and the corresponding authority to the correspondence between the current login account, the new secondary password, and the corresponding authority, and The correspondence between the original secondary password and the new secondary password used in the saved login is deleted; the correspondence storage module 506 is further configured to delete the original secondary password and the new secondary used when the saved login is not allowed to be modified. The correspondence of passwords.

In an embodiment, the receiving module 502 is further configured to receive a login request, where the login request includes an account number and a password.

The authentication module 504 is also used to verify the legitimacy and type of the password included in the login request.

In an embodiment, the correspondence storage module 506 can store the correspondence between the account and the master password and the correspondence between the account and the secondary password in two different data tables, and the identity verification module 504 can store the account and the master password. In the data table of the corresponding relationship, the password corresponding to the account included in the login request is searched. If the search is successful, the found password is matched with the password included in the login request. If the matching is consistent, the password included in the login request is determined. It is legal and the password type is the primary password. If the matching is inconsistent, it is determined that the password included in the login request is not a valid password; if the search fails, the login request is included in the data table corresponding to the storage account and the secondary password. If the password is correct, the password is matched with the password included in the login request. If the matching is consistent, it is determined that the password included in the login request is legal and the password type is a secondary password. If it fails, it is determined that the password included in the login request is not a valid password.

In another embodiment, the correspondence storage module 506 can store the correspondence between the account and the password (including the primary password and the secondary password) into a data table, and add a field marking the password type to the data table; The password type field can be a Boolean type, which is used to indicate whether it is a master password (or to indicate whether it is a secondary password); if the field is yes, it is a master password (or a secondary password). The field of the tag password type may also be a string type, which is used to represent the password parameter of the password, and the permission parameter may be understood as the name of the password; when the primary password and the secondary password are stored, the primary password and the secondary password may be set. The prefix characters of the permission parameters are different. For example, the permission parameter corresponding to the primary password starts with “main”, and the permission parameter corresponding to the secondary password starts with “sub”; or, since there is only one primary password, the permission parameter may not be set when the primary password is stored. The permission parameter is set when the secondary password is stored. The identity verification module 504 can search the account included in the login request in the data table that stores the correspondence between the account and the password, and obtain the corresponding password, and match the obtained password with the password included in the login request. It is determined that the password included in the login request is not a valid password; if the matching is consistent, it is determined according to the corresponding field of the marked primary password and the secondary password that the password included in the login request is a primary password or a secondary password.

In this embodiment, as shown in FIG. 6, the password grading management system further includes a function providing module 602, configured to: if the password included in the login request is legal, obtain the corresponding privilege according to the type of the password, and provide corresponding according to the corresponding privilege The function.

The process of the function providing module 602 obtaining the corresponding permission according to the type of the password includes: if the password included in the login request is a secondary password, querying the permission corresponding to the password included in the login request; if the password included in the login request is the primary password, Get the permissions corresponding to the default master password. In one embodiment, the default master password corresponds to all permissions, as there is no need to restrict permissions for the master password.

If the password included in the login request is neither the legal master password nor the legal secondary password of the account included in the login request, the prompting module may prompt the password input error.

In the embodiment shown in FIG. 7, the password classification management system further includes a permission parameter generation module 702, configured to generate a permission parameter corresponding to the secondary password after receiving the input secondary password and the permission corresponding to the secondary password; The module 506 is configured to store a correspondence between the current login account, the secondary password, and the corresponding permission parameter, and store a correspondence between the permission parameter and the corresponding permission.

The permission parameter is a symbol name or a numeric serial number for identifying the secondary password, and the permission parameter of the secondary password can be understood as the name of the secondary password, and the permission parameters corresponding to the different secondary passwords are different. The correspondence relationship storage module 506 can store the correspondence between the current login account, the secondary password and the corresponding permission parameter, and the correspondence between the permission parameter and the authority in two different data tables.

In this embodiment, the process of querying the privilege corresponding to the password included in the login request by the function providing module 602 includes: obtaining a privilege parameter corresponding to the password included in the login request, and querying the privilege corresponding to the privilege parameter.

In this embodiment, the process of the corresponding relationship storage module 506 storing the correspondence between the secondary password and the modified authority includes: obtaining the permission parameter corresponding to the secondary password, and storing the correspondence between the obtained permission parameter and the modified authority. The correspondence relationship storage module 506 can query the original authority corresponding to the obtained permission parameter in the correspondence table between the permission parameter and the authority, and modify the original authority to the modified authority included in the request; or delete the record corresponding to the obtained permission parameter. And add a record that contains the obtained permission parameters with the modified permissions.

In this embodiment, the process in which the correspondence relationship storage module 506 modifies the correspondence between the current login account, the original secondary password, and the corresponding authority to the correspondence between the current login account, the new secondary password, and the corresponding permission includes: The correspondence between the current login account, the original secondary password, and the corresponding permission parameters is changed to the correspondence between the current login account, the new secondary password, and the corresponding permission parameters.

The password classification management method and system, after receiving the secondary password setting request of the current login account, verify whether the current login account is used as a master password, and after the verification is passed, the input secondary password and the password corresponding to the secondary password are received. Stores the correspondence between the current login account secondary password and the corresponding permissions. In the above method and system, when an account is logged in using the master password, the sub password of the account can be set and the permission corresponding to the sub password can be set, thereby preventing the account from leaking the user information or tampering with the account password when using the secondary password. The above method and system can improve information security when multiple users share the same account.

FIG. 8 is a block diagram of a computer system 1000 in which embodiments of the present application can be implemented. The computer system 1000 is merely an example of a computer environment suitable for use in the present application and is not to be considered as limiting the scope of use of the application. Computer system 1000 is also not to be construed as requiring a combination of one or more components in an exemplary computer system 1000 that is dependent on or illustrated.

Computer system 1000 shown in Figure 8 is an example of a computer system suitable for use in the present application. Other architectures with different subsystem configurations can also be used. For example, desktops, notebooks, and the like that are well known to the public can be applied to some embodiments of the present application. However, it is not limited to the devices listed above.

As shown in FIG. 8, computer system 1000 includes a processor 1010, a memory 1020, and a system bus 1022. Various system components, including memory 1020 and processor 1010, are coupled to system bus 1022. Processor 1010 is a hardware for executing computer program instructions through basic arithmetic and logic operations in a computer system. Memory 1020 is a physical device for temporarily or permanently storing computing programs or data (eg, program state information). System bus 1020 can be any of the following types of bus structures, including a memory bus or memory controller, a peripheral bus, and a local bus. The processor 1010 and the memory 1020 can communicate via the system bus 1022. The memory 1020 includes a read only memory (ROM) or a flash memory (neither shown), and a random access memory (RAM), which generally refers to a main memory loaded with an operating system and an application.

Computer system 1000 also includes a display interface 1030 (eg, a graphics processing unit), a display device 1040 (eg, a liquid crystal display), an audio interface 1050 (eg, a sound card), and an audio device 1060 (eg, a speaker). Display device 1040 and audio device 1060 are media devices for experiencing multimedia content.

Computer system 1000 generally includes a storage device 1070. Storage device 1070 can be selected from a variety of computer readable storage media, which are any available media that can be accessed by computer system 1000, including both mobile and fixed media. For example, a computer readable storage medium includes, but is not limited to, a flash memory (micro SD card), a CD-ROM, a digital versatile disc (DVD) or other optical disc storage, a magnetic tape cartridge, a magnetic tape, a magnetic disk storage, or other magnetic storage device, or Any other medium that can be used to store the required information and be accessible by computer system 1000.

Computer system 1000 also includes an input device 1080 and an input interface 1090 (eg, an IO controller). The user can enter commands and information into computer system 1000 via input device 1080, such as a keyboard, mouse, touch panel device on display device 1040. Input device 1080 is typically coupled to system bus 1022 via input interface 1090, but may be coupled via other interfaces or bus structures, such as a universal serial bus (USB).

Computer system 1000 can be logically coupled to one or more network devices in a network environment. The network device can be a personal computer, server, router, smart phone, tablet or other public network node. The computer system 1000 is connected to the network device via a local area network (LAN) interface 1100 or a mobile communication unit 1110. A local area network (LAN) is a network of computers that are interconnected in a limited area, such as a home, school, computer lab, or office building that uses network media. WiFi and twisted pair cabling Ethernet are the two most commonly used technologies for building LANs. WiFi is a technology that enables computer systems 1000 to exchange data or connect to a wireless network via radio waves. The mobile communication unit 1110 can answer and make calls over a radio communication line while moving within a wide geographical area. In addition to the call, the mobile communication unit 1110 also supports Internet access in a 2G, 3G or 4G cellular communication system providing mobile data services.

It should be noted that other computer systems including more or less subsystems than computer system 1000 are also suitable for use in the invention. For example, computer system 1000 can include a Bluetooth unit that can exchange data over short distances, an image sensor for photography, and an accelerometer for measuring acceleration.

As described in detail above, computer system 1000 suitable for use in the present application is capable of performing the operations specified by the password hierarchy management method. Computer system 1000 performs these operations in the form of software instructions that processor 1010 runs in a computer readable storage medium. These software instructions can be read into memory 1020 from storage device 1070 or from another device via local area network interface 1100. The software instructions stored in the memory 1020 cause the processor 1010 to perform the password hierarchy management method described above. Furthermore, the present application can also be implemented by a hardware circuit or a hardware circuit in combination with a software instruction. Thus, implementation of the application is not limited to any specific combination of hardware circuitry and software.

The above-mentioned embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the claims. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims

A password hierarchical management method is used for hierarchical management of a primary password and a secondary password, wherein the primary password and the secondary password are two password types managed hierarchically, and one master password corresponds to one or more secondary passwords, and the method include:

Executed by the server:

Receiving a secondary password setting request of the current login account;

Verify whether the current login account is used to log in to the master password;

When the current login account is logged in, the master password is used, and the input secondary password and the password corresponding to the secondary password are received;

And storing a correspondence between the current login account, the secondary password, and the permission.
The password grading management method according to claim 1, wherein the method further comprises:

Receiving a login request, the login request including an account number and a password;

Verify the legality and type of the password;

If the password is legal, the corresponding permission is obtained according to the type of the password, and the corresponding function is provided according to the corresponding permission.
The password grading management method according to claim 2, wherein the step of obtaining the corresponding privilege according to the type of the password comprises:

If the password is a secondary password, query the permission corresponding to the password.
The cryptographic hierarchical management method according to claim 3, wherein after the step of receiving the input secondary password and the authority corresponding to the secondary password, the method further comprises:

Generating a permission parameter corresponding to the secondary password;

The step of storing the correspondence between the current login account, the secondary password, and the corresponding authority includes: storing a correspondence between the current login account, the secondary password, and the corresponding permission parameter, And storing a correspondence between the permission parameter and the corresponding authority;

The step of querying the rights corresponding to the password includes: obtaining a permission parameter corresponding to the password, and querying a permission corresponding to the permission parameter.
The password grading management method according to claim 1, wherein the method further comprises:

Receiving a request to modify the authority corresponding to the secondary password;

Verify whether the current login account is used to log in to the master password;

After the verification is passed, the input modified permission is received, and the correspondence between the secondary password and the modified authority is stored.
The password grading management method according to claim 1, wherein the method further comprises:

Receiving a request to modify the secondary password;

Verify the type of password used to log in to the current login account;

If the type of the password used is the primary password, the original password to be modified and the corresponding new secondary password are received, and the correspondence between the current login account, the original secondary password, and the corresponding authority is changed to the current login account. Correspondence between the new secondary password and the corresponding permissions.
The password grading management method according to claim 6, wherein after receiving the request for modifying the secondary password and verifying the type of the password used when the current login account is logged in, the method further includes:

If the type of the password used is a secondary password, the input new secondary password is received, and the correspondence between the original secondary password and the new secondary password used in the login is saved, and the current login account is re-registered with the primary password;

When the current login account is re-registered with the master password, the modification sub-password approval request is sent to the login client, where the approval request includes the original secondary password and the new secondary password;

Receiving the approval result sent by the login client;

Modifying the original secondary password according to the approval result or suspending the modification of the original secondary password.
The password grading management method according to claim 1, wherein the step of verifying whether the current login account is used to log in is a master password comprises:

Prompt for the master password;

Verify that the entered password is a valid master password, and if so, the verification is passed.
A password hierarchical management system, comprising:

A plurality of modules comprising computer executable instructions executed by a processor, the modules comprising:

a receiving module, configured to receive a secondary password setting request of the currently logged in account;

An authentication module, configured to verify whether the current login account is used to log in or not;

The receiving module is further configured to: after the verification is passed, receive the input secondary password and the permission corresponding to the secondary password;

Corresponding relationship storage module, configured to store a correspondence between the current login account, the secondary password, and the corresponding authority;

The master password and the secondary password are two password types of an account, and one master password corresponds to one or more secondary passwords.
The cryptographic hierarchical management system according to claim 9, wherein the receiving module is further configured to receive a login request, where the login request includes an account number and a password;

The identity verification module is further configured to verify the legality and type of the password;

The system further includes a function providing module, configured to obtain a corresponding permission according to the type of the password, and provide a corresponding function according to the corresponding permission, if the password is legal .
The password grading management system according to claim 10, wherein the process of obtaining, by the function providing module, the corresponding privilege according to the type of the password comprises: if the password is a secondary password, querying the corresponding password Permissions.
The password grading management system according to claim 11, wherein the system further comprises a privilege parameter generating module, configured to generate a privilege corresponding to the sub cipher after receiving the input sub cipher and the cipher corresponding to the sub cipher parameter;

The corresponding relationship storage module is configured to store a correspondence between the current login account, the secondary password, and the corresponding permission parameter, and store a correspondence between the permission parameter and the corresponding permission;

The process of the function providing module querying the permission corresponding to the password includes: obtaining a permission parameter corresponding to the password, and querying a permission corresponding to the permission parameter.
The cryptographic hierarchical management system according to claim 9, wherein the receiving module is further configured to receive a request for modifying a right corresponding to the secondary password;

The identity verification module is further configured to verify, after receiving the request for modifying the permission corresponding to the secondary password, whether the current login account is used to log in or not;

The receiving module is further configured to: after the verification is passed, receive the modified permission of the input;

The corresponding relationship storage module is further configured to store a correspondence between the secondary password and the modified authority.
The cryptographic hierarchical management system according to claim 9, wherein the receiving module is further configured to receive a request for modifying a secondary password;

The identity verification module is further configured to verify, after receiving the request for modifying the secondary password, the type of the password used when the current login account is logged in;

The receiving module is further configured to: if the type of the used password is a primary password, receive the input original secondary password to be modified and the corresponding new secondary password;

The corresponding relationship storage module is further configured to modify the correspondence between the current login account, the original secondary password, and the corresponding authority as a correspondence between the current login account, the new secondary password, and the corresponding authority.
The cryptographic hierarchical management system according to claim 14, wherein the receiving module is further configured to: if the type of the used password is a secondary password, receive the input new secondary password;

The corresponding relationship storage module is further configured to save a correspondence between the original secondary password and the new secondary password used in the login;

The system further includes a monitoring module and a sending module, wherein the monitoring module is configured to wait for the current login account to log in again with the master password;

The sending module is configured to send a modified secondary password approval request to the login client when the current login account is re-registered with the master password, where the approval request includes the original secondary password and the new secondary password;

The receiving module is further configured to receive an approval result sent by the login client;

The corresponding relationship module is further configured to modify the original secondary password according to the approval result or suspend the modification of the original secondary password.
The password grading management system according to claim 9, wherein the identity verification module is configured to prompt for a master password, and verify whether the input password is a legal master password, and if yes, determine that the verification is passed.
One or more computer readable storage media containing computer executable instructions for performing the cryptographic hierarchical management method of any of claims 1-8.