WO2019184074A1

WO2019184074A1 - Password verification method and system

Info

Publication number: WO2019184074A1
Application number: PCT/CN2018/088413
Authority: WO
Inventors: 易胜燕
Original assignee: 易胜燕
Priority date: 2018-03-27
Filing date: 2018-05-25
Publication date: 2019-10-03
Also published as: CN108429758A

Abstract

Provided are a password verification method and system, particularly a password verification method and system capable of realizing any one of or multiple combined technologies of ''allowing alteration of a login account, simultaneously submitting multiple passwords for verification, disabling password verification triggered within a period of time based on a certain probability, disabling password verification within a period of time when characters in an input password match characters in a real password within an appointed range, and recording and counting password verification failure information''. The present invention effectively prevents an illegitimate user from hacking account passwords, thereby improving account security.

Description

Password verification method and system

Technical field

The present invention relates to the field of computers, and in particular, to a password verification method and system.

Background technique

The existing password verification method has a password verification failure, and the user is notified to disable the password verification for a certain period of time. During the password verification, the user can reset the password by using a mobile phone verification code. For example, if the Alipay login password verification fails for 5 consecutive times, the account will be locked for 3 hours. During the lockout period, the login password can be reset by the mobile phone check code. If the Alipay payment password verification fails for 3 consecutive times, the account will be locked for 3 hours. The payment password is reset by the mobile phone check code + ID number.

The disadvantage of the method is that an illegal user can perform password verification for an account for a certain period of time, so that the password verification can be disabled for a period of time, so that the real user of the account needs to wait for a period of time or reset the password by using the mobile phone verification code. The operational complexity. If an illegal user attacks a large number of accounts in the above manner, it will increase the operating cost of the system as a bad user experience and sending a large number of text messages. If an illegal user obtains the mobile phone and ID number of an individual user through certain channels, the user's personal information and property will be at risk of loss. That is, illegally destroying low cost, safety and high cost.

In addition, the existing method only saves the user login success record, such as the login log function of the China Merchants Bank APP. The disadvantage is that the real user cannot know the process when the account is attacked by the illegal user multiple times. It is too late to take the precautionary measures after the real user finds that the illegal user has successfully logged in.

technical problem

The disadvantage of the existing password verification method in the above background art is that an illegal user can disable password verification for a certain period of time by attempting to perform password verification on an account, so that the real user of the account needs to wait for a period of time or pass the mobile phone when performing password verification. Checksum mode resetting the password increases the operational complexity. If an illegal user attacks a large number of accounts in the above manner, it will increase the operating cost of the system as a bad user experience and sending a large number of text messages. If an illegal user obtains the mobile phone and ID number of an individual user through certain channels, the user's personal information and property will be at risk of loss. That is, illegally destroying low cost, safety and high cost.

Problem solution

Technical solution

In order to overcome the user experience of the illegal user attack behavior in the prior art and the operating cost brought by sending the short message, the risk of personal information and property loss caused by the loss of the user's mobile phone and the leakage of the ID number is prevented, and the account is In the case that the process is attacked and the process cannot be known, the present invention provides a method in which the login account allows modification, multiple passwords are simultaneously submitted for verification, the password is deactivated for a period of time triggered by a certain probability, and the password is matched with the real password to match the specified range. A password verification method and system for deactivating any one or more of the combination of password verification, recording, and statistical password verification failure information for a period of time.

The technical solution adopted by the present invention to solve the technical problem thereof is:

A password verification method and system, comprising a total of five technologies, wherein any one or more of the combined technologies can constitute a technical solution, and the following five technologies are respectively explained:

Technique 1 (login account allows modification): Account information includes (not limited to) "user account", "login account", "first password" field. The User Account field is the user ID. It does not participate in password verification or can only participate in the password verification within the preset consecutive failure times. It can be seen by looking up friends, viewing personal or friend data, and the effect is equivalent to QQ. The "login account" field is the user ID when the user performs password verification, including but not limited to the login scenario. The user can only view and modify his or her login account, and the user can modify it (and detect other users). Whether the login account is duplicated and saved after successful password verification. The next time you perform password verification, you will need to enter a new login account, which is equivalent to the “username” in the “username+password” authentication mode; “first password” The field is the password used by the user for password verification, and is equivalent to the "password" or other password-based authentication method (such as mobile phone verification code) in the above "username + password" authentication mode. The value of the above user identity is unique (not repeated). The password verification method is the login account (or user account) + the first password.

In addition, there may be multiple login accounts, and after the number of consecutive failed login verification attempts, the first login account is disabled and the second login account is enabled for password verification, and only the second login account is used for password verification. After the verification is successful, the system can be entered, the first login account is reset and the second login account is disabled. You can also use more login account items to perform password verification, such as the third login account.

Technique 2 (Multiple passwords are submitted simultaneously for verification): When the password verification fails using the "Login Account" + "First Password" field for consecutive d1 times and above, the protection mode is enabled. The above protection mode refers to adding a password field, and subsequently using the "login account" + "first password" + "second password" field to simultaneously submit to the server for password verification, only "first password" and "second password" The verification is successful only when the matching is successful. Reset d1 count to 0 after successful login. It is also possible to use more password fields to enhance password verification, such as the "third password" field (note: the above-mentioned "alpha + number" parameter can be set and generated by the user or system).

Technique 3 (deactivate password verification for a period of time based on a certain probability): When the password verification fails for d1 times or more, the system generates a random number s1 between 1 and m1 (m1 is the set maximum number). When s1=1, t1 disables password verification and returns password verification failure message for a period of time (illegal users cannot know whether password verification is disabled, and the real user can guess by inputting the correct password). After the login is successful, the reset d1 count is 0 (Note: The above-mentioned "alpha + number" parameter can be set and generated by the user or system).

Technique 4 (Enter the password and the real password to match the specified range of characters for a period of time to disable password verification): Set the input password and the real password (you can also add multiple preset "anti-break decoding" f1 with interference effect Participate in matching) When matching the specified number of characters (the number of characters matches between n1 and n2), t1 disables password verification and returns a password verification failure message for a period of time (illegal users cannot know whether password verification is disabled, real users) Can be guessed by entering the correct password) (Note: The above-mentioned "alpha + number" parameters in this technology can be set and generated by the user or system).

Technology 5 (recording and statistics password verification failure information): Each password verification failure information will be saved in the system. After logging in to the system, users can check the password verification failure information and statistical data of this account to judge account security. And take preventive measures in a timely manner.

It should be noted that if a technical solution includes the above multiple technologies, the above-mentioned "letter + number" parameters may have different values in each technology.

Advantageous effects of the invention

Beneficial effect

The beneficial effect of the technology 1 is that the login account can be improved only by the user itself. When an illegal user is found to try to attack the account, the login account can be modified to lose the target, thereby prohibiting the behavior.

The beneficial effect of Technology 2 is that the exponential level enhances the difficulty of brute force cracking. The violent cracking refers to the exhaustive method. The formula for calculating the maximum number of attempts for brute force success is: (F^L)^P, where ^ represents the power; F represents The number of characters (for example, 10 characters from 0 to 9); L represents the number of characters (for example, the password only allows 6 digits); P represents the number of passwords (for example, 2 passwords are required in the above protection mode).

The beneficial effect of the technology 3 is that when an illegal user violently cracks an account, it is unclear how many times the password verification is deactivated and deactivated due to the uncertainty of how many attempts to verify the authentication, which causes it to be useless and cannot be cracked in a short time. When the real user finds that the account is in the password verification mode, the brute force action can be invalidated by changing the password (or the login account in the technology 1).

The beneficial effect of the technology 4 is that when an illegal user violently cracks an account, since the password is matched with the character of the real password for a certain number of times, the password verification is disabled for a period of time, and the subsequent input of the password is not verified by the password verification. Messages, which greatly reduce the risk of passwords being cracked.

The beneficial effect of the technology 5 is that the user can monitor whether the account is attacked and attacked, and take preventive measures to protect the account security in time.

Brief description of the drawing

DRAWINGS

The drawings illustrate the preferred embodiments of the present invention and are used to further understand the technical spirit of the present invention. Therefore, the invention is not limited to the drawings.

1 is a flow chart schematically illustrating a password verification method according to a first embodiment of the present invention.

2 is a flow chart schematically illustrating a password verification method of a plurality of login account replacement rules according to a second embodiment of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Preferred embodiments of the cryptographic verification method of the present invention are given below with reference to the accompanying drawings.

Example 1:

As shown in FIG. 1, the user inputs a login account [101], and the system detects whether the login account exists [102]. If not, the login account does not have a message [103]; if so, the next step is performed.

The system detects whether the login account is in the protection mode [201] and controls the display/hide of the second password input box. If not, the user inputs the first password [202]; if so, the user inputs the first password and the second password [203].

After the user submits, the system detects whether the password verification is in the disabled state [3401], and if so, prompts the password verification failure message [3403]; if not, the next step is performed.

The system detects whether the password verification fails [204]. If not, the reset password verification failure consecutive count is 0 [2301], and enters the system [205]; if so, records the password verification failure information (mainly including the user account, login account, Password, verification time, after entering the system, you can count and view the record according to time) [501], the password verification failure consecutive count is incremented by 1 [2302], and the next step is performed.

The system detects whether the password verification failure consecutive count is >= the preset number of times in the technology 2 protection mode [206], and if so, enables the protection mode (the first password and the second password are required to be used for the next password verification) [207], and Perform the next step; if not, proceed directly to the next step.

The system detects whether the consecutive number of password verification failures is >= the preset number of times in technology 3 [301], and if so, generates a random number [302] between 1 and the preset number, if the above random number = 1 [303], The system executes the password verification [3402] and the prompt password verification failure message [3403] within the preset time, if the above random number! When =1 [303], the next step is performed; if not, the next step is performed.

The system detects whether the input password matches the real password with a preset range of characters [401], and if so, the system performs the password verification [3402] and the prompt password verification failure message [3403] within a preset time; if not, only the password is prompted Verification failure message [3403].

Example 2:

As shown in FIG. 2, the user inputs a login account [101], and the system detects whether the login account exists [102]. If not, the login account does not have a message [103]; if so, the next step is performed.

The system detects whether the login account is disabled [20201], and if so, prompts that the current login account has been deactivated and uses the next login account for password verification message [20202]; if not, the next step is performed.

The system detects whether the password verification fails [204]. If not, the reset password verification failure consecutive count is 0 [2301] and the activation/deactivation status of multiple login accounts [20206], and enters the system [205]; if yes, The password verification failure consecutive count is incremented by 1 [2302] and the next step is performed.

The system detects whether the current login account is the last one of the multiple login accounts [20203], and if so, prompts the password verification failure message [3403]; if not, performs the next step.

The system detects whether the password verification failure consecutive count is >= preset number [20204], if not, prompts the password verification failure message [3403]; if yes, disables the current login account and enables the next login account [20205], prompting the current login The account has been deactivated and please use the next login account for password verification message [20202].

For convenience of description, the above five technologies are described as a technical solution of an overall process in the drawings and embodiments of the specification. It should be noted that any one or more of the combined technologies may be used as a technical solution in the implementation of the present invention.

The descriptions of the above are merely specific descriptions of the possible embodiments of the present invention, and are not intended to limit the scope of the present invention. Within the scope of protection of the invention.

Claims

A password verification method, characterized in that the account information includes (not limited to) a user account, a login account, and a first password field, wherein the user account is a unique identifier of the user identity, does not participate in password verification, or can only participate in preset default failures. The password verification within the number of times is visible to other users; the login account is a unique identifier of the user when the user performs password verification, and the user can only view and modify his own login account; the first password is the password used by the user for password verification, and the password is verified. The mode is login account (or user account) + first password.
The password verification method according to claim 1, wherein there are a plurality of login accounts, wherein when the current login account fails the password verification for a preset number of times and above [20204], the current login account is disabled and enabled. A login account for password verification [20205], only after the next login account is successfully authenticated [204] can enter the system [205] and reset the activation/deactivation status of multiple login accounts [20206].
A password verification method, characterized in that, when the password verification fails for a preset number of times and above [206], the protection mode [207] is enabled, and the protection mode refers to adding one or more password items [203] and simultaneously submitting to The server performs password verification, and only if all the password items match successfully, the verification succeeds.
A password verification method, characterized in that, when the password verification fails for a preset number of times and above [301], the system generates a random number between 1 and a preset number [302], when the random number = 1 [303] The password verification is disabled within the preset time [3402] and the password verification failure message [3403] is returned (the illegal user cannot know whether the password verification is disabled, and the real user can guess by inputting the correct password).
A password verification method, characterized in that the input password matches a real password (and/or joins a plurality of preset "anti-break decoding" with interference effects) when matching a specified number of characters [401], preset The password verification is disabled in time [3402] and the password verification failure message [3403] is returned (illegal users cannot know whether the password verification is disabled or not, and the real user can guess by entering the correct password).
A password verification method is characterized in that each password verification failure information is saved in the system [501], and the user can view the password verification failure information and statistics of the account after logging in to the system.
A password verification system characterized by comprising a system comprising a cryptographic verification method according to any one or more of claims 1 to 6.