WO2016026382A1

WO2016026382A1 - Password setting method, apparatus and system

Info

Publication number: WO2016026382A1
Application number: PCT/CN2015/085914
Authority: WO
Inventors: 温涛
Original assignee: 阿里巴巴集团控股有限公司; 温涛
Priority date: 2014-08-19
Filing date: 2015-08-03
Publication date: 2016-02-25
Also published as: CN105450413A; CN105450413B

Abstract

Embodiments of the present application provide a password setting method, apparatus and system. The method comprises: receiving a password setting request in a first server, the setting request comprising a first user identifier and a first character string; generating a check request according to the first user identifier and the first character string; sending the check request to one or more second servers; receiving a check result obtained according to the check request and returned by the one or more second servers, the check result being a result obtained by checking whether the first character string is the same as a first password that corresponds to the first user identifier in the second server; and when the check result is that the first character string is different from the first password, setting the first character string as a second password of the first user identifier in the first server. The present application can enhance strength of passwords and improve security of personal information of users

Description

Method, device and system for setting password

Technical field

The present application relates to the technical field of information security, and in particular, to a method for setting a password, a device for setting a password, and a system for setting a password.

Background technique

With the development of the Internet, there are more and more platforms with different service functions, such as a platform for providing portals, a platform for providing instant messaging tools (an application), etc. These platforms are for people's lives and work. It's convenient.

The user usually registers the account on the platform and sets the corresponding password to ensure the security of the account. The user can log in to the website or application of the platform by using the account and password, and enjoy the services provided by the platform. For example, a user can use an account number and password to log in to a platform that provides instant messaging tools for instant messaging with friends.

Many times, in order to facilitate memory, users are often accustomed to using the same account and password on different platforms. This leads to the fact that once the user's account and password on a certain platform are obtained by criminals, the criminals can use the account number and password to log in to other platforms, stealing the user's personal information or the user's virtual property, real property, and even using the user's Personal information for illegal activities such as fraud. It can be seen that the use of the same account and password on different platforms is very dangerous, and the security of the user's account is very low.

Therefore, a technical problem that needs to be solved urgently by those skilled in the art is to propose a password setting mechanism to improve the strength of the password and improve the security of the user's personal information.

Summary of the invention

The technical problem to be solved by the embodiments of the present application is to provide a method for setting a password to improve the strength of the password and improve the security of the user's personal information.

Correspondingly, the embodiment of the present application further provides a password setting device and a password setting system to ensure implementation and application of the foregoing method.

In order to solve the above problem, the embodiment of the present application discloses a method for setting a password, including:

Receiving a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

Generating a verification request according to the first user identifier and the first character string;

Sending the verification request to one or more second servers;

Receiving, by the one or more second servers, a verification result obtained according to the verification request; the verification result is that the first character string and the first user identifier are verified in the first Whether the corresponding first password in the second server is the same;

When the verification result is that the first character string is different from the first password, the first character string is set as the second password of the first user identifier in the first server.

Preferably, the step of generating a verification request according to the first user identifier and the first character string comprises:

Performing a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

Performing a second encryption process on the first ciphertext to obtain a digital signature;

Encapsulating the first ciphertext and the digital signature into a verification request.

Preferably, the step of performing the first encryption process on the first user identifier and the first character string to obtain the first ciphertext comprises:

And encrypting the first user identifier and the first character string by using a target key corresponding to the one or more second servers to obtain a first ciphertext.

Preferably, the step of performing a second encryption process on the first ciphertext to obtain a digital signature includes:

The first ciphertext is encrypted with a specified private key to obtain a digital signature.

Preferably, the step of sending the verification request to one or more second servers comprises:

The verification request is sent to one or more second servers by a specified encrypted transmission.

Preferably, the one or more second servers obtain the verification result by:

Performing a validity check on the verification request; the validity check includes a time check and signature At least one of the checks;

When the verification request passes the validity check, verify whether the first character string is the same as the first password corresponding to the first user identifier in the second server;

When the first character string is the same as the first password, setting the same information of the first character string and the first password as a verification result;

When the first character string is different from the first password, the information that the first character string is different from the first password is set as a verification result.

Preferably, the verification request includes a first timestamp; the second server has a second timestamp; and the step of verifying validity of the verification request includes:

Calculating a difference between the first timestamp and the second timestamp;

When the difference is within a preset time threshold, it is determined that the verification request passes the time check.

Preferably, the step of verifying validity of the verification request comprises:

Performing a third encryption process on the first ciphertext to obtain a second character string;

When the second character string is the same as the digital signature, it is determined that the verification request is verified by a signature.

Preferably, the step of performing the third encryption process on the first ciphertext to obtain the second character string comprises:

The first ciphertext is encrypted by using a specified public key to obtain a second character string.

Preferably, the step of verifying whether the first character string is the same as the first password corresponding to the first user identifier in the second server comprises:

Decrypting the first ciphertext to obtain the first user identifier and the first character string;

Finding a second user identifier associated with the first user identifier; the second user identifier has an associated first password;

Verifying whether the first string is the same as the first password.

Preferably, the step of performing the second decryption process on the first ciphertext to obtain the first user identifier and the first character string comprises:

Decrypting the first ciphertext by using the target key to obtain the first user identifier and The first character string.

Preferably, the step of verifying whether the first string is the same as the first password comprises:

Encrypting the first character string by using a first feature key to obtain a second ciphertext;

Verifying whether the second ciphertext is the same as the third ciphertext; the third ciphertext is a ciphertext obtained by encrypting the first password by using the first feature key;

When the second ciphertext is the same as the third ciphertext, determining that the first character string is the same as the first password;

When the second ciphertext is different from the third ciphertext, it is determined that the first character string is different from the first ciphertext.

Preferably, the first character string meets at least one of the first condition and the second condition;

The first condition is that the first character string satisfies a preset strength condition;

The second condition is that the first character string is different from the first second password of the first user identifier in the first server.

Preferably, the method further includes:

When the verification result is that the first character string is the same as the first password, the prompt information for resetting the password is generated.

Preferably, the method further includes:

Encrypting the second password by using the second feature key to obtain a fourth ciphertext;

The fourth ciphertext is stored in a database.

The embodiment of the present application further discloses a method for setting a password, including:

Receiving, by the first server, a verification request sent by the first server; the verification request is, when the first server receives the setting request of the password, according to the first user identifier and the first in the setting request a verification request generated by a string;

Obtaining a verification result according to the verification request; the verification result is a result obtained by verifying whether the first character string and the first password corresponding to the first user identifier in the second server are the same ;

Returning the verification result to the first server; the first server is configured to: when the verification result is that the first character string is different from the first password, the first string is And setting a second password that is the first user identifier in the first server.

The embodiment of the present application further discloses a password setting apparatus, including:

a request receiving module, configured to receive a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

a verification request generating module, configured to generate a verification request according to the first user identifier and the first character string;

a verification request sending module, configured to send the verification request to one or more second servers;

a verification result receiving module, configured to receive a verification result obtained by the one or more second servers and obtained according to the verification request; the verification result is to verify the first character string and the Determining, by the first user, a result obtained by whether the corresponding first password in the second server is the same;

a password setting module, configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier on the first server The second password in .

Preferably, the setting request receiving module includes:

a first ciphertext obtaining submodule, configured to perform a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

a digital signature obtaining submodule, configured to perform a second encryption process on the first ciphertext to obtain a digital signature;

And a packaging submodule, configured to encapsulate the first ciphertext and the digital signature into a verification request.

Preferably, the first ciphertext obtaining submodule comprises:

And a symmetric ciphering module, configured to encrypt the first user identifier and the first character string by using a target key corresponding to the one or more second servers, to obtain a first ciphertext.

Preferably, the digital signature obtaining submodule comprises:

a first asymmetric cipher submodule, configured to add the first ciphertext by using a specified private key Secret, get a digital signature.

Preferably, the verification request sending module includes:

An encrypted transmission sub-module for transmitting the verification request to one or more second servers by a specified encrypted transmission mode.

Preferably, the device further includes:

The prompt information generating module generates, when the verification result is that the first character string is the same as the first password, generating prompt information for resetting the password.

Preferably, the device further includes:

a fourth ciphertext obtaining module, configured to encrypt the second password by using the second feature key to obtain a fourth ciphertext;

a storage module, configured to store the fourth ciphertext in a database.

a verification request receiving module, configured to receive, in the second server, a verification request sent by the first server; the verification request is, when the first server receives the setting request of the password, according to the setting request a first user identifier and a verification request generated by the first string;

a verification result obtaining module, configured to obtain a verification result according to the verification request; the verification result is a verification that the first character string and the first user identifier correspond to the second server The result of whether a password is the same;

a verification result returning module, configured to return the verification result to the first server; and when the first server is configured to use the verification result that the first character string is different from the first password, Setting the first character string as the second password of the first user identifier in the first server.

The embodiment of the present application further discloses a password setting system, including:

The system includes a first server and one or more second servers;

The first server includes:

a verification result receiving module, configured to receive a verification result obtained by the one or more second servers and obtained according to the verification request;

a password setting module, configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier on the first server The second password in ;

The one or more second servers include:

a verification request receiving module, configured to receive, in the second server, a verification request sent by the first server;

The verification result returns a module for returning the verification result to the first server.

Compared with the background art, the embodiments of the present application include the following advantages:

In the embodiment of the present application, the first server requests the one or more second servers to perform verification of the same password according to the first user identifier and the first password generation verification request in the password setting request, when the first server When receiving the verification result that the first character string is different from the first password corresponding to the first user identifier in the second server, setting the first character string as the second password of the first user identifier in the first server, In addition, it ensures that the same user does not set the same password in different servers, which increases the strength of the password and greatly reduces the user's account and password in a certain server. The impact of the time on the account and password in the current server, thereby improving the security of the user's personal information.

During the interaction between the first server and the second server, the second server does not need to know the second feature key of the first server, and the first server does not need the first feature key of the second server, the first server And the second server still maintains its own feature key, which ensures the privacy of the feature key.

The first server encrypts the first user identifier and the first character string by using a key to generate a first ciphertext, and after the first ciphertext is encapsulated into the verification request, sends the verification request to the second server by using an encrypted transmission manner. , ensuring the security of the first user identifier and the first character string during transmission.

In the embodiment of the present application, the first server may perform a first encryption process on the first user identifier and the first character string to generate a corresponding first ciphertext, and improve user information (ie, the first user identifier and the first character string). Security.

In the embodiment of the present application, the verification request may be sent by using an encrypted transmission manner, and the security of the user information is improved in one step.

The embodiment of the present application performs validity check on the verification request sent by the first server to ensure the security of the verification request, and at the same time, when determining that the verification request is invalid, the subsequent verification operation is not required, thereby reducing the system. s expenses.

DRAWINGS

1 is a flow chart showing the steps of Embodiment 1 of a method for setting a password of the present application;

2 is a flow chart showing the steps of Embodiment 2 of a method for setting a password according to the present application;

3 is a structural block diagram of Embodiment 1 of a password setting apparatus of the present application;

4 is a structural block diagram of Embodiment 2 of a password setting apparatus of the present application;

FIG. 5 is a structural block diagram of an embodiment of a password setting system of the present application.

detailed description

The above described objects, features and advantages of the present application will become more apparent and understood.

In the traditional password setting method, the user is on the platform through the client (for example, a browser). When setting a password, the platform usually checks the password strength of the string set by the user as a password. When the string passes the strength check, the string can be set as the password, and the platform uses its own unique key pair to the user. The set password is encrypted and stored in the database in cipher text to ensure the security of the password.

Although the strength check can increase the difficulty of “brute force cracking” (that is, using dictionary exhaustive) passwords, these requirements also increase the difficulty for users to remember passwords, and also increase users' use of the same password on multiple platforms. The possibility.

That is, in order to facilitate memory and management, many users are accustomed to setting the same account and password on different platforms. With the development of computers, there are more and more methods for cracking ciphertext to obtain plaintext. This leads to the fact that once a user's account and password on a certain platform are acquired by criminals, the criminals can be in a few minutes or hours. Crack the ciphertext and obtain the password in plain text. In turn, the user's account and password can be used to log in to other platforms, stealing the user's personal information or the user's virtual property, real property, or even using the user's personal information for fraud and other illegal activities.

The traditional password setting method can only be applied on a single platform, and it is not able to detect whether the user uses the same account and password on different platforms, and cannot avoid the user using the same account and password on different platforms. The problem, therefore, the above-mentioned platform-based password setting method has great hidden dangers and low security.

Therefore, one of the core concepts of the embodiments of the present application is proposed to verify the password of the user in different servers to prevent the same user from setting the same password between different servers.

Referring to FIG. 1 , a flow chart of the steps of Embodiment 1 of a password setting method of the present application is shown, which may specifically include the following steps:

Step 101: Receive a setting request of a password in the first server.

It should be noted that the server can control the computer that accesses the network or network resources (for example, a disk drive, a printer, etc.), and can provide resources for the computer on the network to operate like a workstation, and can usually be divided into Types such as file server, database server, and application server.

In a specific implementation, the password setting request may refer to a string sent by the user. An indication of a password. The user can trigger a password setting request on the client by setting or modifying at least one of the account password and the independent password, or other means.

The account password can be the password of the login user account, which can be set when registering a new user account, or can be modified after setting; the independent password can be used to protect the password of certain business objects after logging in the user account, for example, an independent password. The password can be viewed in the instant messaging tool, the password of the login email, or the password that can be confirmed for payment, or the password can be protected for the processing of the virtual item (such as transaction, destruction, etc.), etc. This example does not limit this.

The client sends a password setting request to the first server, and the setting request may include the first user identifier and the first character string.

The first user identifier may be information that can represent a user uniquely identified in the first server, and may include at least one of a user account and information bound to the user account; and the information bound to the user account may be Including at least one of the following:

Other user accounts, email addresses, phone numbers, names.

The first string can be a string that is set to be a password, and can be any string of any kind.

Of course, the triggering manner and content of the above-mentioned password setting request are only examples. When the embodiment of the present application is implemented, other triggering manners and contents may be set according to actual conditions, which is not limited by the embodiment of the present application. In addition, in addition to the foregoing triggering manners and contents, other triggering methods and contents may be used by those skilled in the art according to actual needs, and the embodiment of the present application does not limit this.

Step 102: Generate a verification request according to the first user identifier and the first character string.

In the embodiment of the present application, the verification request may refer to an indication sent by the first server whether there is a password equal to the first character string.

In a preferred embodiment of the present application, step 102 can include the following sub-steps:

Sub-step S11, performing a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

In a specific implementation, the first user identifier and the first string received by the first server are plaintext. In the embodiment of the present application, the first server may perform a first encryption process on the first user identifier and the first character string to generate a corresponding first ciphertext, and improve user information (ie, the first user identifier and the first String) security.

In a preferred example of the embodiment of the present application, the sub-step S11 may include the following sub-steps:

Sub-step S111, encrypting the first user identifier and the first character string by using a target key corresponding to the one or more second servers, to obtain a first ciphertext.

In this example, the first encryption process can be performed in a symmetric encryption manner. Among them, symmetric encryption can be an encryption method using a single-key cryptosystem, and the same key can be used as both information encryption and decryption.

In an actual application, the first server and the second server may pre-approve a key (ie, a target key) for encrypting and decrypting the first user identifier and the first character string, and each second server may have a corresponding target. Key.

The first server and the second server may also stipulate encryption and decryption algorithms, and specify how to perform encryption and decryption, such as DES (Data Encryption Standard) algorithm, IDEA (International Data Encryption Algorithm) algorithm, The AES (Advanced Encryption Standard) algorithm, and the like, the symmetry of the embodiment of the present application is not limited.

Of course, the embodiment of the present application may also perform the first encryption process by using other methods, such as asymmetric encryption, which is not limited in this embodiment of the present application.

Sub-step S12, performing a second encryption process on the first ciphertext to obtain a digital signature;

In this example, the second encryption process can be performed in an asymmetric encryption manner. Among them, asymmetric encryption can use encryption methods for cryptosystems with two different keys for encryption and decryption.

Generating a digital signature to the data or file (eg, the first ciphertext), the recipient (eg, the second server) can verify that the data or file (eg, the first ciphertext) is complete and accurate by verifying the digital signature, determining the data or The file (eg, the first ciphertext) is sent by the generating digital signing party (eg, the first server) instead of being forged by a third party, and the data or file (eg, the first ciphertext) has not been tampered with.

A set of digital signatures can usually include two complementary algorithms, one of which can be used for In digital signatures, another algorithm can be used to verify digital signatures.

In a preferred example of the embodiment of the present application, the sub-step S12 may include the following sub-steps:

Sub-step S121, encrypting the first ciphertext by using a specified private key to obtain a digital signature.

Asymmetric encryption uses not the same key for encryption and decryption. It usually requires two keys: a public key and a private key. The public key and the private key are a pair, the private key can be saved by the encrypting party (for example, the first server), and the public key can be disclosed to the decrypting party (for example, the second server).

In this example, if the first server encrypts the data with the private key, the second server can decrypt with the corresponding public key.

When the encrypting party (for example, the first server) encrypts the data using its own private key, it is equivalent to digitally signing the data, and the decrypting party (for example, the second server) decrypts the data with the public key, since the private key is the encryption party ( For example, the first server) all, if the decrypting party (for example, the second server) can decrypt normally, it can indicate that the data comes from the encrypting party (for example, the first server), ensuring that the data is not faked and not modified during the transmission. .

In an actual application, the first server and the second server may agree in advance to generate a digitally signed private key and a public key to decrypt the digital signature.

The first server and the second server can also agree on encryption and decryption algorithms, specifying how to encrypt and decrypt, for example, RSA algorithm (an asymmetric encryption algorithm, RSA is Ronald Ron Rivest, Adi Sa, respectively) Moore Adi Shamir, Leonard Adleman's initial letter), ElGamal algorithm (an encryption algorithm), knapsack algorithm, Rabin algorithm (special case of RSA algorithm), Diffie-Hellman key exchange The public key encryption algorithm, the Elliptic Curve Cryptography (ECC), and the like in the protocol are not limited in this embodiment of the present application.

Sub-step S13, the first ciphertext and the digital signature are encapsulated into a verification request.

In the embodiment of the present application, the first server and the second server agree on the protocol to be transmitted in advance, and the first server may encapsulate the first ciphertext and the digital signature into the verification request according to the transmitted protocol, and send the result to the second server.

It should be noted that, in some specific scenarios, the first encryption process and the second encryption process may not be performed, that is, the first user identifier and the first character string may be directly encapsulated without generating the first ciphertext and the digital signature. In the verification request, but the verification request needs to be private, for example, the second server only receives the verification request of the first server in the whitelist, which is not limited by the embodiment of the present application.

Step 103: Send the verification request to one or more second servers;

It should be noted that the first server and the second server may belong to different platforms, respectively, but may face the same user, and the user may register the account in the first server and the second server.

The second server may open a specified API (Application Programming Interface) interface, and the first server may invoke the specified API interface, and according to the parameter specification of the specified API interface, the URL corresponding to the API (Uniform) The Resource Locator sends a verification request to the second server, requesting the second server to verify whether the user has the same password as the first character string that needs to be set as the password.

In a preferred embodiment of the present application, step 103 may include the following sub-steps:

Sub-step S21, the verification request is sent to the second server by the specified encrypted transmission mode.

For example, the first server may send a verification request by using a Hyper-Transfer Protocol over Secure Socket Layer (HTTPS), and may also send a verification request by using another encryption transmission manner, which is not limited in this embodiment of the present application.

Of course, in some specific scenarios, the verification request may not be sent by means of encrypted transmission, but the transmission method needs to be secure.

Step 104: Receive, by the one or more second servers, a verification result obtained according to the verification request.

The verification result may be a result obtained by verifying whether the first character string and the first password corresponding to the first user identifier in the second server are the same;

In a specific implementation, the second server may verify the first string and the first according to the verification request. Is the password the same?

In a preferred embodiment of the present application, the second server can obtain the verification result by:

Sub-step S31, performing a validity check on the verification request; the validity check may include at least one of a time check and a signature check;

In the embodiment of the present application, if the second server determines that the verification request is valid, the first character string may be verified. If the second server determines that the verification request is invalid, the first character string may not be verified.

In a preferred embodiment of the present application, the verification request may include a first timestamp; the second server may have a second timestamp; and the sub-step S31 may include the following sub-steps:

Sub-step S311, calculating a difference between the first timestamp and the second timestamp;

Sub-step S312, when the difference is within a preset time threshold, it is determined that the verification request passes the time check.

In the embodiment of the present application, the second server may perform time verification on the verification request to ensure the consistency of the time between the first server and the second server.

A timestamp, usually a sequence of characters, that uniquely represents a moment in time. The first timestamp may represent the system time of the first server, and the second timestamp may represent the system time of the second server.

In a specific implementation, the first server may add the first timestamp to the URL and send it to the second server along with the verification request.

The first timestamp and the second timestamp may be used to verify the consistency of time between the first server and the second server, and the difference between the first timestamp and the second timestamp may allow the existence of a small error. For example, the first timestamp may be different from the second timestamp by a few minutes (ie, the time threshold), which is acceptable and may be considered to pass the time check.

The embodiment of the present application passes the first time stamp of the first server and the second time of the second server. The consistency of the time stamp improves the security of the second server API and improves the security of the password verification.

In a preferred embodiment of the present application, sub-step S31 may comprise the following sub-steps:

Sub-step S313, performing a third encryption process on the first ciphertext to obtain a second character string;

Sub-step S314, when the second character string is the same as the digital signature, it is determined that the verification request passes the signature verification.

In the embodiment of the present application, the second server may perform signature verification on the verification request to ensure the authenticity of the verification request.

In a specific implementation, the second server may perform the third encryption process by using asymmetric encryption corresponding to the sub-step S12.

If the second server verifies that the first ciphertext is complete and accurate by verifying the digital signature, it may be determined that the first ciphertext is sent by the generated first server instead of being forged by a third party, and the first ciphertext has not been tampered with.

In a preferred example of the embodiment of the present application, the sub-step S313 may include the following sub-steps:

Sub-step S3131, encrypting the first ciphertext by using the specified public key to obtain a second character string.

In a specific implementation, corresponding to sub-step S121, the second server may verify the digital signature using a public key agreed in advance.

The second server may encrypt the first ciphertext with the agreed public key to generate a second string.

It should be noted that, in one case, the embodiment of the present application may perform time verification on the verification request without performing signature verification on the verification request. When the verification request passes the time verification, it is determined that the verification request is passed. Validity check.

In another case, the embodiment of the present application may perform signature verification on the verification request, but does not perform time verification on the verification request. When the verification request passes the signature verification, it determines that the verification request passes the validity check. .

In another scenario, the embodiment of the present application may perform time check and signature verification on the verification request. When the verification request passes the time check and the signature check, it is determined that the verification request passes the validity check.

Certainly, the embodiment of the present application may perform time verification on the verification request and then perform signature verification on the verification request. If the time verification fails, and the verification request fails to pass the validity check, the verification is not required. Request to perform signature verification; you can also perform signature verification on the verification request before verifying the request. The time check is performed. If the verification request does not pass the signature check and it is determined that the verification request has not passed the validity check, the time verification of the verification request is not required.

Of course, the foregoing validity check is only an example. When the embodiment of the present application is implemented, other validity check may be set according to the actual situation, which is not limited by the embodiment of the present application. In addition, in addition to the above-mentioned validity check, other validity check can be used by those skilled in the art according to actual needs, and the embodiment of the present application does not limit this.

Sub-step S32, when the verification request passes the validity check, verify whether the first character string is the same as the first password corresponding to the first user identifier in the second server;

When the validity check of the verification request is passed, it may be indicated that the verification request is sent by the first server and has not been tampered with, and the second server may check whether the first character string is identical to the first password.

In a preferred embodiment of the present application, sub-step S32 may include the following sub-steps:

Sub-step S321, performing decryption processing on the first ciphertext to obtain the first user identifier and the first character string;

In a specific implementation, the second server may perform a decryption process on the first ciphertext to obtain the first user identifier and the first character string in a plaintext form, corresponding to the sub-step S11.

In a preferred example of the embodiment of the present application, the sub-step S321 may include the following sub-steps:

Sub-step S3211: decrypting the first ciphertext by using the target key to obtain the first user identifier and the first character string.

In this example, corresponding to sub-step S111, the second server may perform the second decryption process in a symmetric encryption manner.

In a specific implementation, the second server may decrypt using the previously agreed target key and the decrypted algorithm.

Of course, the embodiment of the present application may also perform decryption processing by using other methods, such as asymmetric encryption, which is not limited in this embodiment of the present application.

Sub-step S322, searching for a second user identifier associated with the first user identifier;

The second user identifier may be information capable of representing a user uniquely determined in the second server, and may include at least one of a user account and information bound to the user account; The information bound to the user account may include at least one of the following:

Other user accounts, email addresses, phone numbers, names.

In a specific implementation, when the first user identifier and the second user identifier are the same, similar, or mutually bound, the first user identifier and the second user identifier may be the same user.

For example, if the user account that is the first user identifier is abc, and the user account that is the second user identifier is abc or abc_001, the first user identifier and the second user identifier may be considered to be associated.

For example, if the user account that is the first user identifier and the user account that is the second user identifier are mutually bound accounts, the first user identifier and the second user identifier may be considered as being associated.

For example, if the mailbox as the first user identifier is abc@abc.com and the mailbox as the second user identifier is abc@abc.com, the first user identifier and the second user identifier may be considered as being associated.

It should be noted that, in this embodiment, a user identifier, two user identifiers, or even more user identifiers may be used for association determination to improve the accuracy of the first user identifier and the second user identifier association judgment.

The second user identifier has an associated first password, and the first password may include at least one of an account password and an independent password.

When the first string request is set to the account password, the account password corresponding to the second user identifier may be extracted for verification. Of course, the independent password corresponding to the second user identifier may be extracted for verification. No restrictions;

When the first string request is set to an independent password, the independent password corresponding to the second user identifier may be extracted for verification. Of course, the account password corresponding to the second user identifier may be extracted for verification. No restrictions.

Sub-step S323, verifying whether the first character string is the same as the first password.

In an actual application, if the first password is saved in plain text, it can be directly verified whether the first string is the same as the first password.

If the first password is stored in cipher text, the first password can be converted into a plaintext form. Check whether the first character string is the same as the first password in the plain text format. The first character string may be converted into the cipher text form, and the first character string in the cipher text format is the same as the first password. This example does not limit this.

In a preferred example of the embodiment of the present application, the sub-step S323 may include the following sub-steps:

Sub-step S3231: encrypting the first character string by using a first feature key to obtain a second ciphertext;

Sub-step S3232, verifying whether the second ciphertext is the same as the third ciphertext; the third ciphertext is a ciphertext obtained by encrypting the first password by using the first feature key;

Sub-step S3233, when the second ciphertext is the same as the third ciphertext, determining that the first character string is the same as the first password;

Sub-step S3234, when the second ciphertext is different from the third ciphertext, determining that the first character string is different from the first password.

In this example, the second server may have a dedicated encryption key (ie, a first feature key) for encrypting the password in the second website, storing the password in the form of ciphertext to ensure the second server Password security.

In a specific implementation, the second server may use the first feature key to encrypt the first string in the same encryption manner as the third ciphertext, and verify the first string in the cipher text form and the first in the cipher text form. Is the password the same?

Sub-step S33, when the first character string is the same as the first password, setting the same information of the first character string and the first password as a verification result;

Sub-step S34, when the first character string is different from the first password, the information that the first character string is different from the first password is set as a verification result.

In a specific implementation, when the first character string is the same as the first password, the generated verification result may include the same information of the first character string and the first password; when the first character string is different from the first password, the generated The verification result may include information that the first character string is different from the first password.

The second server verifies whether the first character string is the same as the first password, obtains a verification result, and returns the verification result to the first server.

Step 105: When the verification result is that the first character string is different from the first password, Setting the first character string as the second password of the first user identifier in the first server.

When the verification result is the information that the first character string is different from the first password, it may indicate that the first user identifier does not have the same password as the first character string in the second server, and the first server may use the first string. Set to the first password of the first user in the first server.

In a preferred embodiment of the present application, the first character string may meet at least one of the first condition and the second condition;

The first condition may be that the first character string satisfies a preset strength condition;

In a specific implementation, the first server may preset the strength condition of the password, enhance the security of the password, reduce the probability of “brute force cracking”, and allow the first string to be set when the first character string input by the user satisfies the strength condition. For the password.

For example, the first server may set the length of the first string, for example, the length of the first string may be set to be 8 bits or more, if the number of bits of the first string does not meet the length requirement (such as the first The string is 7 digits. The first server can prompt the user to input the first string that does not meet the strong requirements and needs to be re-entered.

The first server may also set the first character string input by the user to be combined by at least one of a number, a character, and an English letter (including capitalization), assuming that the first character string needs to be combined by a number and an English character, if the first The string consists of pure numbers or pure English letters. The first server can prompt the user to enter the first string that does not meet the strength requirements and needs to be re-entered.

Of course, the above-mentioned strength conditions are only examples. In the implementation of the embodiments of the present application, other strength conditions are set by the person skilled in the art according to actual needs, which is not limited by the embodiment of the present application.

The second condition may be that the first character string is different from the first second password of the first user identifier in the first server.

In the case that the password is not set for the first time, the first user identifier may have at least one password in the first server. In order to further enhance the security of the password, the leakage of the previous password is prevented from causing a security risk to the current password. The server can set the first character string that is input by the user when the password is set to be the same as the password that exists in the previous one, and can include the previous password or the password in a certain period of time.

If the first character string input by the user is the same as the pre-existing password, the first server may prompt the user that the first character string already exists and needs to be re-entered.

It should be noted that, in the embodiment of the present application, whether the first character string meets the first condition and the second condition may be determined at any time before the first character string is set as the password.

For example, it may be determined whether the first character string meets the first condition before the verification request is sent, and whether the first character string meets the second condition is determined after the verification result is obtained.

For another example, it may be determined whether the first character string meets the first condition and the second condition before transmitting the verification request.

For example, the determination of whether the first character string meets the first condition and the second condition may be performed after the verification result is obtained, and the like, which is not limited by the embodiment of the present application.

In the embodiment of the present application, the first server requests the one or more second servers to perform verification of the same password according to the first user identifier and the first password generation verification request in the password setting request, when the first server When receiving the verification result that the first character string is different from the first password corresponding to the first user identifier in the second server, setting the first character string as the second password of the first user identifier in the first server, In addition, it ensures that the same user does not set the same password in different servers, which increases the strength of the password, greatly reduces the impact of the account and password leaked by the user on the current server and the password on the current server. The security of the user's personal information.

In a preferred embodiment of the present application, the method may further include the following steps:

Step 106: When the verification result is that the first character string is the same as the first password, generate prompt information for resetting the password.

In the embodiment of the present application, when the verification result received by the first server is that the first character string is the same as the first password, the password may be the same as the first character string in the second server, and the first server may generate Prompt the user to reset the password information, prompting the user to reset the password code.

Step 107: Encrypt the second password by using the second feature key to obtain a fourth ciphertext;

Step 108: Store the fourth ciphertext in a database.

In the embodiment of the present application, the first server may have a specific encryption key (ie, a second feature key), and the first server may encrypt the second password by using the second feature key to generate a fourth ciphertext. The second password is stored in the database in the form of ciphertext, which ensures the security of the password.

Referring to FIG. 2, a flow chart of the steps of Embodiment 2 of the method for setting a password of the present application is shown. Specifically, the method may include the following steps:

Step 201: Receive a verification request sent by the first server in the second server. The verification request is a first user identifier in the setting request when the first server receives the setting request of the password. And a verification request generated by the first string;

In a preferred embodiment of the present application, the setting request may include a first user identifier and a first character string; then the first server may generate a verification request by the following steps:

Sub-step S41, performing a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

In a preferred embodiment of the present application, sub-step S41 may comprise the following sub-steps:

Sub-step S411, encrypting the first user identifier and the first character string by using a target key corresponding to the one or more second servers, to obtain a first ciphertext.

Sub-step S42, performing a second encryption process on the first ciphertext to obtain a digital signature;

In a preferred embodiment of the present application, sub-step S42 may include the following sub-steps:

Sub-step S421, encrypting the first ciphertext with a specified private key to obtain a digital signature.

Sub-step S43, the first ciphertext and the digital signature are encapsulated into a verification request.

In a preferred embodiment of the present application, the verification request is sent by the first server by a specified encrypted transmission mode.

Step 202: Obtain a verification result according to the verification request.

In a preferred embodiment of the present application, step 202 can include the following sub-steps:

Sub-step S51, performing a validity check on the verification request; the validity check may include at least one of a time check and a signature check;

In a preferred embodiment of the present application, the verification request may include a first timestamp; the second server may have a second timestamp; and the sub-step S51 may include the following sub-steps:

Sub-step S511, calculating a difference between the first timestamp and the second timestamp;

Sub-step S512, when the difference is within a preset time threshold, determining that the verification request passes the time check.

In a preferred embodiment of the present application, sub-step S51 may comprise the following sub-steps:

Sub-step S513, performing a third encryption process on the first ciphertext to obtain a second character string;

Sub-step S514, when the second character string is the same as the digital signature, it is determined that the verification request passes the signature verification.

In a preferred embodiment of the present application, sub-step S513 may include the following sub-steps:

Sub-step S5131, encrypting the first ciphertext by using a specified public key to obtain a second character string.

Sub-step S52, when the verification request passes the validity check, verify whether the first character string is the same as the first password corresponding to the first user identifier in the second server;

In a preferred embodiment of the present application, sub-step S52 may include the following sub-steps:

Sub-step S521, performing decryption processing on the first ciphertext to obtain the first user identifier and the first character string;

In a preferred embodiment of the present application, sub-step S521 may include the following sub-steps:

Sub-step S5211, decrypting the first ciphertext by using the target key to obtain the first user identifier and the first character string.

Sub-step S522, searching for a second user identifier associated with the first user identifier; the second user identifier has an associated first password;

Sub-step S523, verifying whether the first character string is the same as the first password.

In a preferred embodiment of the present application, sub-step S53 may comprise the following sub-steps:

Sub-step S531, encrypting the first character string by using a first feature key to obtain a second ciphertext;

Sub-step S532, verifying whether the second ciphertext and the third ciphertext are the same; the third ciphertext is a ciphertext obtained by encrypting the first password by using the first feature key;

Sub-step S533, when the second ciphertext is the same as the third ciphertext, determining that the first character string is the same as the first password;

Sub-step S534, when the second ciphertext is different from the third ciphertext, determining that the first character string is different from the first password.

Sub-step S53, when the first character string is the same as the first password, setting the same information of the first character string and the first password as a verification result;

Sub-step S54, when the first character string is different from the first password, the information that the first character string is different from the first password is set as a verification result.

Step 203: Return the verification result to the first server.

In a specific implementation, the first server may be configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user Identifying a second password in the first server.

In a preferred embodiment of the present application, the first server is further configured to generate prompt information for resetting the password when the verification result is that the first character string is the same as the first password.

In a preferred embodiment of the present application, the first server is further configured to encrypt the second password by using the second feature key to obtain a fourth ciphertext; storing the fourth ciphertext In the database.

In the embodiment of the present application, the application is substantially similar to the application of the method embodiment 1, and the description is relatively simple. For the related part, refer to the description of the method embodiment 1. The embodiment of the present application is not described in detail herein.

In order to enable those skilled in the art to better understand the embodiments of the present application, the following description is by way of specific examples.

The user name of the user in the first server is SkyWen (first user ID), the original password is cba321, and now requests to set abc123 (the first string) to the corresponding password, the first server can request the second server to perform Password verification.

The first server receives the SkyWen and abc123 input by the user, and the first server may encrypt the SkyWen and the abc123 by using the key UJHUSHUY (target key) agreed with the second server in advance, and the encrypted user name SkyWen is AAB76115CB4379D0 (first Ciphertext), the encrypted string abc123 is D559B76EEE41C613 (first ciphertext).

The first server may pre-arrange with the second server to produce a digitally signed private key RSA private key (specified private key) and a digitally verified public key RSA public key (designated public key).

The agreed RSA private key is as follows:

<RSAKeyValue> <Modulus> 14WXrrULUY / x1CilapBr1l5CQIjG8IxFAP7upJPIPsObgeO8YhzGApYh + 7U6qXvYbkvu6C901NSOwRMWpjKcpMx4 / ZwdX4jDlgaV6uD6JtNUNzpHtYcrZ60SJgnKtD9vIoQKo75P1C8 / OBm1FA / Ei6mTWfuydHwNYDoPh0aW1E0 = </ Modulus> <Exponent> AQAB </ Exponent> <P> 9tHYz / hssi0jFuNUQQdqCytp8JBiJsT2nnmWaiQh5fKpIxRP2h6YNuuWqnVQR53NLrJhv6vwE45SaCL8J7CC / w == </ P> <Q> 34m8ROF4PtXkpkpazxYIpOLPixWuMm + rWVW6XzOb / wA5McFnsUNNqY091uaxs5gd / bnJQXr4rkzT1Kw1 / iDEsw == </ Q> <DP> ZuuaPR6aNLIdr62btIIi9gVkZ6vNQd1f + TU6Q4hNmlVVsgsGQS4AyuXyLaI9l591r8Myf3py4bS3KDVucB5qgQ == </ DP> <DQ> BFsNtRXjnu3SB795J4HZZ0UYIDCq9Uahwxrdh89cocpiUure12BlWgFrjA1wtvwm0XPWTRVVVSggFIvKfYor6w == </ DQ> <InverseQ> FhUOB x2YvqX18lsF4t8ox6QX7nMfd4cV4Fd7p1BLheyVbABaTbHllhwRVpArM5qeZmRqsN3iX15DS1FEEpDamw == </ InverseQ> <D> bbj4qRxIv + RttJpg5KjUDdX9GsfHqG1xL / mZ2zXVi4agY / diT / zgHi767B + u1txTKowD / Dc03qm8Z7VlIYXA0wJDpJTAmOgrQwVCSLmjsx4GIxHrT6Hf8XW / qbvfC2azvSWLZvjiwyFdxRSpvBe1KSWuTi + F3cQUkAtLtksx580 = </ D> </ RSAKeyValue>

The agreed RSA public key is as follows:

<RSAKeyValue> <Modulus> 14WXrrULUY / x1CilapBr1l5CQIjG8IxFAP7upJPIPsObgeO8YhzGApYh + 7U6qXvYbkvu6C901NSOwRMWpjKcpMx4 / ZwdX4jDlgaV6uD6JtNUNzpHtYcrZ60SJgnKtD9vIoQKo75P1C8 / OBm1FA / Ei6mTWfuydHwNYDoPh0aW1E0 = </ Modulus> <Exponent> AQAB </ Exponent> </ RSAKeyValue>

The first server can use the RSA private key to re-encrypt the AAB76115CB4379D0 and D559B76EEE41C613 to generate a digital signature. The generated digital signature is as follows:

B866CC139585766D95E0BD75B53EF3E4A81CF4509D7066A2D62FDD03F8BA21AF6062C0B734C4FBBA5787496B3F4A63FBAD08C640F919DA71F30CC53C93B859C32D4DB81AE714717DDF9564E4D5DD25868B48ACC0748E15F2BB562411B419C6032D11050C1C47669606A65413885CB0A1C41422B9B045A29CF22B02CDB10A4C98

The first server may encapsulate the encrypted username, the encrypted first string, and the digital signature to generate a verification request.

When the first server sends a verification request to the second server, the time stamp 1407394800082 when the verification request is sent may be added to the URL to be encapsulated into the verification request.

The first server may send the verification request to the second server through the HTTPS protocol, where the generated URL is as follows:

Https://xxxx.com/xxx.do? Sign=B866CC139585766D95E0BD75B53EF3E4A81CF4509D7066A2D62FDD03F8BA21AF6062C0B734C4FBBA5787496B3F4A63FBAD08C640F919DA71F30CC53C93B859C32D4DB81AE7147 17DDF9564E4D5DD25868B48ACC0748E15F2BB562411B419C6032D11050C1C47669606A65413885CB0A1C41422B9B045A29CF22B02CDB10A4C98&user_name=AAB76115CB4379D0&user_pass=D559B76EEE41C613&request_time=1407394800082

When the second server receives the verification request sent by the first server, the timestamp A of the local system may be obtained by using the System.currentTimeMillis() method, and the timestamp A indicates the time when the second server receives the verification request.

The second server may preset a time threshold, such as a set time threshold of 30 s.

Then, when A-1407394800082<30, it indicates that the verification request passes the time check.

After the time check is passed, the AAB76115CB4379D0 and D559B76EEE41C613 are encrypted with the RSA public key, and the generated string is as follows:

The second server compares the digital signature generated by using the RSA private key with the character string generated by using the RSA public key, and can indicate that the verification request is actually sent by the first server and has not been tampered with.

The second server can decrypt the AAB76115CB4379D0 and D559B76EEE41C613 by using the key UJHUSHUY to obtain the username SkyWen and the string abc1213.

The second server detects whether there is a user name consistent with SkyWen in the database, and if not, returns a result that the first server server does not have the user name SkyWen, and the first server server can set abc123 to the password corresponding to the user name SkyWen, and The abc123 is encrypted by using the unique key of the first server to generate a ciphertext, and the ciphertext is stored in the database.

If the second server detects that the user name SkyWen exists in the database, the abc123 can be encrypted by using the second server unique key LJHJGUUG, and the encrypted abc123 and the number According to the password of SkyWen in the library, if the passwords of the encrypted abc123 and SkyWen are the same, and the first server has returned the same password on the second server, the first server prompts the user to reset the password.

If the encrypted abc123 and SkyWen passwords are different, the result that the first server does not have the same password on the second server is returned.

If the first server sets the length of the character string set to the password to be 6 bits or more, and includes at least one English letter and one number, abc123 meets the strength requirement.

If the first server sets the string set to the password to be different from the previous password, and abc123 is not the same as cba321, the requirement is met.

The first server may set abc123 as the password corresponding to the user name SkyWen, and encrypt the abc123 by using the unique key of the first server to generate the ciphertext, and store the ciphertext in the database.

It should be noted that, for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the embodiments of the present application are not limited by the described action sequence, because In accordance with embodiments of the present application, certain steps may be performed in other sequences or concurrently. In the following, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required in the embodiments of the present application.

Referring to FIG. 3, it is a structural block diagram of Embodiment 1 of a device for setting a password of the present application, which may specifically include the following modules:

a setting request receiving module 301, configured to receive a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

The verification request generating module 302 is configured to generate a verification request according to the first user identifier and the first character string;

a verification request sending module 303, configured to send the verification request to one or more second servers;

a verification result receiving module 304, configured to receive, returned by the one or more second servers, a verification result obtained according to the verification request; the verification result is obtained by verifying whether the first character string is the same as the first password corresponding to the first user identifier in the second server result;

The password setting module 305 is configured to: when the verification result is that the first character string is different from the first password, set the first character string to be the first user identifier at the first The second password in the server.

In a preferred embodiment of the present application, the verification request generating module 302 may include the following sub-modules:

In a preferred embodiment of the present application, the first ciphertext obtaining module may include the following submodules:

In a preferred embodiment of the present application, the digital signature obtaining module may include the following submodules:

The first asymmetric cipher module is configured to encrypt the first ciphertext by using a specified private key to obtain a digital signature.

In a preferred embodiment of the present application, the verification request sending module may include the following submodules:

In a preferred embodiment of the present application, the one or more second servers may obtain the verification result by:

Performing a validity check on the verification request; the validity check may include at least one of a time check and a signature check;

In a preferred embodiment of the present application, the verification request may include a first timestamp; the second server may have a second timestamp; the one or more second servers may Check the verification request for validity check:

Calculating a difference between the first timestamp and the second timestamp;

In a preferred embodiment of the present application, the one or more second servers may perform validity verification on the verification request in the following manner:

In a preferred embodiment of the present application, the one or more second servers may obtain the second string by:

In a preferred embodiment of the present application, the one or more second servers may verify that the first character string and the first user identifier correspond to a first one in the second server by: Is the password the same:

Verifying whether the first string is the same as the first password.

In a preferred embodiment of the present application, the one or more second servers may perform decryption processing on the first ciphertext to obtain the first user identifier and the first word. String:

In a preferred embodiment of the present application, the one or more second servers may verify whether the first string is the same as the first password by:

In a preferred embodiment of the present application, the device may further include:

a storage module, configured to store the fourth ciphertext in a database.

Referring to FIG. 4, a structural block diagram of Embodiment 2 of a device for setting a password of the present application is shown, which may specifically include the following modules:

a verification request receiving module 401, a verification request receiving module, configured to receive in the second server a verification request sent by the first server; the verification request is a check generated by the first server according to the first user identifier and the first character string in the setting request when the first server receives the setting request of the password request;

a verification result obtaining module 402, the verification result obtaining module, configured to obtain a verification result according to the verification request; the verification result is to verify that the first character string and the first user identifier are in the Whether the corresponding first password in the second server is the same;

a verification result returning module 403, configured to return the verification result to the first server;

In a specific implementation, the first server may be configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier. a second password in the first server.

In a preferred embodiment of the present application, the setting request may include a first user identifier and a first character string; then the first server may generate a verification request by:

In a preferred embodiment of the present application, the verification request can be sent by:

In a preferred embodiment of the present application, the first server may obtain the first ciphertext by:

In a preferred embodiment of the present application, the first server can obtain a digital signature by:

In a preferred embodiment of the present application, the first server may send a verification request in the following manner:

In a preferred embodiment of the present application, the verification result obtaining module 402 may include the following sub-modules:

a validity check submodule, configured to perform a validity check on the check request; the validity check includes at least one of a time check and a signature check;

a first verification submodule, configured to: when the verification request passes the validity check, verify that the first character string and the first user identifier correspond to a first one in the second server Whether the passwords are the same;

a first verification result setting submodule, configured to set, when the first character string is the same as the first password, information that is the same as the first password as a verification result;

a second verification result setting submodule, configured to set, when the first character string is different from the first password, information that is different from the first password as a verification result .

In a preferred embodiment of the present application, the verification request may include a first timestamp; the second server may have a second timestamp; the validity verification sub-module may include the following sub-modules:

a timestamp difference calculation submodule, configured to calculate a difference between the first timestamp and the second timestamp;

The first determining submodule is configured to determine that the verification request passes the time check when the difference is within a preset time threshold.

In a preferred embodiment of the present application, the validity check submodule may include the following submodules:

a second string obtaining submodule, configured to perform a third encryption process on the first ciphertext to obtain a second character string;

The second determining submodule is configured to determine that the verification request passes the signature verification when the second character string is the same as the digital signature.

In a preferred embodiment of the present application, the second string obtaining submodule may include the following submodules:

a second asymmetric cipher submodule, configured to add the first ciphertext by using a specified public key Secret, get the second string.

In a preferred embodiment of the present application, the first verification module may include the following submodules:

a first ciphertext encryption submodule, configured to perform decryption processing on the first ciphertext to obtain the first user identifier and the first character string;

a searching submodule, configured to search for a second user identifier associated with the first user identifier; the second user identifier has an associated first password;

The second parity module is configured to check whether the first string is the same as the first password.

In a preferred embodiment of the present application, the first ciphertext encryption submodule may include the following submodules:

And a symmetric decryption sub-module, configured to decrypt the first ciphertext by using the target key, to obtain the first user identifier and the first character string.

In a preferred embodiment of the present application, the second verification module may include the following submodules:

a second ciphertext obtaining submodule, configured to encrypt the first character string by using a first feature key to obtain a second ciphertext;

a third parity module, configured to check whether the second ciphertext and the third ciphertext are the same; the third ciphertext is obtained by encrypting the first password by using the first feature key Cipher text

a third determining sub-module, configured to determine that the first character string is the same as the first password when the second ciphertext is the same as the third ciphertext;

The fourth determining sub-module is configured to determine that the first character string is different from the first password when the second ciphertext is different from the third ciphertext.

In a preferred embodiment of the present application, the first character string meets at least one of the first condition and the second condition;

In a preferred embodiment of the present application, the first server may be generated by the following manner Tips for resetting the password:

In a preferred embodiment of the present application, the first server may store the fourth ciphertext in a database by:

The fourth ciphertext is stored in a database.

Referring to FIG. 5, a block diagram of a system embodiment of a password setting according to the present application is shown, which includes a first server 510 and a second server 520;

The first server 510 may include:

a setting request receiving module 511, configured to receive a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

a verification request generating module 512, configured to generate a verification request according to the first user identifier and the first character string;

a verification request sending module 513, configured to send the verification request to one or more second servers;

The verification result receiving module 514 is configured to receive a verification result obtained by the one or more second servers and obtained according to the verification request;

The password setting module 515 is configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier in the first The second password in the server;

The one or more second servers 520 can include:

a verification request receiving module 521, configured to receive, in the second server, a verification request sent by the first server; the verification request is, when the first server receives the setting request of the password, according to the setting request a first user identifier and a verification request generated by the first string;

a verification result obtaining module 522, configured to obtain a verification result according to the verification request; the verification result is to verify that the first character string and the first user identifier correspond to the second server Whether the first password is the same as obtained; the verification result includes the first string and The first passwords are different;

a verification result returning module 523, configured to return the verification result to the first server; the first server is configured to set the first character string as the first user identifier on the first server The second password in .

In a preferred embodiment of the present application, the verification request generating module 512 may include the following sub-modules:

In a preferred embodiment of the present application, the first ciphertext obtaining submodule may include the following submodules:

In a preferred embodiment of the present application, the digital signature obtaining submodule may include the following submodules:

In a preferred embodiment of the present application, the verification request sending module 513 may include the following sub-modules:

In a preferred embodiment of the present application, the first server 510 may further include:

a storage module, configured to store the fourth ciphertext in a database.

In a preferred embodiment of the present application, the verification result obtaining module 522 may include the following sub-modules:

a second determining submodule, configured to determine when the second string is the same as the digital signature The verification request is verified by signature.

The second asymmetric cipher module is configured to encrypt the first ciphertext by using a specified public key to obtain a second string.

For the device and the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments can be referred to each other.

Those skilled in the art will appreciate that embodiments of the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

In a typical configuration, the computer device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory. The memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory. Memory is an example of a computer readable medium. Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include non-persistent computer readable media, such as modulated data signals and carrier waves.

Embodiments of the present application are described with reference to flowcharts and/or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It will be understood that each of the flows and/or blocks, and the flowcharts and/or A combination of processes and/or blocks in the figures. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing terminal device to produce a machine such that instructions are executed by a processor of a computer or other programmable data processing terminal device Means are provided for implementing the functions specified in one or more of the flow or in one or more blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The instruction device implements the functions specified in one or more blocks of the flowchart or in a flow or block of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device such that a series of operational steps are performed on the computer or other programmable terminal device to produce computer-implemented processing, such that the computer or other programmable terminal device The instructions executed above provide steps for implementing the functions specified in one or more blocks of the flowchart or in a block or blocks of the flowchart.

While a preferred embodiment of the embodiments of the present application has been described, those skilled in the art can make further changes and modifications to the embodiments once they are aware of the basic inventive concept. Therefore, the appended claims are intended to be interpreted as including all the modifications and the modifications

Finally, it should also be noted that in this context, relational terms such as first and second are used merely to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities. There is any such actual relationship or order between operations. Furthermore, the terms "comprises" or "comprising" or "comprising" or any other variations are intended to encompass a non-exclusive inclusion, such that a process, method, article, or terminal device that includes a plurality of elements includes not only those elements but also Other elements that are included, or include elements inherent to such a process, method, article, or terminal device. An element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that comprises the element, without further limitation.

The above describes a method for setting a password, a device for setting a password, and a system for setting a password. The principle and implementation of the present application are described in the following. The description of the above embodiments is only for helping to understand the method of the present application and its core ideas; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in specific embodiments and application scopes. In summary, the content of this specification should not be construed as limiting the application.

Claims

A method for setting a password, comprising:

Receiving a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

Generating a verification request according to the first user identifier and the first character string;

Sending the verification request to one or more second servers;

Receiving, by the one or more second servers, a verification result obtained according to the verification request; the verification result is that the first character string and the first user identifier are verified in the first Whether the corresponding first password in the second server is the same;

When the verification result is that the first character string is different from the first password, the first character string is set as the second password of the first user identifier in the first server.
The method according to claim 1, wherein the step of generating a verification request according to the first user identifier and the first character string comprises:

Performing a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

Performing a second encryption process on the first ciphertext to obtain a digital signature;

Encapsulating the first ciphertext and the digital signature into a verification request.
The method according to claim 2, wherein the step of performing the first encryption process on the first user identifier and the first character string to obtain the first ciphertext comprises:

And encrypting the first user identifier and the first character string by using a target key corresponding to the one or more second servers to obtain a first ciphertext.
The method according to claim 3, wherein the step of performing a second encryption process on the first ciphertext to obtain a digital signature comprises:

The first ciphertext is encrypted with a specified private key to obtain a digital signature.
The method of claim 1, wherein the step of transmitting the verification request to one or more second servers comprises:

Sending the verification request to one or more second services by a specified encrypted transmission method Device.
The method according to claim 1 or 2 or 3 or 4 or 5, wherein the one or more second servers obtain the verification result by:

Performing a validity check on the verification request; the validity check includes at least one of a time check and a signature check;

When the verification request passes the validity check, verify whether the first character string is the same as the first password corresponding to the first user identifier in the second server;

When the first character string is the same as the first password, setting the same information of the first character string and the first password as a verification result;

When the first character string is different from the first password, the information that the first character string is different from the first password is set as a verification result.
The method according to claim 6, wherein the verification request comprises a first timestamp; the second server has a second timestamp; and the step of verifying validity of the verification request include:

Calculating a difference between the first timestamp and the second timestamp;

When the difference is within a preset time threshold, it is determined that the verification request passes the time check.
The method according to claim 6, wherein the step of verifying the validity of the verification request comprises:

Performing a third encryption process on the first ciphertext to obtain a second character string;

When the second character string is the same as the digital signature, it is determined that the verification request is verified by a signature.
The method according to claim 8, wherein the step of performing the third encryption process on the first ciphertext to obtain the second character string comprises:

The first ciphertext is encrypted by using a specified public key to obtain a second character string.
The method according to claim 6, wherein the step of verifying whether the first character string is identical to the first password corresponding to the first user identifier in the second server comprises:

Decrypting the first ciphertext to obtain the first user identifier and the first character string;

Finding a second user identifier associated with the first user identifier; the second user identifier has an associated first password;

Verifying whether the first string is the same as the first password.
The method according to claim 10, wherein the step of performing the second decryption process on the first ciphertext to obtain the first user identifier and the first character string comprises:

Decrypting the first ciphertext by using the target key to obtain the first user identifier and the first character string.
The method according to claim 10, wherein the step of verifying whether the first character string is identical to the first password comprises:

Encrypting the first character string by using a first feature key to obtain a second ciphertext;

Verifying whether the second ciphertext is the same as the third ciphertext; the third ciphertext is a ciphertext obtained by encrypting the first password by using the first feature key;

When the second ciphertext is the same as the third ciphertext, determining that the first character string is the same as the first password;

When the second ciphertext is different from the third ciphertext, it is determined that the first character string is different from the first ciphertext.
The method according to claim 1 or 2 or 3 or 4 or 5 or 7 or 8 or 9 or 10 or 11 or 12, wherein said first character string conforms to at least one of a first condition and a second condition a condition

The first condition is that the first character string satisfies a preset strength condition;

The second condition is that the first character string is different from the first second password of the first user identifier in the first server.
The method of claim 1 or 2 or 3 or 4 or 5 or 7 or 8 or 9 or 10 or 11 or 12, further comprising:

When the verification result is that the first character string is the same as the first password, the prompt information for resetting the password is generated.
According to claim 1 or 2 or 3 or 4 or 5 or 7 or 8 or 9 or 10 or 11 or 12 The method is characterized in that the method further includes:

Encrypting the second password by using the second feature key to obtain a fourth ciphertext;

The fourth ciphertext is stored in a database.
A method for setting a password, comprising:

Receiving, by the first server, a verification request sent by the first server; the verification request is, when the first server receives the setting request of the password, according to the first user identifier and the first in the setting request a verification request generated by a string;

Obtaining a verification result according to the verification request; the verification result is a result obtained by verifying whether the first character string and the first password corresponding to the first user identifier in the second server are the same ;

Returning the verification result to the first server; the first server is configured to: when the verification result is that the first character string is different from the first password, the first string is And setting a second password that is the first user identifier in the first server.
A device for setting a password, comprising:

a request receiving module, configured to receive a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

a verification request generating module, configured to generate a verification request according to the first user identifier and the first character string;

a verification request sending module, configured to send the verification request to one or more second servers;

a verification result receiving module, configured to receive a verification result obtained by the one or more second servers and obtained according to the verification request; the verification result is to verify the first character string and the Determining, by the first user, a result obtained by whether the corresponding first password in the second server is the same;

a password setting module, configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier on the first server The second password in .
The device according to claim 17, wherein the setting request receiving module comprises:

a first ciphertext obtaining submodule, configured to perform a first encryption process on the first user identifier and the first character string to obtain a first ciphertext;

a digital signature obtaining submodule, configured to perform a second encryption process on the first ciphertext to obtain a digital signature;

And a packaging submodule, configured to encapsulate the first ciphertext and the digital signature into a verification request.
The apparatus according to claim 18, wherein the first ciphertext obtaining submodule comprises:

And a symmetric ciphering module, configured to encrypt the first user identifier and the first character string by using a target key corresponding to the one or more second servers, to obtain a first ciphertext.
The apparatus according to claim 18, wherein the digital signature obtaining submodule comprises:

The first asymmetric cipher module is configured to encrypt the first ciphertext by using a specified private key to obtain a digital signature.
The apparatus according to claim 17, wherein the verification request generation module comprises:

An encrypted transmission sub-module for transmitting the verification request to one or more second servers by a specified encrypted transmission mode.
The apparatus according to claim 17 or 18 or 19 or 20 or 21, wherein said first character string conforms to at least one of a first condition and a second condition;

The first condition is that the first character string satisfies a preset strength condition;

The second condition is that the first character string is different from the first second password of the first user identifier in the first server.
The device according to claim 17 or 18 or 19 or 20 or 21, further comprising:

The prompt information generating module generates, when the verification result is that the first character string is the same as the first password, generating prompt information for resetting the password.
Device according to claim 17 or 18 or 19 or 20 or 21, characterized in that Also includes:

a fourth ciphertext obtaining module, configured to encrypt the second password by using the second feature key to obtain a fourth ciphertext;

a storage module, configured to store the fourth ciphertext in a database.
A device for setting a password, comprising:

a verification request receiving module, configured to receive, in the second server, a verification request sent by the first server; the verification request is, when the first server receives the setting request of the password, according to the setting request a first user identifier and a verification request generated by the first string;

a verification result obtaining module, configured to obtain a verification result according to the verification request; the verification result is a verification that the first character string and the first user identifier correspond to the second server The result of whether a password is the same;

a verification result returning module, configured to return the verification result to the first server; and when the first server is configured to use the verification result that the first character string is different from the first password, Setting the first character string as the second password of the first user identifier in the first server.
A password setting system, characterized in that the system comprises a first server and one or more second servers;

The first server includes:

a request receiving module, configured to receive a setting request of a password in the first server; the setting request includes a first user identifier and a first character string;

a verification request generating module, configured to generate a verification request according to the first user identifier and the first character string;

a verification request sending module, configured to send the verification request to one or more second servers;

a verification result receiving module, configured to receive a verification result obtained by the one or more second servers and obtained according to the verification request;

a password setting module, configured to: when the verification result is that the first character string is different from the first password, set the first character string as the first user identifier on the first server middle Second password;

The one or more second servers include:

a verification request receiving module, configured to receive, in the second server, a verification request sent by the first server;

a verification result obtaining module, configured to obtain a verification result according to the verification request; the verification result is a verification that the first character string and the first user identifier correspond to the second server The result of whether a password is the same;

The verification result returns a module for returning the verification result to the first server.