User password encryption processing method, device, equipment and storage medium

Abstract

The embodiment of the present invention provides a method, device, equipment and storage medium for encrypting and processing user passwords, which are applied to a server. The method includes: responding to a user's login request, obtaining a stored first random number and a first encrypted password; when the user's login request meets a preset random number update condition, obtaining a second random number and a second encrypted password; updating the stored first random number and the first encrypted password with the second random number and the second encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification for the user password. By automatically updating and / or replacing the random number and the encrypted password used for login verification, the flexibility of using the encryption processing of the user password is increased, and the encryption effect is enhanced based on its flexibility, which is conducive to improving the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements.

Description

Technical Field

[0001] The present invention relates to the fields of network technology and security technology, and in particular to a user password encryption processing method, a user password encryption processing device, a corresponding electronic device and a corresponding computer storage medium. Background Art

[0002] With the rapid development of science and technology in recent years, we have entered the information age. However, in the information age, personal information is often leaked for various reasons, leading to property safety risks. Therefore, security is very important in the network production process.

[0003] At present, in order to ensure the security of the network production process, most industries adopt the method of directly using external encryption methods for encryption, and then storing the encrypted data directly in the database. However, this encryption method has low security and is not suitable for projects with high confidentiality requirements, such as encryption of account data. Summary of the invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a user password encryption processing method, a user password encryption processing device, a corresponding electronic device and a corresponding computer storage medium that overcome the above problems or at least partially solve the above problems.

[0005] The embodiment of the present invention discloses a method for encrypting a user password, which is applied to a server. The method includes:

[0006] In response to a user's login request, obtaining a stored first random number and a first encrypted password; the first encrypted password is obtained by encrypting an encryption result of the user password based on the first random number;

[0007] When the user's login request meets the preset random number update condition, a second random number and a second encrypted password are obtained; the second encrypted password is obtained by encrypting the encryption result of the user password based on the second random number;

[0008] The second random number and the second encrypted password are used to update the stored first random number and the first encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification on the user password.

[0009] Optionally, it also includes:

[0010] In response to a login request from a user, encrypt the user password using a preset encryption algorithm to obtain an encryption result for the user password, and perform an XOR operation on the encryption result of the user password using the first random number to obtain encrypted data;

[0011] If the encrypted data is compared with the first encrypted password and passes, it means that the current user password has passed the login verification;

[0012] After passing the login verification based on the first random number and the first encrypted password, if the time interval between the user's login requests and / or the number of logins of the user do not meet the preset random number update conditions, the first random number and the first encrypted password are retained and stored.

[0013] Optionally, the preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold;

[0014] When the login request of the user meets the preset random number update condition, obtaining the second random number and the second encrypted password includes:

[0015] If the time interval between the issuance time of the login request of the user and the previous issuance time is greater than a preset time threshold, and / or the number of logins of the user is greater than a preset number threshold, an indicator of changing the random number is added to the user account of the user;

[0016] After the login verification is passed based on the first random number and the first encrypted password, a dynamically generated second random number is obtained for the user account having an identifier for changing the random number;

[0017] The encryption result of the user password is encrypted according to the second random number to obtain a second encrypted password.

[0018] Optionally, the encryption result for the user password includes an integer string converted from an encrypted character string after encrypting the user password;

[0019] The step of encrypting the encryption result of the user password according to the second random number to obtain a second encrypted password includes:

[0020] The second random number is used to perform an XOR operation on the integer string for the user password to obtain a second encrypted password.

[0021] Optionally, updating the stored first random number and first encrypted password with the second random number and the second encrypted password comprises:

[0022] Obtaining a first prefix character that is the same in the first random number and the first encrypted password;

[0023] Using the first prefix character to determine a storage location, and adding the same second character prefix to the second random number and the second encrypted password;

[0024] The first random number and the first encrypted password having the first prefix character in the storage location are replaced with the second random number and the second encrypted password having the second prefix character respectively.

[0025] Optionally, before responding to the user's login request, the method further includes:

[0026] storing the first random number and the first encrypted password in correspondence;

[0027] The corresponding storage of the first random number and the first encrypted password includes:

[0028] Obtaining a dynamically generated first random number, and encrypting the user password using a preset encryption algorithm to obtain an encryption result for the user password;

[0029] Using the first random number to perform an XOR operation on the encryption result of the user password to generate the first encrypted password;

[0030] The first random number and the first encrypted password are stored correspondingly.

[0031] Optionally, the using a preset encryption algorithm to encrypt the user password to obtain an encryption result for the user password includes:

[0032] Encrypting the user password using a preset encryption algorithm to generate an encrypted string of preset length;

[0033] Converting the encrypted string of the preset length into an array; the array includes array data;

[0034] The array data is concatenated in array order to obtain an integer string.

[0035] Optionally, the corresponding storage of the first random number and the first encrypted password includes:

[0036] Adding the same first character prefix to the obtained first random number and the generated first encrypted password;

[0037] The same first character prefix is ​​used to store a first random number and a first encrypted password corresponding to the first random number.

[0038] The embodiment of the present invention further discloses a user password encryption processing device, which is applied to a server, and the device comprises:

[0039] A login request response module, used to respond to a user's login request and obtain a stored first random number and a first encrypted password; the first encrypted password is obtained by encrypting an encryption result of the user password based on the first random number;

[0040] A random number update module, configured to obtain a second random number and a second encrypted password when the user's login request meets a preset random number update condition; the second encrypted password is obtained by encrypting the encryption result of the user password based on the second random number;

[0041] The storage update module is used to update the stored first random number and first encrypted password with the second random number and the second encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification on the user password.

[0042] Optionally, before responding to the user's login request, the device further includes:

[0043] A corresponding storage module, used for correspondingly storing the first random number and the first encrypted password;

[0044] The corresponding storage module includes:

[0045] The encryption result generating unit is used to obtain a dynamically generated first random number, and encrypt the user password using a preset encryption algorithm to obtain an encryption result for the user password;

[0046] A first encryption password generating unit, configured to perform an XOR operation on an encryption result of the user password using the first random number to generate the first encryption password;

[0047] A corresponding storage unit is used to store the first random number and the first encrypted password accordingly.

[0048] Optionally, the encryption result generating unit includes:

[0049] The encrypted string generating subunit is used to encrypt the user password using a preset encryption algorithm to generate an encrypted string of a preset length;

[0050] An array conversion subunit, used to convert the encrypted string of preset length into an array; the array includes array data;

[0051] The data concatenation subunit is used to concatenate the array data in array order to obtain an integer string.

[0052] Optionally, the corresponding storage unit includes:

[0053] A first character prefix adding subunit, used for adding the same first character prefix to the acquired first random number and the generated first encrypted password;

[0054] The corresponding storage subunit is used to adopt the same first character prefix to correspondingly store a first random number and a first encrypted password corresponding to the first random number.

[0055] Optionally, the device further comprises:

[0056] an encrypted data generating module, for responding to a user's login request, encrypting the user password using a preset encryption algorithm to obtain an encryption result for the user password, and performing an XOR operation on the encryption result of the user password using the first random number to obtain encrypted data;

[0057] An encrypted password comparison module, used for indicating that the current user password has passed the login verification when the encrypted data is compared with the first encrypted password;

[0058] A retention storage module is used to retain and store the first random number and the first encrypted password after the login verification is passed based on the first random number and the first encrypted password, if the time interval between the user's login requests and / or the number of logins of the user do not meet the preset random number update conditions.

[0059] Optionally, the preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold; the random number update module includes:

[0060] An identification adding submodule, used for adding an identification of changing a random number to the user account of the user when the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold;

[0061] A second random number acquisition submodule, after the user passes the login verification based on the first random number and the first encrypted password, acquires a dynamically generated second random number for the user account with an identifier for changing the random number;

[0062] The second encrypted password generating submodule is used to encrypt the encryption result of the user password according to the second random number to obtain a second encrypted password.

[0063] Optionally, the encryption result for the user password includes an integer string converted from an encrypted character string after encrypting the user password; and the second encrypted password generation submodule includes:

[0064] The second encrypted password generating unit is used to perform an XOR operation on an integer string for the user password using the second random number to obtain a second encrypted password.

[0065] Optionally, the storage update module includes:

[0066] A first prefix character acquisition submodule, used to acquire the first prefix character that is the same in the first random number and the first encrypted password;

[0067] a second prefix character adding submodule, configured to determine a storage location using the first prefix character, and to add the same second character prefix to the second random number and the second encrypted password;

[0068] The update replacement submodule is used to replace the first random number and the first encrypted password with the first prefix character in the storage location with the second random number and the second encrypted password with the second prefix character respectively.

[0069] An embodiment of the present invention also discloses an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of any one of the user password encryption processing methods are implemented.

[0070] The embodiment of the present invention further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the user password encryption processing methods are implemented.

[0071] The embodiments of the present invention include the following advantages:

[0072] In an embodiment of the present invention, when the server responds to a user's login request, if the user's login request meets the preset random number update condition, the server can obtain a second random number and a second encrypted password, and use the second random number and the second encrypted password to update the originally stored first random number and the second encrypted password, so that the updated second random number and the second encrypted password can be used to perform login verification of the user's password when responding to the user's login request later. By automatically updating and / or replacing the random number and the encrypted password used for login verification, the flexibility of using the encryption processing of the user password is increased, and the encryption effect is enhanced based on its flexibility, and the encryption password is not easy to be cracked, and the generated encryption password is obtained by encrypting the encryption result again based on the random number. This double encryption method is also not easy to be cracked, which is conducive to improving the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1It is a schematic diagram of the process of encrypting a user password in the related art;

[0074] Figure 2 It is a flowchart of a method for encrypting a user password according to an embodiment of the present invention;

[0075] Figure 3 is a flowchart of another embodiment of a method for encrypting a user password according to the present invention;

[0076] Figure 4 It is a schematic diagram of the process of the double encryption method provided by an embodiment of the present invention;

[0077] Figure 5 It is a schematic diagram of an application scenario of user password encryption processing provided by an embodiment of the present invention;

[0078] Figure 6 It is a structural block diagram of an embodiment of a user password encryption processing device of the present invention. DETAILED DESCRIPTION

[0079] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0080] In order to ensure the security of network production, some important data usually needs to be encrypted and stored in the database. In projects with higher confidentiality requirements, such as the encryption of account data, higher requirements are mostly expressed by using components for encryption and using the keys obtained / defined by themselves, or processing the encryption key.

[0081] Reference Figure 1 , showing a schematic diagram of the process of encrypting the user password in the related art, the use of components and the processing of the encryption key key can be manifested as obtaining the user password registered by the user, and then using the component, such as base64 to pass in the encryption key key to encrypt the obtained user password to obtain the encrypted password; the encrypted password is stored in the database, the encryption key key can be the key key for encrypting all user passwords, and the encryption key key can be used to encrypt the user password when the user logs in again. At this time, the encrypted data can be compared with the encrypted password in the database. If the comparison is successful, it means that the login verification has passed and the user has logged in successfully.

[0082] However, in the related technology for encrypting user passwords, the stored key is a constant, that is, the encryption key used for encryption is a fixed key. Therefore, the same encryption key is used each time the user password is encrypted. This encryption method using a fixed key is easy to crack, and the encrypted data obtained by the encryption process has low security and is not suitable for projects with high confidentiality requirements.

[0083] One of the core ideas of the embodiments of the present invention is to propose a method of double encrypting user passwords through dynamically updated random numbers, which can further ensure the security of encrypted data through multiple encryptions and automatic replacement of random numbers, and provide dynamic update capabilities while improving the security of encrypted data. The flexibility of using user password encryption processing can be increased mainly by automatically updating and / or replacing random numbers and encryption passwords used for login verification, and the encryption effect is enhanced based on its flexibility. The encryption password is not easy to be cracked, and the generated encryption password is obtained by encrypting the encryption result again based on the random number. This double encryption method is also not easy to be cracked, which is beneficial to improving the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements.

[0084] Reference Figure 2 , shows a flowchart of a method for encrypting a user password according to an embodiment of the present invention, which is applied to a server and focuses on the encryption process of a user logging in using a registered user password, and may specifically include the following steps:

[0085] Step 201, responding to a user's login request, obtaining a stored first random number and a first encrypted password;

[0086] In an embodiment of the present invention, a method of doubly encrypting user passwords through dynamically updated random numbers is proposed, which can further ensure the security of encrypted data through multiple encryptions and automatic replacement of random numbers, and provide dynamic update capabilities while improving the security of encrypted data.

[0087] In order to improve the security of encrypted data, when the server responds to the user's login request, the first encrypted password obtained can be obtained by encrypting the encryption result of the user password based on the first random number, wherein the encryption result of the user password is the encrypted data that has been encrypted once, and the encryption process performed on the encryption result again based on the first random number is a secondary encryption process. Then, the first encrypted password obtained can be expressed as the encrypted data after the user password is encrypted twice. Based on the double encryption of the user password, it is beneficial to improve the security of the data that needs to be encrypted.

[0088] In practical applications, in order to ensure security during the network production process, some important data usually needs to be encrypted and stored in a database, and the encryption of the user password is implemented by relying on the first random number. When responding to a user's login request, the server can obtain the stored first random number from the cache and the first encrypted password stored corresponding to the first random number from the database in order to perform login verification on the user password carried in the login request, so as to perform login verification on the current login request based on the first random number and the first encrypted password relied on during encryption.

[0089] Step 202, when the user's login request meets the preset random number update condition, obtain a second random number and a second encrypted password;

[0090] In order to prevent the user's login from expiring, when the user's login request meets the preset random number update conditions, the random number can be automatically replaced to avoid leaking user information. At the same time, the flexibility of using user password encryption processing is increased, and the encryption effect is enhanced based on its flexibility.

[0091] The operation of automatically replacing random numbers performed can mainly be used to double encrypt user passwords through dynamically updated random numbers. Then, when the user's login request meets the preset random number update conditions, the second random number obtained is a dynamically generated random number, and the obtained second encrypted password is processed based on the double encryption method like the first encrypted password stored in the database, that is, the second encrypted password can be obtained by encrypting the encryption result of the user password based on the second random number.

[0092] Among them, the situation where the user's login request meets the preset random number update condition may refer to the situation where the user's login has expired. The situation used to indicate that the user's login has expired may include the login expiration situation caused by the time interval between the user's login request and the previous issuance time being too long, or it may include the login expiration situation caused by the number of login requests of the user exceeding the limit. This embodiment of the present invention does not limit this.

[0093] In actual applications, even if it is necessary to automatically replace the random number when the user login expires, in order to ensure that the user requested to log in has the authority to update the random number, the server can automatically replace the random number after the current login request passes the login verification based on the first random number and the first encrypted password, that is, after the user successfully logs in using the first random number stored in the cache before replacing the random number and the first encrypted password stored in the database.

[0094] Step 203: Use the second random number and the second encrypted password to update the stored first random number and the first encrypted password.

[0095] The operation of automatically replacing the random number performed can be specifically manifested as updating the stored first random number and the first encrypted password with the second random number and the second encrypted password, so that the updated second random number and the second encrypted password can be used for subsequent login verification of the user password, making the encrypted password difficult to crack, which is beneficial to improving the security of the data that needs to be encrypted, and is suitable for projects with high confidentiality requirements.

[0096] Specifically, the random number can be automatically replaced and a new encryption password can be automatically generated through calculation to replace the encryption password in the database. The random number automatically replaced can be the second random number, and the new encryption password automatically generated can be the second encryption password. Then the update using the second random number and the second encryption password is mainly manifested as the update and replacement of the first random number stored in the cache and the first encryption password stored in the database, that is, the first random number stored in the cache is replaced by the second random number, and the first encryption password stored in the database is replaced by the second encryption password, and the second random number and the second encryption password are stored correspondingly in the cache and the database.

[0097] In an embodiment of the present invention, when the server responds to a user's login request, if the user's login request meets the preset random number update condition, the server can obtain a second random number and a second encrypted password, and use the second random number and the second encrypted password to update the originally stored first random number and the second encrypted password, so that the updated second random number and the second encrypted password can be used to perform login verification of the user's password when responding to the user's login request later. By automatically updating and / or replacing the random number and the encrypted password used for login verification, the flexibility of using the encryption processing of the user password is increased, and the encryption effect is enhanced based on its flexibility, and the encryption password is not easy to be cracked, and the generated encryption password is obtained by encrypting the encryption result again based on the random number. This double encryption method is also not easy to be cracked, which is conducive to improving the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements.

[0098] Reference Figure 3 , shows a flowchart of another embodiment of a user password encryption processing method of the present invention, which is applied to a server and focuses on the overall encryption processing process from user registration of a user password to using the registered user password to log in, which may specifically include the following steps:

[0099] Step 301, generating a first random number and a first encrypted password, and storing the first random number and the first encrypted password correspondingly;

[0100] When a user registers a user account, the server can receive a registration request sent by the user. The registration request sent carries the user account and the user password for this user account. In order to ensure security in the network production process, a first random number for encrypting the user password and a first encrypted password after the user password is encrypted can be generated at this time. For some more important data, it is usually necessary to encrypt the data and store the encrypted data in a database. In this case, the generated first random number and first encrypted password can be stored in the cache and the database respectively.

[0101] In practical applications, the generation of the first random number can be dynamic and random, and the random number generated randomly is an integer type random number, and the generation of the first encrypted password can be implemented by double encryption. The double encryption method can be expressed as using a preset encryption algorithm to encrypt the user password to obtain an encryption result for the user password, and the encryption result obtained belongs to the result of a single encryption process, and then the first random number can be used to perform an XOR operation on the encryption result for the user password to generate a first encrypted password, and the generated first encrypted password belongs to the result of a double encryption process.

[0102] Specifically, the encryption processing method performed once can mainly be achieved by encrypting the user password using a preset encryption algorithm to generate an encrypted string of preset length; then converting the encrypted string of preset length into an array, and concatenating the array data contained in the array in the array order to obtain an integer string.

[0103] For example, Figure 4 As shown, the preset encryption algorithm used can be SHA-1 (Secure Hash Algorithm 1, a Hash algorithm). SHA-1 has high security, and the double encryption based on SHA-1 can improve security. At this time, the server can encrypt the user password according to SHA-1 to generate an encrypted string of preset length, that is, the generated encrypted string can be an encryption result composed of a preset length, such as 40 letters or numbers, such as f73926e2d2c800406660e67468c1cb8093a3b337, and then the generated string can be converted into a byte[] array, and the array data contained in the byte[] array can be spliced ​​in data order to obtain an integer string of integer type. At this time, the spliced ​​integer string can be recorded, and the generated integer string is one of the data that needs to be XORed, that is, the encryption result after one encryption process.

[0104] Among them, the preset length of the generated encrypted string can refer to the length of the program operation string, and the conversion of the encrypted string to an array and the splicing of data can be implemented based on the program. The program that performs the above operations can be expressed as a plug-in in actual applications, that is, it can be implemented based on the introduction of the SHA-1 encryption algorithm plug-in.

[0105] After the first random number and the first encrypted password are generated, the first random number and the first encrypted password can be stored correspondingly. The first random number is stored in the cache, and the first encrypted password is stored in the database. In order to ensure that the first random number stored in the cache and the first encrypted password stored in the database can be stored correspondingly, two characters can be randomly added to the prefix of the random number and the encrypted password to ensure corresponding storage. At this time, the first character prefix can be obtained, and the same first character prefix can be added to the obtained first random number and the generated first encrypted password. Based on the use of the same first character prefix, the first random number and the first encrypted password corresponding to the first random number are stored correspondingly.

[0106] Step 302, in response to the user's login request, encrypt the user password using a preset encryption algorithm to obtain an encryption result for the user password, and then perform an XOR operation on the encryption result of the user password using a first random number to obtain encrypted data;

[0107] After the user successfully registers the user password and stores the first random number and the first encrypted password accordingly, when the user logs in using the user password, the user password carried in the login request can be verified, and the current login request can be verified based on the first random number and the first encrypted password that were relied upon during encryption.

[0108] Specifically, due to the double encryption method used when encrypting the user password, when the server responds to the user's login request and performs login verification on the current login request, it also needs to perform double encryption verification. Specifically, it can be manifested as using a preset encryption algorithm, such as SHA-1, to encrypt the user password to obtain an encryption result for the user password, and then using the first random number obtained in response to the user's login request to perform an XOR operation on the encryption result of the user password to obtain encrypted data, so that the first encrypted password obtained in response to the user's login request is used to compare and determine the encrypted data generated for login verification.

[0109] Step 303: If the encrypted data is compared with the first encrypted password, determine whether to update or replace the stored first random number and the stored first encrypted password;

[0110] The encrypted data generated for login verification is compared and judged. If the encrypted data is compared with the stored first encrypted password, it means that the user password carried in the current login request has passed the login verification, that is, the current user has logged in successfully and can continue the operation; if the encrypted data fails to compare with the stored first encrypted password, it will prompt that the password is wrong.

[0111] In order to prevent the user's login from expiring while ensuring that the user requesting login has the authority to update the random number, if the user password carried in the current login request passes the login verification, it can be determined whether to update and replace the stored first random number and the stored first encrypted password.

[0112] In a specific implementation, it can be achieved by judging whether the user's login request meets the preset random number update condition. The situation in which the user's login request meets the preset random number update condition may refer to the situation in which the user's login is expired. The situation used to indicate that the user's login is expired may include the situation in which the time interval between the issuance time of the user's login request and the previous issuance time is too long, resulting in a login expiration situation, and may also include the situation in which the number of login requests of the user exceeds the limit. That is, the preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than the preset time threshold, and / or the number of logins of the user is greater than the preset number threshold. It should be noted that the determination of the preset time threshold and the preset number threshold can be set based on actual conditions, and the embodiment of the present invention does not limit this.

[0113] In one case, if the time interval between the user's login request and / or the number of user logins do not meet the preset random number update conditions, that is, the time interval between the user's login request and the previous one is less than the preset time threshold, and the user's login times are less than the preset threshold, the user's login will not expire at this time, and there is no need to update the stored first random number and first encrypted password.

[0114] In another case, when the time interval between the user's login requests and / or the number of user logins meet the preset random number update conditions, that is, the time interval between the user's login request and the previous login request is greater than the preset time threshold, and / or the user's login times are greater than the preset threshold, the user's account will expire. At this time, the stored first random number and the stored first encrypted password need to be updated and replaced.

[0115] The update and replacement operation performed can be manifested as automatically replacing the random number and automatically generating a new encryption password through calculation, replacing the encryption password in the database, and then updating the stored first random number and first encryption password with the second random number and the second encryption password, so that the updated second random number and the second encryption password can be used for subsequent login verification of the user password.

[0116] In actual applications, the operation of automatically replacing random numbers can be mainly used to double encrypt user passwords through dynamically updated random numbers. Then, when the user's login request meets the preset random number update conditions, the second random number obtained is a dynamically generated random number, and the obtained second encrypted password is processed based on the double encryption method like the first encrypted password stored in the database, that is, the second encrypted password can be obtained by encrypting the encryption result of the user password based on the second random number.

[0117] In a specific implementation, if the time interval between the time when the user's login request is issued and the previous time is issued is greater than a preset time threshold, and / or the number of logins of the user is greater than a preset number threshold, an identifier for changing the random number can be added to the user's user account. After the login verification is passed based on the first random number and the first encrypted password, a dynamically generated second random number can be obtained for the user account with the identifier for changing the random number, and then the encryption result of the user password can be encrypted according to the second random number to obtain a second encrypted password.

[0118] The method for generating the second encrypted password may be implemented by referring to the method for generating the first encrypted password.

[0119] In practical applications, the generation of the second random number can be dynamic and random, and the random number generated randomly is an integer type random number, and the generation of the second encrypted password can be implemented by double encryption. The double encryption method can be expressed as using a preset encryption algorithm to encrypt the user password to obtain an encryption result for the user password, and the encryption result obtained belongs to the result of a single encryption process, and then the second random number can be used to perform an XOR operation on the encryption result for the user password to generate a second encrypted password, and the generated second encrypted password belongs to the result of a double encryption process.

[0120] Specifically, the encryption processing method performed once can mainly be achieved by encrypting the user password using a preset encryption algorithm to generate an encrypted string of preset length; then converting the encrypted string of preset length into an array, and concatenating the array data contained in the array in the array order to obtain an integer string.

[0121] For example, Figure 4As shown, the preset encryption algorithm used can be SHA-1 (Secure Hash Algorithm 1, a Hash algorithm). SHA-1 has high security, and the double encryption based on SHA-1 can improve security. At this time, the server can encrypt the user password according to SHA-1 to generate an encrypted string of preset length, that is, the generated encrypted string can be an encryption result composed of a preset length, such as 40 letters or numbers, such as f73926e2d2c800406660e67468c1cb8093a3b337, and then the generated string can be converted into a byte[] array, and the array data contained in the byte[] array can be spliced ​​in data order to obtain an integer string of integer type. At this time, the spliced ​​integer string can be recorded, and the generated integer string is one of the data that needs to be XORed, that is, the encryption result after one encryption process.

[0122] In the embodiment of the present invention, after obtaining the second random number and the second encryption password for updating, the update can be manifested as automatically replacing the random number and automatically generating a new encryption password through calculation to replace the encryption password in the database. The random number automatically replaced can be the second random number, and the new encryption password automatically generated can be the second encryption password. The update performed using the second random number and the second encryption password is mainly manifested as updating and replacing the first random number stored in the cache and the first encryption password stored in the database.

[0123] Among them, the second random number is stored in the cache, and the second encrypted password is stored in the database. In order to ensure that the second random number stored in the cache and the second encrypted password stored in the database can be stored correspondingly, two characters can be randomly added to the random number and the encrypted password prefix to ensure corresponding storage.

[0124] In practical applications, the same first prefix character in the first random number and the first encrypted password can be obtained, and then the first prefix character is used to determine the storage location, and the same second character prefix is ​​added to the second random number and the second encrypted password, and the first random number and the first encrypted password with the first prefix character in the storage location are replaced with the second random number and the second encrypted password with the second prefix character, respectively, to complete the update of the stored random number and the encrypted password, so that the encrypted password is not easy to be cracked, which is beneficial to improve the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements.

[0125] Step 304: Use the stored random number and encrypted password to perform login verification on subsequent user logins.

[0126] The stored random number and encrypted password can be used to verify subsequent user logins.

[0127] In one case, if the user login does not expire in step 303, there is no need to update the stored first random number and the first encrypted password. That is, the original random number and the encrypted password are retained and stored. Then, when responding to the user's login request subsequently, the first random number and the first encrypted password can continue to be used for login verification.

[0128] In another case, if the user login expires in step 303, the first random number and the first encrypted password with the first prefix character in the storage location have been replaced with the second random number and the second encrypted password with the second prefix character, respectively, to complete the update of the stored random number and the encrypted password. Then, when responding to the user's login request subsequently, the updated second random number and the second encrypted password are used for login verification.

[0129] Among them, the follow-up mentioned above can be the user's next login, but when the corresponding stored random number and encrypted password are used for login verification based on the above two situations, and the verification is successful, if the user's login request meets the preset random number update condition, that is, there is a situation where the user's login has expired, it is necessary to repeat the encryption processing process from step 301 to step 303, and re-update the stored random number and encrypted password.

[0130] Exemplarily, when updating the random number and regenerating a new encrypted password, two prefix characters can be randomly added to the new random number and the encrypted password prefix to ensure corresponding storage, and when regenerating a new encrypted password, the old encrypted password and the old random number are still stored in the database and cache. When the user logs in, first check whether the two prefix characters of the random number and the encrypted password correspond. If they correspond, the next step can be performed. If they do not correspond, the old random number and the old encrypted password can be obtained from the database and a new random number and encrypted password can be regenerated. In a preferred embodiment, when the user password is modified, since the encryption result of one processing is an encryption process for the user password, the old encrypted password in the database will also change at this time.

[0131] It should be noted that the "first" and "second" mentioned in the embodiments of the present invention do not have a clear order of precedence. The first random number and the first encryption password refer to the old random number and the old encryption password, and the second random number and the second encryption password refer to the new random number and the new encryption password. When the server responds to the Nth user login, the first random number and the first encryption password are equivalent to those used for the N-1th encryption process, and the second random number and the second encryption password can represent those used for the N+1th encryption process when the user login expires. The embodiments of the present invention do not limit this.

[0132] In the embodiment of the present invention, by automatically updating and / or replacing the random number and encryption password used for login verification, the flexibility of using the user password encryption process is increased, the encryption effect is enhanced based on its flexibility, and the encryption password is not easy to be cracked. The generated encryption password is obtained by encrypting the encryption result again based on the random number. This double encryption method is also not easy to be cracked, which is beneficial to improving the security of the data that needs to be encrypted, and is suitable for projects with high confidentiality requirements.

[0133] Reference Figure 5 , shows a schematic diagram of an application scenario of the user password encryption processing provided by an embodiment of the present invention. The user password encryption processing proposed by the embodiment of the present invention can be applied to project scenarios with high confidentiality requirements, such as password encryption protection, systems with high security requirements for users, and OA (Office Automation) systems used by multiple platforms and multiple users. Figure 5 As shown, the application is in the scenario of password encryption protection, involving a client 510 for users to perform registration operations, for users to send registration requests, for users to perform login operations, and for users to send login requests, and a server 511 for responding to users' registration requests and login requests.

[0134] In an embodiment of the present invention, a method of doubly encrypting user passwords through dynamically updated random numbers is proposed, which can further ensure the security of encrypted data through multiple encryptions and automatic replacement of random numbers, and provide dynamic update capabilities while improving the security of encrypted data.

[0135] Specifically, when a user registers a user account, the server 511 can receive a registration request sent by the client 510. The registration request sent carries the user account and the user password for this user account. In order to ensure the security in the network production process, a preset encryption algorithm can be used at this time, such as SHA-1 to encrypt the user's login password to obtain an encryption result for the user password. The encryption result obtained can be expressed as a character string of a preset length. The server can generate a random number and store it in the cache, and then convert the obtained character string into a byte[] array, and then traverse the array data contained in the array to splice an integer string of an integer type. This integer string can be used as one of the values ​​for the XOR operation. When performing secondary encryption processing, the spliced ​​integer string can be XORed with the random number in the cache, and an encrypted password can be generated after the operation. At this time, the generated encrypted password can be stored in the database.

[0136] Subsequently, each time the user logs in to the server 511 through the client 510, the user password carried in the login request can be obtained, and then the random number stored in the cache according to the user can be obtained, the user password and the obtained random number are XORed (^), and compared with the encrypted password stored in the database. A successful comparison indicates that the user has successfully logged in.

[0137] In a preferred embodiment, when a user's login expires, for example, when the time interval between the issuance time of the user's login request and the previous issuance time is too long (exceeding a preset time threshold), or when the number of login requests of the user exceeds the limit (exceeding a preset number threshold), the server will mark that the user needs to change the random number, that is, add an identification of changing the random number to the user's user account. When the user logs in to the system again, the user password must first be encrypted with SHA-1 using the current random number (referring to the random number before it was replaced), and then the random number is XORed with the concatenated integer string, and compared with the old encrypted password stored in the database. After the comparison is successful, if the user is marked as needing to change the random number, a new random number will be generated and stored in the cache to replace the old random number. The user password is then encrypted with SHA-1, and the new random number and the concatenated integer string are further XORed, and the old encrypted password stored in the database is replaced with the new XORed data, i.e., the new encrypted password, so that the new random number and the new encrypted password can be used for subsequent login verification.

[0138] The embodiment of the present invention proposes to encrypt the password based on the SHA-1 encryption algorithm, generate a random number, and then use the XOR operation for encryption, which has a strong encryption effect. It can improve security by automatically replacing the random number and the encrypted data. It can also be based on the use of double encryption, which is not easy to be cracked, thereby improving data security. It is suitable for projects with high confidentiality requirements. And its core is mainly based on plug-in implementation, which can reduce maintenance costs and shorten the development cycle.

[0139] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0140] Reference Figure 6 , shows a structural block diagram of an embodiment of a user password encryption processing device of the present invention, which is applied to a server and may specifically include the following modules:

[0141] The login request response module 601 is used to respond to the user's login request and obtain the stored first random number and first encrypted password; the first encrypted password is obtained by encrypting the encryption result of the user password based on the first random number;

[0142] The random number updating module 602 is used to obtain a second random number and a second encrypted password when the time interval between the user's login request and / or the number of the user's logins meet a preset random number update condition; the second encrypted password is obtained by encrypting the encryption result of the user's password based on the second random number;

[0143] The storage update module 603 is used to update the stored first random number and first encrypted password with the second random number and the second encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification on the user password.

[0144] In one embodiment of the present invention, before responding to the user's login request, the user password encryption processing device provided in the embodiment of the present invention may further include the following modules:

[0145] A corresponding storage module, used for correspondingly storing the first random number and the first encrypted password;

[0146] The corresponding storage module may include the following submodules:

[0147] The encryption result generating unit is used to obtain the dynamically generated first random number, and encrypt the user password using a preset encryption algorithm to obtain an encryption result for the user password;

[0148] A first encryption password generating unit, used to perform an XOR operation on the encryption result of the user password using a first random number to generate a first encryption password;

[0149] The corresponding storage unit is used to store the first random number and the first encrypted password correspondingly.

[0150] In one embodiment of the present invention, the encryption result generating unit may include the following subunits:

[0151] The encrypted string generation subunit is used to encrypt the user password using a preset encryption algorithm to generate an encrypted string of a preset length;

[0152] An array conversion subunit, used for converting an encrypted string of a preset length into an array; the array includes array data;

[0153] The data concatenation subunit is used to concatenate array data in array order to obtain an integer string.

[0154] In one embodiment of the present invention, the corresponding storage unit may include the following sub-units:

[0155] A first character prefix adding subunit, used for adding the same first character prefix to the acquired first random number and the generated first encrypted password;

[0156] The corresponding storage subunit is used to adopt the same first character prefix to correspondingly store the first random number and the first encrypted password corresponding to the first random number.

[0157] In one embodiment of the present invention, the user password encryption processing device provided in the embodiment of the present invention may further include the following modules:

[0158] The encrypted data generation module is used to respond to the user's login request, encrypt the user's password using a preset encryption algorithm to obtain an encryption result for the user's password, and then use a first random number to perform an XOR operation on the encryption result of the user's password to obtain encrypted data;

[0159] The encrypted password comparison module is used to indicate that the current user password has passed the login verification when the encrypted data is compared with the first encrypted password;

[0160] The storage module is used to retain and store the first random number and the first encrypted password after the login verification is passed based on the first random number and the first encrypted password, if the time interval between the user's login requests and / or the number of user logins do not meet the preset random number update conditions.

[0161] In one embodiment of the present invention, the preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than the preset time threshold, and / or the number of login times of the user is greater than the preset number threshold; the random number update module 602 may include the following submodules:

[0162] The identification adding submodule is used to add an identification of changing the random number to the user account of the user when the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold;

[0163] A second random number acquisition submodule, after the user passes the login verification based on the first random number and the first encrypted password, obtains a dynamically generated second random number for the user account with an identifier for changing the random number;

[0164] The second encrypted password generating submodule is used to encrypt the encryption result of the user password according to the second random number to obtain the second encrypted password.

[0165] In one embodiment of the present invention, the encryption result of the user password includes an integer string converted from an encrypted string after encrypting the user password; the second encrypted password generation submodule may include the following units:

[0166] The second encrypted password generating unit is used to perform an XOR operation on an integer string for the user password using a second random number to obtain a second encrypted password.

[0167] In one embodiment of the present invention, the storage update module 603 may include the following submodules:

[0168] A first prefix character acquisition submodule, used to acquire the first prefix character that is the same in the first random number and the first encrypted password;

[0169] A second prefix character adding submodule, used for determining a storage location using the first prefix character, and adding the same second character prefix to the second random number and the second encrypted password;

[0170] The update replacement submodule is used to replace the first random number and the first encrypted password with the first prefix character in the storage location with the second random number and the second encrypted password with the second prefix character respectively.

[0171] In an embodiment of the present invention, when the server responds to a user's login request, if the user's login request meets the preset random number update condition, the server can obtain a second random number and a second encrypted password, and use the second random number and the second encrypted password to update the originally stored first random number and the second encrypted password, so that the updated second random number and the second encrypted password can be used to perform login verification of the user's password when responding to the user's login request later. By automatically updating and / or replacing the random number and the encrypted password used for login verification, the flexibility of using the encryption processing of the user password is increased, and the encryption effect is enhanced based on its flexibility, and the encryption password is not easy to be cracked, and the generated encryption password is obtained by encrypting the encryption result again based on the random number. This double encryption method is also not easy to be cracked, which is conducive to improving the security of the data to be encrypted, and is suitable for projects with high confidentiality requirements.

[0172] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0173] An embodiment of the present invention further provides an electronic device, including:

[0174] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, each process of the above-mentioned user password encryption processing method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0175] An embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned user password encryption processing method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0176] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0177] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0178] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0179] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0180] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0181] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0182] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0183] The user password encryption processing method, the user password encryption processing device, the corresponding electronic device and the corresponding computer storage medium provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained in detail using specific examples herein. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and the scope of application. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for encrypting a user password, characterized in that: Applied to a server, the method comprises: In response to a user's login request, obtaining a stored first random number and a first encrypted password; the first encrypted password is obtained by encrypting an encryption result of the user password based on the first random number; When the user's login request meets the preset random number update condition, a second random number and a second encrypted password are obtained; the second encrypted password is obtained by encrypting the encryption result of the user password based on the second random number; Using the second random number and the second encrypted password to update the stored first random number and the first encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification on the user password; The preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold; When the login request of the user meets the preset random number update condition, obtaining the second random number and the second encrypted password includes: If the time interval between the issuance time of the login request of the user and the previous issuance time is greater than a preset time threshold, and / or the number of logins of the user is greater than a preset number threshold, an indicator of changing the random number is added to the user account of the user; After the login verification is passed based on the first random number and the first encrypted password, a dynamically generated second random number is obtained for the user account having an identifier for changing the random number; Encrypting the encryption result of the user password according to the second random number to obtain a second encrypted password; The updating of the stored first random number and the first encrypted password by using the second random number and the second encrypted password comprises: Obtaining a first prefix character that is the same in the first random number and the first encrypted password; Using the first prefix character to determine a storage location, and adding the same second character prefix to the second random number and the second encrypted password; The first random number and the first encrypted password having the first prefix character in the storage location are replaced with the second random number and the second encrypted password having the second prefix character respectively.

2. The method according to claim 1, characterized in that Also includes: In response to a login request from a user, encrypt the user password using a preset encryption algorithm to obtain an encryption result for the user password, and perform an XOR operation on the encryption result of the user password using the first random number to obtain encrypted data; If the encrypted data is compared with the first encrypted password and passes, it means that the current user password has passed the login verification; After passing the login verification based on the first random number and the first encrypted password, if the time interval between the user's login requests and / or the number of logins of the user do not meet the preset random number update conditions, the first random number and the first encrypted password are retained and stored.

3. The method according to claim 1, characterized in that The encryption result for the user password includes an integer string converted from an encrypted character string after encrypting the user password; The step of encrypting the encryption result of the user password according to the second random number to obtain a second encrypted password includes: The second random number is used to perform an XOR operation on the integer string for the user password to obtain a second encrypted password.

4. The method according to claim 1, characterized in that: Before responding to the user's login request, the method further includes: Correspondingly storing the first random number and the first encrypted password; The corresponding storage of the first random number and the first encrypted password includes: Obtaining a dynamically generated first random number, and encrypting the user password using a preset encryption algorithm to obtain an encryption result for the user password; Using the first random number to perform an XOR operation on the encryption result of the user password to generate the first encrypted password; The first random number and the first encrypted password are stored correspondingly.

5. The method according to claim 2 or 4, characterized in that: The method of encrypting the user password using a preset encryption algorithm to obtain an encryption result for the user password includes: Encrypting the user password using a preset encryption algorithm to generate an encrypted string of preset length; Converting the encrypted string of the preset length into an array; the array includes array data; The array data is concatenated in array order to obtain an integer string.

6. The method according to claim 4, characterized in that The corresponding storage of the first random number and the first encrypted password includes: Adding the same first character prefix to the obtained first random number and the generated first encrypted password; The same first character prefix is ​​used to store a first random number and a first encrypted password corresponding to the first random number.

7. A user password encryption processing device, characterized in that: Applied to a server, the device comprises: A login request response module, used to respond to a user's login request and obtain a stored first random number and a first encrypted password; the first encrypted password is obtained by encrypting an encryption result of the user password based on the first random number; A random number update module, configured to obtain a second random number and a second encrypted password when the user's login request meets a preset random number update condition; the second encrypted password is obtained by encrypting the encryption result of the user password based on the second random number; A storage update module, used to update the stored first random number and first encrypted password with the second random number and the second encrypted password, so as to use the updated second random number and the second encrypted password to perform login verification for the user password; The preset random number update condition includes that the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold; The random number update module includes the following submodules: An identification adding submodule, used for adding an identification of changing a random number to the user account of the user when the time interval between the issuance time of the user's login request and the previous issuance time is greater than a preset time threshold, and / or the number of login times of the user is greater than a preset number threshold; A second random number acquisition submodule, after the login verification is passed based on the first random number and the first encrypted password, acquires a dynamically generated second random number for the user account with an identifier for changing the random number; A second encrypted password generating submodule, configured to encrypt the encryption result of the user password according to the second random number to obtain a second encrypted password; The storage update module includes the following submodules: A first prefix character acquisition submodule, used to acquire the first prefix character that is the same in the first random number and the first encrypted password; a second prefix character adding submodule, configured to determine a storage location using the first prefix character, and to add the same second character prefix to the second random number and the second encrypted password; The update replacement submodule is used to replace the first random number and the first encrypted password with the first prefix character in the storage location with the second random number and the second encrypted password with the second prefix character respectively.

8. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the user password encryption processing method as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the user password encryption processing method as claimed in any one of claims 1 to 6 are implemented.

Images