Password storing and verifying method and password storing and verifying device

Abstract

An embodiment of the invention provides a password storing and verifying method and a password storing and verifying device. The method comprises the following steps of acquiring identity authentication information of a user; adding preset parameters in the identity authentication information to obtain a character string; performing Hash operation by using the character string to obtain a characteristic value; and extracting data at an appointed position as enciphered data from the characteristic value. By the password storing and verifying method and the password storing and verifying device, the complexity of passwords of a user can be improved, the defense capability of the passwords of the user can also be improved, Hash collision is avoided or reduced, so that the crack probability of the passwords is reduced, and the passwords of the user are prevented from leaking.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a password storage method, a password verification method, a password storage device and a password verification device. Background technique [0002] With the development of informatization construction, information security has gradually become an important issue. The information security system in the network environment is the key to ensure information security. [0003] In computer services, the most common and basic user login access control method is the "username / password" method, that is, when a user needs to use a certain service, he must first register a user name and set a password corresponding to it. For the corresponding password, the service provider stores the user's username / password in the "user information database". When the user logs in, the user submits the user name and password to the server for authentication, and the server compares the u...

AI Technical Summary

Problems solved by technology

Therefore, directly hashing user passwords is not very defensive for simple passwords

[0008] Secondly, currently commonly used hash algorithms, such as MD5, SHA-1, etc., all have collision problems, that is, different passwords have the same hash value

In this way, even if the user uses a more complex password, if its hash value collides with the hash value of a record in the password-hash value relationship table owned by the attacker, its password will also be cracked

Images