Data updating method and device, server and storage medium

Abstract

The application discloses a data updating method and device, a server and a storage medium. The method comprises the following steps: a server receives a first request sent by a terminal, wherein the first request is used for requesting to check first data; the first data is checked by using a first hash result of the first data in a database, and a checking result is obtained; in the case that the checking result represents that the checking is passed, first information and second information are compared, and a comparison result is obtained, wherein the first information represents a hash rule used when the server performs hash operation; the second information represents a hash rule used when the first hash result is generated; in the case that the comparison result represents that the first information and the second information are inconsistent, the hash result of the first data in the database is updated based on the first information. The scheme provided in the application can automatically update the hash result.

Description

Technical Field

[0001] This application relates to the field of data processing, and more particularly to a data updating method, apparatus, server, and storage medium. Background Technology

[0002] When verifying the identity information of a terminal, such as its account password, the hash result of that identity information is required. The hash result is obtained by the server performing a hash operation on the identity information according to pre-configured hash rules and then storing the data in the database. To improve verification performance, the hash rules configured on the server are updated. When the hash rules configured on the server change, the hash result stored in the database needs to be updated using the updated hash rules.

[0003] However, in related technologies, the hash results cannot be updated automatically, which affects the server's verification performance and thus reduces the user experience. Summary of the Invention

[0004] To address the related technical problems, embodiments of the present invention provide a data update method, apparatus, server, and storage medium.

[0005] The technical solution of this invention is implemented as follows:

[0006] This application provides a data update method applied to a server, including:

[0007] The receiving terminal sends a first request, which is used to request the verification of the first data;

[0008] The first data is verified using the first hash result of the first data in the database to obtain the verification result;

[0009] If the verification result indicates that the verification is successful, the first information and the second information are compared to obtain a comparison result. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result.

[0010] If the comparison results indicate that the first information and the second information are inconsistent, the hash result of the first data in the database is updated based on the first information.

[0011] In the above scheme, the step of using the first hash result of the first data in the database to verify the first data and obtain the verification result includes:

[0012] Determine the second information;

[0013] Based on the second information, a hash operation is performed on the first data to obtain the hash operation result;

[0014] The hash operation result is compared with the first hash result of the first data in the database to obtain the comparison result;

[0015] Based on the comparison results, the verification results are obtained.

[0016] In the above scheme, updating the first hash result based on the first information includes:

[0017] Based on the first information, a hash operation is performed on the first data to obtain a second hash result;

[0018] The hash result of the first data in the database is updated using the second hash result.

[0019] In the above scheme, the step of performing a hash operation on the first data based on the first information to obtain a second hash result includes:

[0020] Based on the first information, a hash operation is performed on the first data to obtain a third hash result;

[0021] Based on the third information, the third hash result is encapsulated to obtain the second hash result. The third information represents the encapsulation rule corresponding to the hash operation using the first information.

[0022] The method in the above scheme further includes:

[0023] Obtain the relationship between hash rules and encapsulation rules;

[0024] Based on the first information and the aforementioned relationship, the third information is determined.

[0025] The method in the above scheme further includes:

[0026] Update the first information.

[0027] In the above scheme, updating the first information includes:

[0028] The hash rule used by the server when performing hash operations is determined from at least one set of preset hash rules;

[0029] The first information is updated based on the determined hash rule.

[0030] This application also provides a data update device, including:

[0031] A receiving unit is configured to receive a first request sent by a terminal, wherein the first request is used to request verification of first data.

[0032] The verification unit is used to verify the first data using the first hash result of the first data in the database, and obtain the verification result;

[0033] The comparison unit is used to compare the first information and the second information to obtain a comparison result if the verification result indicates that the verification has passed. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result.

[0034] An update unit is configured to update the hash result of the first data in the database based on the first information when the comparison result indicates that the first information and the second information are inconsistent.

[0035] This application also provides a server, including: a processor and a memory for storing computer programs capable of running on the processor.

[0036] When the processor runs the computer program, it executes the steps of any of the above methods.

[0037] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the above methods.

[0038] The data update method, apparatus, server, and storage medium provided in this application embodiment involve a server receiving a first request from a terminal, the first request being used to request verification of first data; using a first hash result of the first data in a database to verify the first data, obtaining a verification result; if the verification result indicates that the verification passed, comparing first information and second information to obtain a comparison result, where the first information represents the hash rule used by the server when performing the hash operation; and the second information represents the hash rule used to generate the first hash result; if the comparison result indicates that the first information and the second information are inconsistent, updating the hash result of the first data in the database based on the first information. The solution provided in this application embodiment allows the server to automatically update the hash result when verifying the terminal's identity using the hash result. Since it does not need to wait for the user to actively trigger a password change before updating, the hash result can be updated promptly, thereby improving the server's verification efficiency and ultimately enhancing the user experience. Attached Figure Description

[0039] Figure 1 This is a schematic diagram of the certification process in related technologies;

[0040] Figure 2This is a flowchart illustrating the process of Keystone server managing hash results in related technologies.

[0041] Figure 3 This is a schematic diagram of the data update method in an embodiment of this application;

[0042] Figure 4 This is a flowchart illustrating the process of cracking hash results in related technologies;

[0043] Figure 5 This is a flowchart illustrating the method for updating the hash result in the application example of this application.

[0044] Figure 6 This is a schematic diagram of the data update device structure according to an embodiment of this application;

[0045] Figure 7 This is a schematic diagram of the server structure in an embodiment of this application. Detailed Implementation

[0046] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0047] In cloud computing applications, OpenStack is a powerful, open-source cloud management platform that supports various virtualization technologies, such as Xen, KVM, and VMware. OpenStack coordinates key components like compute, storage, and networking to accomplish specific tasks and provides scalable and elastic cloud services for both private and public clouds. Its core cloud services include compute, networking, storage, identity, and image services. The Keystone server, a core component of OpenStack, provides authentication and authorization services for components like Glance, Cinder, and Nova. Only after successful authentication can service requests be processed and responded to. Therefore, authentication is fundamental to other services, and the functionality and performance of the Keystone server have a crucial impact on other components within the cloud platform. Figure 1As shown, during the process of a user sending service requests to the Nova and Glance components, the user first sends credentials to the Keystone server. These credentials are used by the Keystone server to verify the user's identity information, such as username and password. The Keystone server verifies the user's identity based on the received credentials and assigns a token to the user upon successful verification. Using the token assigned by the Keystone server, the user can initiate service requests to the Nova and Glance components and receive responses. In other words, the Keystone server provides relevant authentication and authorization for the Glance and Nova components. Only after successful authentication can the corresponding service requests be processed and responded to. During this process, the Keystone server needs to retrieve the hash result of the user's identity information from the database and use the retrieved hash result to verify the user's identity.

[0048] The hash results in the database are generated by the Keystone server based on the terminal's identity information. Specifically, the Keystone server performs hash calculations on the terminal's identity information using hash rules in the backend configuration file to generate hash results; this process can also be referred to as user creation. The hash rule format is "hash algorithm + number of hash rounds," meaning it includes the hash algorithm used and the number of rounds performed. For example, a hash rule of "bcrypt+rounds_7" indicates that the bcrypt hash algorithm is used for seven hash operations. When the Keystone server verifies the terminal's identity information, it retrieves the corresponding hash result from the database, determines the hash rule used to generate the hash result based on the prefix of the hash result, and then uses the determined hash rule to verify the terminal's identity information.

[0049] For example, such as Figure 2 As shown, the Keystone server creates the account user-1 and generates a password for user-1, which is the hash result of user-1. The hash result is prefixed with $2b$05$. The generated password is then stored in the database. When the terminal provides a credential request to obtain a token, the Keystone server receives the account user-1 and the password string pwd-1 contained in the credential. The Keystone server retrieves the hash result of user-1 from the database based on the account, determines the corresponding hash rule based on the hash result prefix, and verifies the password string pwd-1 according to the determined hash rule.

[0050] In related technologies, the Keystone server updates its configured hash rules to improve verification performance, such as reducing the total time for creating virtual machines or the time spent creating multiple virtual machines concurrently. However, when the hash rules are modified, the Keystone server only uses the new hash rules to generate hash results for newly created users—terminals whose corresponding hash results are not stored in the database. For existing users in the system—terminals whose corresponding hash results are already stored in the database—the Keystone server's backend configuration files are usually not perceived by the terminals, and the Keystone server currently lacks a mechanism to notify the terminals of modified backend configurations. Therefore, when the hash rules configured in the Keystone server are modified, the hash results stored in the database for existing users do not automatically change, resulting in the verification process for existing users remaining the same in time. Furthermore, even if a new hash rule is currently used to generate hash results for newly created users, when the configured hash rules are updated again, the new user will become an existing user, and the currently generated hash result cannot be updated based on the updated hash rules.

[0051] For existing users, the Keystone server only updates the hash result of the terminal's identity information in the database when the terminal actively triggers a password change, i.e., requests to change the original password to a new one. Specifically, based on the new identity information submitted by the terminal, a new hash result is generated using the new hash rules currently configured on the server, and this new hash result replaces the original hash result in the database, thus completing the hash result update. Conversely, when the terminal does not actively trigger a password change, the hash result in the database remains unchanged. However, this update method cannot update the hash result in the database in a timely manner, thus affecting the verification efficiency of the Keystone server.

[0052] Based on this, in various embodiments of this application, when the server uses the hash result to verify the identity of the terminal, it can automatically update the hash result. Since it does not need to wait for the user to actively trigger the password change before updating, the hash result can be updated in a timely manner, thereby improving the server's verification efficiency and thus improving the user experience.

[0053] This application provides a data update method applied to a server, such as... Figure 3 As shown, the method includes:

[0054] Step 301: Receive a first request sent by the terminal, the first request being used to request verification of the first data;

[0055] Step 302: Use the first hash result of the first data in the database to verify the first data and obtain the verification result;

[0056] Step 303: If the verification result indicates that the verification is successful, compare the first information and the second information to obtain a comparison result. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result.

[0057] Step 304: If the comparison result indicates that the first information and the second information are inconsistent, update the hash result of the first data in the database based on the first information.

[0058] In practical applications, the hash result can also be called a hash result string, and the hash rule can also be called a hash combination. This application does not limit this, as long as its function can be achieved.

[0059] The server can be understood as a server used for identity authentication, and specifically, it may include the keystone server used in OpenStack.

[0060] The first data may include the terminal's identity information; specifically, it may include the terminal's password string. For example, the first data may be the terminal's credentials, which contain the terminal's account and password; the first data may be carried in the first request.

[0061] In practical applications, step 302, where the first data is verified using its first hash result in the database to obtain a verification result, can be understood as follows: The hashing rule used to generate the first hash result is determined based on its prefix; the terminal's identity information is hashed according to the determined hashing rule; and the result of the hashing operation is compared with the first hash result. If the comparison result indicates that the hashing operation result matches the first hash result, the verification passes; otherwise, the verification fails. In the event of a verification failure, the server can notify the terminal by returning a 401 status code, etc.

[0062] In practical applications, after the verification is successful, the server will verify whether the hash result of the terminal's identity information in the database is generated using the latest configured hash rule. Before the server performs the verification, the server needs to first determine the hash rule corresponding to the hash result in the database and the latest configured hash rule in the server.

[0063] Based on this, in one embodiment, the method may further include:

[0064] Determine the first information and the second information.

[0065] Here, when the hash rule corresponding to the hash result in the database is completely consistent with the latest configured hash rule in the server, specifically, when the hash algorithm and the number of hash rounds used are exactly the same, that is, when the first information and the second information are consistent, it indicates that the hash result in the database was generated using the latest configured hash rule and does not need to be updated; correspondingly, when the hash rule corresponding to the hash result in the database is inconsistent with the latest configured hash rule in the server, specifically, when the hash algorithm and the number of hash rounds used are not exactly the same, that is, when the first information and the second information are inconsistent, it indicates that the hash result in the database was not generated using the latest configured hash rule and needs to be updated.

[0066] In practical applications, the first information can be pre-configured in the server, while the second information can be determined based on the hash results stored in the database. Specifically, the hash results of the terminal identity information stored in the database can be obtained first, the prefix of the hash results can be determined, i.e., the prefix of the first hash result, and then the hash rule used to generate the hash result can be determined based on the association between the prefix and the hash rule, i.e., the second information can be determined.

[0067] In practical applications, the hash results in the database are updated, which means that the latest hash rules configured in the server are used to perform hash calculations on the terminal's identity information.

[0068] Therefore, in one embodiment, updating the first hash result based on the first information includes:

[0069] Based on the first information, a hash operation is performed on the first data to obtain a second hash result;

[0070] The hash result of the first data in the database is updated using the second hash result.

[0071] In practical application, updating the hash result of the first data in the database using the second hash result means replacing the hash result of the first data in the database with the second hash result. Specifically, the second hash result is stored in the database, and the first hash result stored in the database is deleted.

[0072] In this embodiment, since it is not necessary to modify the terminal's identity information, that is, it is not necessary to remind the user to change the password, nor is it necessary for the user to actively trigger the password change, the purpose of updating the hash result in the database can be achieved without affecting the user experience.

[0073] In practical applications, the server performs a hash operation on the terminal's identity information. This can be understood as the server encrypting the terminal's identity information using a hash algorithm to generate a hash result. The prefix of the hash result carries the mapping information of the hash rule; that is, the hash result carries a prefix corresponding to the hash rule, with a one-to-one mapping between the prefix and the hash rule. Programmers can easily obtain the mapping relationship between the prefix and the hash rule, and determine the corresponding hash rule based on the prefix of the hash result and the mapping relationship. For example, programmers familiar with the passlib package can clearly determine that a hash result prefix of "$2b$05$" represents "bcrypt hash algorithm + 5 hash rounds"; a hash result prefix of "$pbkdf2-sha512$3500$" represents "pbkdf2-sha512 hash algorithm + 3500 hash rounds". In this case, when the database is compromised by a hacker, leading to data leakage, the hacker can easily obtain the terminal account and the hash result of that account, and can determine the corresponding hash algorithm and hash rounds based on the hash result. Although hash algorithms are irreversible, such as the one-way hash algorithm in Python's standard library passlib, making it difficult to crack the hash result, if a hacker knows which hash algorithm is used and how many rounds of hashing are employed, they can clearly identify the direction of their attack and easily crack the hash result.

[0074] For example, such as Figure 4As shown, after a hacker breaches the database, they can obtain the hash result pwd-hashed of user-1 in the database. By examining the prefix of the hash result, they can confirm the hash algorithm hash_algorithm1 and the number of hash rounds n used to generate the hash result pwd-hashed. Once the hash algorithm and the number of hash rounds are obtained, the hash algorithm can be used to continuously perform hash operations on various possible password combinations for the corresponding number of hash rounds to obtain the hash result. That is, assuming that user-1's password pwd is possible_pwd1, hashing pwd will yield the hash result re. s, where the hash result res can be represented as res = hash_algorithm1.encrypt(pwd, rounds = n); verify whether the hash result res obtained after hashing is consistent with pwd-hashed; when the verification result res is consistent with pwd-hashed, it means that the cracking is successful, and possible_pwd1 is the user's password; when the verification result is inconsistent, pwd is modified to another possible password possible_pwd2 and the hash operation is performed again until the verification result res is consistent with pwd-hashed.

[0075] To address the aforementioned issues, this application embodiment further encapsulates the prefix portion of the hash result. In this way, even if data in the database is leaked, hackers cannot directly obtain the corresponding hash rules from the hash result, further complicating the cracking process and increasing the difficulty of cracking the hash result, thereby enhancing the security of the database.

[0076] Based on this, in one embodiment, the step of performing a hash operation on the first data based on the first information to obtain a second hash result includes:

[0077] Based on the first information, a hash operation is performed on the first data to obtain a third hash result;

[0078] Based on the third information, the third hash result is encapsulated to obtain the second hash result. The third information represents the encapsulation rule corresponding to the hash operation using the first information.

[0079] Here, the encapsulation can also be called custom encapsulation, and this application embodiment does not limit it, as long as its function can be achieved. The encapsulation of the third hash result can be understood as encapsulating the prefix of the third hash result. Specifically, according to the hash rule used when generating the third hash result, the corresponding encapsulation rule is determined, and the prefix of the third hash result is encapsulated using the determined encapsulation rule.

[0080] In this embodiment, since the generated hash result is custom-encapsulated, even if the database is leaked and a hacker obtains the hash result from the database, it is still difficult to crack the hash result because the hacker does not know the encapsulation rules, thereby improving the security of the hash result in the database.

[0081] In practical applications, to improve the security of the encapsulation results, an association between encapsulation rules and hash rules can be established, enabling the server to determine the relevant encapsulation rules based on the association.

[0082] Based on this, in one embodiment, the method may further include:

[0083] Obtain the relationship between hash rules and encapsulation rules;

[0084] Based on the first information and the aforementioned relationship, the third information is determined.

[0085] In practical applications, the association between the hash rules and the encapsulation rules can be pre-configured in the server, specifically in the server's backend configuration file.

[0086] In practical applications, the performance of verification can vary significantly depending on the hash rules used; for example, the verification time may differ. For instance, on a physical machine configured with two Intel(R) Xeon(R) CPU E5-2650 processors and deployed with 12 cores and 48 threads, the verification time using different hash rules is shown in Table 1:

[0087] bcrypt+rounds_7 ＜0.1s bcrypt+rounds_12 ＞0.4s scrypt+rounds_12 ＜0.1s scrypt+rounds_16 ＞0.4s pbkdf2_sha512+rounds_3500 ＜0.1s pbkdf2_sha512+rounds_40000 ＞0.4s

[0088] Table 1

[0089] As shown in Table 1, different hash algorithms or hash rounds in the hash rules can significantly affect the time required to verify and obtain the token. For example, the time difference between hash rule "bcrypt+rounds_7" and hash rule "bcrypt+rounds_12" is more than 0.3 seconds. Furthermore, as server performance decreases, the time difference between different hash rules becomes even more pronounced. Therefore, to improve verification performance, the hash rules configured in the server will be modified as needed.

[0090] Based on this, in one embodiment, the method may further include:

[0091] Update the first information.

[0092] In practical applications, the hash rules configured in the server can be updated periodically, i.e., the first information can be updated periodically. Alternatively, the update time can be determined based on the hash rules configured in the server, for example, based on the cracking cycle of the hash rules configured in the server. This improves the server's verification performance while further enhancing the security of the hash results. For instance, suppose a hacker needs 10 days to crack a fixed hash algorithm, and the update cycle of the hash rules configured in the server is 7 days. Thus, before the hacker successfully cracks the algorithm, the hash rules corresponding to the hash results in the database have already changed, forcing the hacker to restart the cracking process.

[0093] In practical applications, several sets of efficient hash rules, i.e. rules with high verification performance, can be pre-configured. When the hash rules configured in the server are updated, they are selected from the configured efficient hash rules, so that the server can maintain high verification performance.

[0094] Based on this, in one embodiment, updating the first information includes:

[0095] The hash rule used by the server when performing hash operations is determined from at least one set of preset hash rules;

[0096] The first information is updated based on the determined hash rule.

[0097] It is known that for the same hash algorithm, the larger the number of hash rounds, the more secure the encrypted hash result; however, the verification process also takes longer, thus affecting the user experience. Therefore, in practical applications, the preset hash rules can be configured while considering both hash result security and verification efficiency. For example, the preset set of hash rules can include at least one of "bcrypt+rounds_5", "bcrypt+rounds_7", "scrypt+rounds_12", and "pbkdf2_sha512+rounds_3500".

[0098] In practical applications, a set of hash rules can be randomly selected periodically from at least one set of preset hash rules as the hash rules used by the server when performing hash operations. The random selection period can be determined according to the specific usage situation. For example, a period of 7 days can be determined according to the cracking time of the preset hash rules. This application does not limit this.

[0099] The data update method provided in this application embodiment involves a server receiving a first request from a terminal, the first request being used to request verification of first data; verifying the first data using a first hash result of the first data in a database to obtain a verification result; if the verification result indicates that the verification passed, comparing first information and second information to obtain a comparison result, where the first information represents the hash rule used by the server when performing the hash operation; and the second information represents the hash rule used to generate the first hash result; if the comparison result indicates that the first information and the second information are inconsistent, updating the hash result of the first data in the database based on the first information. The solution provided in this application embodiment allows the server to automatically update the hash result when verifying the terminal's identity using the hash result. Since it does not need to wait for the user to actively trigger a password change before updating, the hash result can be updated promptly, thereby improving the server's verification efficiency and ultimately enhancing the user experience.

[0100] At the same time, because the generated hash results are further encapsulated, even if the database is leaked and hackers obtain the hash results in the database, they will still find it difficult to crack the hash results because they do not know the encapsulation rules, thus improving the security of the hash results in the database.

[0101] The following section provides a more detailed description of this application with reference to application examples.

[0102] like Figure 5 As shown, the hash result update method provided in the application example of this application includes:

[0103] Step 501: The terminal sends an authentication request, which means the server receives the first request sent by the terminal. The first request is used to request the verification of the first data.

[0104] Here, the authentication request carries the terminal's user account and password string.

[0105] Step 502: After receiving the authentication request, the Keystone server performs authentication on the terminal based on the original hash result, that is, it verifies the terminal's password string based on the original hash result. If the verification passes, it executes step 503. If the verification fails, it terminates the current processing flow and sends a 401 status code to the terminal. In other words, it uses the first hash result of the first data in the database to verify the first data and obtain the verification result. If the verification result indicates that the verification has passed, it compares the first information and the second information.

[0106] Here, the original hash result is the hash result in the database. The Keystone server retrieves the corresponding hash result from the database based on the user account, and determines the hash algorithm used to generate the hash result based on the prefix of the retrieved hash result. When verifying the password of the terminal, the determined hash algorithm is used for verification.

[0107] Step 503: The keystone server obtains the latest configured hash combination, which is to determine the first piece of information;

[0108] Here, the latest hash combinations are pre-configured in the keystone server.

[0109] Step 504: The keystone server obtains the original hash combination, that is, obtains the hash combination used to generate the original hash result, which is to determine the second information;

[0110] Here, the Keystone server obtains the original hash combination based on the original hash result. Specifically, it obtains the prefix of the original hash result and, based on the association between the prefix and the hash rule, obtains the hash combination used by the original hash result, namely the original hash algorithm and the original hash round number.

[0111] Step 505: Compare the original hash combination with the latest configured hash combination, that is, compare the first information and the second information; if the comparison result shows that the original hash combination and the latest configured hash combination are consistent, no processing is done on the original hash result; if the comparison result shows that the original hash combination and the latest configured hash combination are inconsistent, proceed to step 506.

[0112] Step 506: Based on the latest configured hash combination, perform hash encryption on the password string provided by the terminal to generate a new hash result, and further encapsulate the prefix part of the new hash result to obtain the encapsulated hash result. That is, based on the password string provided by the user, use the newly configured hash combination to generate a new hash result and encapsulate its prefix. In other words, based on the first information, perform a hash operation on the first data to obtain the second hash result.

[0113] Here, the hash combination and the association between the hash combination and the encapsulation rule are pre-configured in the Keystone server. Before encapsulation, the Keystone server determines the encapsulation rule corresponding to the pre-configured hash combination based on the pre-configured association. In other words, the database only stores the encapsulated hash result, while the encapsulation rule is controlled by the Keystone server. Thus, even if a hacker obtains the hash result in the database, they cannot easily obtain the hash rule corresponding to the hash result because they do not know the encapsulation rule, thereby increasing the difficulty of cracking the hash result.

[0114] Step 507: Update the original hash result using the encapsulated hash result, that is, update the hash result of the user in the database to the new encapsulated hash result.

[0115] Steps 503 to 507 describe the process by which the Keystone server updates the hash result.

[0116] The latest hash combination used during the update process is pre-configured in the Keystone server; the process of configuring the hash combination in the Keystone server includes:

[0117] Step 508: Define the prefix encapsulation rules for the hash results and set efficient hash combinations;

[0118] Here, the process of defining the prefix encapsulation rules is essentially the process of establishing the association between hash combinations and prefix encapsulation combinations. Once established, this association is configured in the Keystone server. Defining the hash combination and prefix encapsulation rules allows for custom encapsulation of the "hash string prefix" according to a mapping relationship with "hash algorithm + hash round number," distinguishing it from the one-to-one mapping relationship between "hash string prefix" and "hash algorithm + hash round number" in related technologies. Therefore, even in the event of a database leak, hackers cannot easily obtain the hash rules corresponding to the hash result from the hash result, i.e., they cannot easily know the hash algorithm and hash round number, increasing the difficulty for hackers to crack the hash result.

[0119] This involves setting up efficient hash combinations, which means selecting several hash combinations with good verification performance as alternative hash combinations. The hash combination updated to the Keystone server will be selected from these selected hash combinations, thereby ensuring the verification performance of the Keystone server. Specifically, the efficient hash combinations include "bcrypt+rounds_5", "bcrypt+rounds_7", "scrypt+rounds_12", and "pbkdf2_sha512+rounds_3500".

[0120] Step 509: Periodically select a set of hash combinations from the set efficient hash combinations and update the Keystone backend configuration, that is, determine the hash rule used by the server when performing hash operations from at least one set of preset hash rules;

[0121] Here, the Keystone server will maintain a module that regularly updates the Keystone backend configuration. This module will periodically select a set of hash combinations from the configured efficient hash combinations and update the Keystone backend configuration with the selected hash combinations.

[0122] The hash result update method provided in this application example supports periodic random updates to the hash combinations configured in the Keystone backend, and promptly updates the hash results of all users in the database based on the updated hash combinations. This enables timely updates to the hash results in the database. Since users do not need to actively trigger password changes, the user experience is improved, and the original password string can be used directly when updating the hash results. Furthermore, the updated hash combinations are highly efficient for verification, thus improving the verification efficiency of the Keystone server. Since the Keystone server's authentication service serves as the foundation for other services, all servers interacting with the Keystone server authenticate based on Keystone. Therefore, the solution provided in this application example can flexibly improve the authentication response performance between the Keystone server and other servers.

[0123] Meanwhile, by further encapsulating the prefix information in the hash result, even if a hacker obtains the hash result from the database, it is difficult for them to know the hash rule of the hash result without mastering the encapsulation rule. This increases the difficulty for hackers to crack the hash result and thus improves the security of the hash result.

[0124] To implement the method of this application embodiment, this application embodiment also provides a data update device, which is set on a server, specifically a Keystone server, such as... Figure 6 As shown, the device includes:

[0125] The receiving unit 601 is used to receive a first request sent by the terminal, wherein the first request is used to request verification of the first data;

[0126] The verification unit 602 is used to verify the first data using the first hash result of the first data in the database, and obtain the verification result.

[0127] The comparison unit 603 is used to compare the first information and the second information to obtain a comparison result if the verification result indicates that the verification is passed. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result.

[0128] The update unit 604 is used to update the hash result of the first data in the database based on the first information when the comparison result indicates that the first information and the second information are inconsistent.

[0129] In one embodiment, the comparison unit 603 is further configured to:

[0130] Determine the first information and the second information.

[0131] In one embodiment, the update unit 604 is used for:

[0132] Based on the first information, a hash operation is performed on the first data to obtain a second hash result;

[0133] The hash result of the first data in the database is updated using the second hash result.

[0134] In one embodiment, the update unit 604 is specifically used for:

[0135] Based on the first information, a hash operation is performed on the first data to obtain a third hash result;

[0136] Based on the third information, the third hash result is encapsulated to obtain the second hash result. The third information represents the encapsulation rule corresponding to the hash operation using the first information.

[0137] In one embodiment, the update unit 604 is further configured to:

[0138] The receiving unit 601 is used to obtain the association between the hash rule and the encapsulation rule;

[0139] Based on the first information and the aforementioned relationship, the third information is determined.

[0140] In one embodiment, the update unit 604 is further configured to:

[0141] Update the first information.

[0142] In one embodiment, the update unit 604 is specifically used for:

[0143] The hash rule used by the server when performing hash operations is determined from at least one set of preset hash rules;

[0144] The first information is updated based on the determined hash rule.

[0145] In practical applications, the receiving unit 601 can be implemented by the communication interface in the data update device, and the verification unit 602, comparison unit 603, and update unit 604 can be implemented by the processor in the data update device.

[0146] It should be noted that the data update device provided in the above embodiments is only illustrated by the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the data update device and data update method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0147] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide a server, such as... Figure 7 As shown, the server 700 includes:

[0148] The communication interface 701 is capable of exchanging information with a terminal and a database; for example, receiving a first request sent by the terminal, and updating the hash result of the first data in the database based on the first information.

[0149] The processor 702 is connected to the communication interface 701 to enable information interaction with the terminal and the database, and to execute the methods provided by one or more of the above technical solutions when running a computer program;

[0150] The computer program is stored in the memory 703.

[0151] Specifically, the communication interface 701 is used to receive a first request sent by the terminal, the first request being used to request verification of the first data;

[0152] The processor 702 is configured to verify the first data using the first hash result of the first data in the database to obtain a verification result; if the verification result indicates that the verification is successful, it compares the first information and the second information to obtain a comparison result, wherein the first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result; if the comparison result indicates that the first information and the second information are inconsistent, it updates the hash result of the first data in the database based on the first information.

[0153] In one embodiment, the processor 702 is further configured to:

[0154] Determine the first information and the second information.

[0155] In one embodiment, the processor 702 is configured to:

[0156] Based on the first information, a hash operation is performed on the first data to obtain a second hash result;

[0157] The hash result of the first data in the database is updated using the second hash result.

[0158] In one embodiment, the processor 702 is specifically used for:

[0159] Based on the first information, a hash operation is performed on the first data to obtain a third hash result;

[0160] Based on the third information, the third hash result is encapsulated to obtain the second hash result. The third information represents the encapsulation rule corresponding to the hash operation using the first information.

[0161] In one embodiment, the processor 702 is further configured to:

[0162] The association between hash rules and encapsulation rules is obtained using the communication interface 701;

[0163] Based on the first information and the aforementioned relationship, the third information is determined.

[0164] In one embodiment, the processor 702 is further configured to:

[0165] Update the first information.

[0166] In one embodiment, the processor 702 is specifically used for:

[0167] The hash rule used by the server when performing hash operations is determined from at least one set of preset hash rules;

[0168] The first information is updated based on the determined hash rule.

[0169] It should be noted that the specific processing procedures of the processor 702 and the communication interface 701 can be understood by referring to the above method.

[0170] Of course, in practical applications, the various components in server 700 are coupled together through bus system 704. It can be understood that bus system 704 is used to implement communication between these components. In addition to the data bus, bus system 704 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general designated all buses as Bus System 704.

[0171] The memory 703 in this embodiment is used to store various types of data to support the operation of the server 700. Examples of such data include any computer program used to operate on the server 700.

[0172] The methods disclosed in the embodiments of this application can be applied to, or implemented by, the processor 702. The processor 702 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry of the hardware in the processor 702 or by instructions in software form. The processor 702 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 702 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically in memory 703. The processor 702 reads information from memory 703 and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0173] In an exemplary embodiment, server 700 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned methods.

[0174] It is understood that the memory (memory 703) in this embodiment of the application can be volatile memory or non-volatile memory, or both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); the magnetic surface memory can be disk storage or magnetic tape storage. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0175] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 703 storing a computer program, which can be executed by the processor 702 of the server 700 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0176] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0177] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0178] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention.

Claims

1. A data update method, characterized in that, Applied to servers, including: The receiving terminal sends a first request, which is used to request the verification of the first data; The first data is verified using the first hash result of the first data in the database to obtain the verification result; If the verification result indicates that the verification is successful, the first information and the second information are compared to obtain a comparison result. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result. If the comparison results indicate that the first information and the second information are inconsistent, the hash result of the first data in the database is updated based on the first information. The step of updating the hash result of the first data in the database based on the first information includes: Based on the first information, a hash operation is performed on the first data to obtain a second hash result; Update the hash result of the first data in the database using the second hash result; The step of performing a hash operation on the first data based on the first information to obtain a second hash result includes: Based on the first information, a hash operation is performed on the first data to obtain a third hash result; Based on the third information, the third hash result is encapsulated to obtain the second hash result, wherein the third information represents the encapsulation rule corresponding to the hash operation using the first information. The method further includes: Obtain the relationship between hash rules and encapsulation rules; Based on the first information and the aforementioned relationship, the third information is determined.

2. The method according to claim 1, characterized in that, The step of verifying the first data using the first hash result of the first data in the database to obtain a verification result includes: Determine the second information; Based on the second information, a hash operation is performed on the first data to obtain the hash operation result; The hash operation result is compared with the first hash result of the first data in the database to obtain the comparison result; Based on the comparison results, the verification results are obtained.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Update the first information.

4. The method according to claim 3, characterized in that, Updating the first information includes: The hash rule used by the server when performing hash operations is determined from at least one set of preset hash rules; The first information is updated based on the determined hash rule.

5. A data update device, characterized in that, include: A receiving unit is configured to receive a first request sent by a terminal, wherein the first request is used to request verification of first data. The verification unit is used to verify the first data using the first hash result of the first data in the database, and obtain the verification result; The comparison unit is used to compare the first information and the second information to obtain a comparison result if the verification result indicates that the verification has passed. The first information represents the hash rule used by the server when performing the hash operation; the second information represents the hash rule used to generate the first hash result. An update unit is configured to update the hash result of the first data in the database based on the first information when the comparison result indicates that the first information and the second information are inconsistent; wherein, the update unit is specifically configured to: perform a hash operation on the first data based on the first information to obtain a third hash result; encapsulate the third hash result based on the third information to obtain a second hash result, wherein the third information represents the encapsulation rule corresponding to the hash operation using the first information; and update the hash result of the first data in the database using the second hash result; The update unit is further configured to: The receiving unit is used to obtain the association between the hash rules and the encapsulation rules; Based on the first information and the aforementioned relationship, the third information is determined.

6. A server, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 4.

7. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images