User password management method and server

Abstract

The embodiment of the invention provides a user password management method and a server, and relates to the field of computers. The method is as follows: through generating salt value extended information according to a salt value after receiving a user registration request comprising a user ID (Identification) and a password, and splicing the salt value and the salt value extended information into salt value information according to a preset sequence, after a password is encrypted, the user ID only needs to be associated with a second ciphertext after two times of encryption to store and thesalt value does not need to be stored; the problem that the server needs to consume a large number of storage spaces due to the fact that the salt value needs to be stored in the prior art is solved;and since the salt value does not need to be stored, an attacker is prevented from attacking and cracking the user password by stealing the salt value and constructing a rainbow table.

Description

technical field [0001] The embodiment of the present invention relates to the field of computer technology, in particular to a user password management method and server. Background technique [0002] In the era of big data, in order to prevent unauthorized access to information resources in the big data system, users need to be authenticated before accessing the big data system. An existing user authentication method is an authentication method based on a user identification (Identification, ID) and a password. In actual implementation, in order to ensure the security of the password, it is usually necessary to encrypt the password during user registration. [0003] An existing method for user registration includes: receiving a user registration request, which carries a user ID and a password; generating a random number as a salt value; encrypting the password according to the salt value to obtain a password ciphertext; ID, password ciphertext, and salt value association ...

AI Technical Summary

Problems solved by technology

[0004] In the process of implementing the present invention, the inventor found that the above-mentioned process has at least the following problems: since the salt value needs to be stored in association with the user ID and password ciphertext after encrypting the password, this leads to a certain amount of storage space being consumed when storing the salt value

In particular, when there are many encrypted passwords, the server needs to consume a lot of storage resources to store the salt value corresponding to each password, and also needs to obtain the corresponding salt value from the storage resources during authentication, thus consuming a lot of input and output (I / O) resources

In addition, the salt value stored on the server may be used by attackers to attack the password encrypted by the salt value by constructing a rainbow table

Images