User password management method, computer device and storage medium

Abstract

The present invention provides a user password management method, a computer device and a storage medium. The user password information is obtained through an encryption platform, and the user password information includes a user password plain text and a user identification. The encryption platform determines an encryption algorithm used to encrypt the user password information and an original secret key generated and sent by an encryption machine, and uses the original secret key and the encryption algorithm to perform encryption operations on the user password plain text and the user identification. The obtained user password ciphertext can improve the password security and shorten the encryption time. The method is suitable for user password encryption scenarios of lightweight software programs. In addition, the user identification is incorporated into the password calculation process to prevent equal value collisions of the same password, and the security level is higher.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a user password management method, a computer device and a storage medium. Background Art

[0002] In the era of informatization and digitalization, user authority security is particularly important. Password encryption and storage is the most important step to protect user authority. In the early days of the Internet, the passwords of users were stored in plain text. Once the database was leaked, the user's login information would be leaked. With the development of information security, a password encryption method based on the md5 digest algorithm has emerged, which encrypts and stores plain text passwords. However, since the encryption method based on the md5 digest algorithm is easily attacked, the password security cannot be protected. In the related technology, for application scenarios with higher security requirements, the bcrypt algorithm provides a more secure implementation. The bcrypt algorithm obtains the ciphertext by salting the password, which improves the security of the password. However, since the bcrypt algorithm needs to perform multiple rounds of encryption on the user's password summary, the encryption process is complicated and time-consuming. It is not suitable for lightweight software applications such as real estate transaction software, which affects the user experience. In addition, if different users set the same password, it will cause the same password to collide with the same value, affecting security. Summary of the invention

[0003] The present invention provides a user password management method, a computer device and a storage medium, which are used to solve the defects of the traditional user password management method, such as the complex encryption process, long time consumption, affecting the user experience, and the same password equal value collision affecting the password security.

[0004] The present invention provides a user password management method, comprising:

[0005] The encryption platform obtains user password information, wherein the user password information includes a plain text user password and a user identifier;

[0006] The encryption platform determines the encryption algorithm used to encrypt the user password information and the original key generated and sent by the encryption machine, and uses the original key and the encryption algorithm to encrypt the user password plaintext and user identification to obtain the user password ciphertext.

[0007] According to a user password management method provided by the present invention, the encryption platform determines an encryption algorithm for encrypting the user password information and an original key generated and sent by the encryption machine, including:

[0008] The encryption platform determines the key number and algorithm version number according to the business system that sends the user password information;

[0009] Determining the encryption algorithm according to the algorithm version number;

[0010] Searching for a key ciphertext according to the key number, wherein the key ciphertext includes two sub-key ciphertexts;

[0011] The corresponding original key is obtained according to the two sub-key ciphertexts, where the original key includes a first sub-key and a second sub-key.

[0012] According to a user password management method provided by the present invention, the user password and the user identification are encrypted using the original key and the encryption algorithm, including:

[0013] Performing digest calculation on the user ID and the user password using the encryption algorithm according to the first sub-key to obtain a user ID digest and a user password digest;

[0014] Performing a position-shifted XOR calculation on the user identification digest and the user password digest according to the second sub-key to obtain a symmetric encryption key;

[0015] Perform a symmetric encryption operation on the user password summary using the symmetric encryption key and the encryption algorithm to obtain the original ciphertext of the user password;

[0016] The original ciphertext of the user password is concatenated with the key number and the algorithm version number to obtain the ciphertext of the user password.

[0017] According to a user password management method provided by the present invention, the method further includes:

[0018] The encryption platform obtains a password verification request;

[0019] The encryption platform performs verification according to the password verification request.

[0020] According to a user password management method provided by the present invention, the password verification request includes an input password plain text, the user identifier, and the user password ciphertext corresponding to the user identifier stored in the business system;

[0021] The encryption platform performs verification according to the password verification request, including:

[0022] Parsing the secret key number and algorithm version number from the user password ciphertext;

[0023] Determine the corresponding key ciphertext according to the key number, and determine the original key according to the key ciphertext;

[0024] Determining the encryption algorithm according to the algorithm version number;

[0025] Encrypt the input password plaintext and the user identifier according to the original secret key and the encryption algorithm to obtain the input password ciphertext;

[0026] The input password ciphertext is compared with the user password ciphertext, and in response to the two being the same, the input password passes the verification.

[0027] According to a user password management method provided by the present invention,

[0028] The encryption platform obtains a password verification request, including:

[0029] The encryption platform receives the password verification request ciphertext, decrypts the password verification request ciphertext, and obtains the password verification request.

[0030] According to a user password management method provided by the present invention, before the encryption platform obtains the user password information, the method further includes:

[0031] The encryption platform initializes and loads a key number and a key ciphertext corresponding to the key number, and sends the key ciphertext to the encryption machine;

[0032] Receive the original secret key obtained after the encryption machine decrypts the secret key ciphertext.

[0033] According to a user password management method provided by the present invention, before the encryption platform determines the key number and the algorithm version number according to the business system that sends the user password information, the method further includes:

[0034] Configure the key number and the algorithm version number corresponding to the business system on the encryption platform;

[0035] In response to an update instruction for the key number and the algorithm version number corresponding to the business system, the key number and the algorithm version number corresponding to the business system are configured as the updated key number and the algorithm version number, and the correspondence between the key number and the key ciphertext before the update and the correspondence between the algorithm version number and the encryption algorithm before the update are retained.

[0036] According to a user password management method provided by the present invention, the encryption platform obtains user password information, including:

[0037] The encryption platform receives the first ciphertext and the session identifier, and searches for a session encryption key corresponding to the session identifier according to the session identifier;

[0038] The first ciphertext is decrypted using the session encryption key to obtain the user password information.

[0039] According to a user password management method provided by the present invention, after obtaining the ciphertext of the user password, the method further includes:

[0040] The user password ciphertext is encrypted using the session encryption key to obtain a second ciphertext, and the second ciphertext is sent.

[0041] According to a user password management method provided by the present invention, the method further includes: the encryption platform configures a preset flow limiting strategy, matches the user's real-time operation information with the preset flow limiting strategy, and limits the flow of the real-time operation that successfully matches;

[0042] The current limiting strategy includes an operation type, an operation dimension, and an operation frequency, and the operation type includes at least one of password encryption, password verification, interface access, and login.

[0043] The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the user password management method as described above when executing the program.

[0044] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the user password management method as described above when executed by a processor.

[0045] The user password management method, computer device and storage medium provided by the present invention obtain user password information through an encryption platform, and the user password information includes a user password plain text and a user identification; the encryption platform determines an encryption algorithm used to encrypt the user password information and an original secret key generated and sent by an encryption machine, and uses the original secret key and the encryption algorithm to perform encryption operations on the user password plain text and the user identification to obtain the user password ciphertext; the password security can be improved and the encryption time is short, and the method is suitable for user password encryption scenarios of lightweight software programs, and the user identification is incorporated into the password calculation process to prevent equal value collisions of the same password, and the security level is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 This is one of the flow charts of the user password management method provided by the present invention;

[0048] Figure 2 This is the second flow chart of the user password management method provided by the present invention;

[0049] Figure 3 This is the third flow chart of the user password management method provided by the present invention;

[0050] Figure 4 It is a password encryption and verification timing diagram provided by the present invention;

[0051] Figure 5 It is a communication sequence diagram between the client and the encryption platform provided by the present invention;

[0052] Figure 6 It is a schematic diagram of the encryption platform architecture provided by the present invention.

[0053] Figure 7 It is a structural schematic diagram of the computer device provided by the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] Figure 1 A flowchart of a user password management method provided by an embodiment of the present invention, such as Figure 1 As shown, the user password management method provided by the embodiment of the present invention includes:

[0056] Step 101: The encryption platform obtains user password information, which includes the user password plain text and user identification;

[0057] In the embodiment of the present invention, the user identification includes an administrator identification and a business user identification. Each business user has a unique identification to prevent collision of equal values ​​of the same password.

[0058] Step 102: The encryption platform determines the encryption algorithm used to encrypt the user password information and the original key generated and sent by the encryption machine, and uses the original key and encryption algorithm to encrypt the user password plaintext and user identification to obtain the user password ciphertext.

[0059] In an embodiment of the present invention, the encryption platform determines the encryption algorithm used to encrypt the user password information and the original key generated and sent by the encryption machine, including:

[0060] The encryption platform determines the key number and algorithm version number based on the business system that sends the user password information;

[0061] Determine the encryption algorithm based on the algorithm version number;

[0062] Find the key ciphertext according to the key number. The key ciphertext contains two sub-key ciphertexts.

[0063] The corresponding original key is obtained according to the two sub-key ciphertexts, where the original key includes a first sub-key and a second sub-key.

[0064] In the embodiment of the present invention, the user password and user identification are encrypted using the original key and encryption algorithm, including:

[0065] Performing digest calculation on the user ID and the user password using an encryption algorithm according to the first sub-key to obtain a user ID digest and a user password digest;

[0066] In the embodiment of the present invention, the first sub-key is the HMAC with SM3 algorithm key. The HMAC (Keyed-Hashing for Message Authentication) operation uses a hash algorithm, takes a key and a message as input, and generates a message digest as output.

[0067] Performing a dislocation XOR calculation on the user identification summary and the user password summary according to the second sub-key to obtain a symmetric encryption key;

[0068] The second sub-key is the SM4 algorithm key, which encrypts the user password through the HMACwithSM3 algorithm and the SM4 algorithm. The calculation process is simple and irreversible, using a commercial algorithm, which meets the requirements of national encryption transformation.

[0069] Use the symmetric encryption key and encryption algorithm to perform symmetric encryption on the user password summary to obtain the original ciphertext of the user password;

[0070] Concatenate the original ciphertext of the user password with the secret key number and algorithm version number to obtain the ciphertext of the user password.

[0071] The encryption platform adds the key number and algorithm version number to the password ciphertext and passes it to the business system, which saves it and passes it to the encryption platform when verifying the password.

[0072] In the embodiment of the present invention, the introduction of external information for encryption operation can save multiple rounds of encryption calculation process, reduce encryption complexity, and reduce encryption time; by adding algorithm version identification, different algorithms can be compatible, ensuring the forward compatibility of the password verification algorithm.

[0073] The traditional user password management method uses the bcrypt algorithm to encrypt user passwords. The bcrypt algorithm obtains the ciphertext by encrypting the password with salt, which improves the security of the password. However, since the bcrypt algorithm needs to perform multiple rounds of encryption on the user password summary, the encryption process is complex and time-consuming. It is not suitable for application scenarios of lightweight software applications such as real estate transaction software, which affects the user experience. In addition, if different users set the same password, it will cause the same password to collide with the same value, affecting security.

[0074] The user password management method provided by the embodiment of the present invention obtains user password information through an encryption platform, and the user password information includes a user password plaintext and a user identifier; the encryption platform determines an encryption algorithm used to encrypt the user password information and an original secret key generated and sent by an encryption machine, and uses the original secret key and the encryption algorithm to perform encryption operations on the user password plaintext and the user identifier to obtain a user password ciphertext; sending the user password ciphertext can improve the password security and shorten the encryption time, and is suitable for user password encryption scenarios of lightweight software programs. In addition, the user identifier is incorporated into the password calculation process to prevent equal value collisions of the same password, and the security level is higher.

[0075] Based on any of the above embodiments, Figure 2 As shown, the user password management method also includes:

[0076] Step 201: The encryption platform obtains a password verification request;

[0077] In an embodiment of the present invention, the encryption platform obtains a password verification request, including:

[0078] The encryption platform receives the password verification request ciphertext, decrypts the password verification request ciphertext, and obtains the password verification request.

[0079] In the embodiment of the present invention, the password verification request includes but is not limited to the plain text of the input password, the user ID, and the ciphertext of the user password corresponding to the user ID stored in the business system, etc.;

[0080] Step 202: The encryption platform performs verification according to the password verification request.

[0081] In an embodiment of the present invention, the encryption platform performs verification according to the password verification request, including:

[0082] Step 2021: parse the user password ciphertext to obtain the key number and algorithm version number;

[0083] Step 2022: Determine the corresponding key ciphertext according to the key number, and determine the original key according to the key ciphertext;

[0084] Step 2023: Determine the encryption algorithm according to the algorithm version number;

[0085] Step 2024: Encrypt the input password plaintext and the user ID according to the original secret key and the encryption algorithm to obtain the input password ciphertext;

[0086] Step 2025: compare the input password ciphertext and the user password ciphertext, and if the two are the same, the input password passes verification.

[0087] Based on any of the above embodiments, before the encryption platform obtains the user password information, it also includes:

[0088] The encryption platform initializes and loads the key number and the key ciphertext corresponding to the key number, and sends the key ciphertext to the encryption machine;

[0089] The original key obtained by receiving the encryption machine after decrypting the key ciphertext.

[0090] In the embodiment of the present invention, the encryption platform obtains user password information, including:

[0091] The encryption platform receives the first ciphertext and the session identifier, and searches for a session encryption key corresponding to the session identifier according to the session identifier;

[0092] The first ciphertext is decrypted using the session encryption key to obtain the user password information.

[0093] In the embodiment of the present invention, after obtaining the ciphertext of the user password, the method further includes:

[0094] The user password ciphertext is encrypted using a session encryption key to obtain a second ciphertext, and the second ciphertext is sent.

[0095] The encryption platform initialization process includes: reading all key numbers and the key ciphertexts corresponding to the key numbers, sending the key ciphertexts to the encryption machine for decryption request, the encryption machine decrypts to obtain the original key, and sends it to the encryption platform. The encryption platform only loads the original key into the memory. The key will disappear after the encryption platform is restarted. Therefore, the encryption platform does not actually store the original key, thereby achieving the purpose of isolating the key from the encryption platform.

[0096] In the process of encrypting and verifying the password, the key ciphertext is found through the key number and then the corresponding original key is found, which further improves the security of the password.

[0097] Based on any of the above embodiments, before the encryption platform determines the key number and the algorithm version number according to the business system that sends the user password information, it also includes:

[0098] Configure the key number and algorithm version number corresponding to the business system on the encryption platform;

[0099] In response to the update instruction of the key number and algorithm version number corresponding to the business system, the key number and algorithm version number corresponding to the business system are configured as the updated key number and algorithm version number, and the correspondence between the key number and the key ciphertext before the update and the correspondence between the algorithm version number and the encryption algorithm before the update are retained.

[0100] By configuring the business system to correspond to the key number and algorithm version number, if the key and algorithm can be updated, you only need to add the key and algorithm to the encryption platform and update the business system configuration.

[0101] The previous correspondence between the key number and the key ciphertext and the algorithm version number and the algorithm are retained, which can be forward compatible with the old keys and algorithms. If a password is encrypted with the old key and algorithm, it can still be decrypted through the encryption platform. Changing the encryption key does not affect the verification of the old version of the password, and the addition of a new key has no effect on the client. Once the original key is leaked, the key can be changed in time to further improve the security of the user's password.

[0102] In some embodiments of the present invention, the encryption platform further includes: configuring a preset flow limiting strategy, matching the user's real-time operation information with the preset flow limiting strategy, and limiting the flow of the real-time operation that successfully matches;

[0103] The current limiting strategy includes operation type, operation dimension and operation frequency. The operation type includes at least one of password encryption, password verification, interface access and login.

[0104] The specific current limiting strategy is shown in Table 1.

[0105] Table 1 Current limiting strategy

[0106]

[0107] In the embodiment of the present invention, a basic current limiting strategy is provided to limit the access frequency of the same user's generation and verification of passwords, thereby preventing the user passwords of the business system from being cracked by exhaustive means.

[0108] Based on any of the above embodiments, Figure 3 As shown, the user password management method provided by the embodiment of the present invention includes:

[0109] Step 301: In response to a password verification request from a client, obtain a password ciphertext stored by the client;

[0110] Step 302: If the password prefix of the password ciphertext is the same as the preset password prefix, parse the key number from the password ciphertext;

[0111] Step 303: Obtain key information according to the key number, and encrypt the verification password input by the client according to the key information;

[0112] Step 304: If the password ciphertext is the same as the encrypted verification password, the verification is successful.

[0113] In the embodiment of the present invention, the password encryption storage and verification sequence is as follows: Figure 4 As shown. The password encryption and verification process is stored separately from the secret key it relies on. The secret key can be updated independently, and the secret key decryption relies on the encryption machine. When there is a need to replace the secret key and algorithm, only the server side needs to be changed, and no business system needs to be changed, which reduces the frequent adjustment of the business system and improves the convenience of password policy adjustment.

[0114] In some embodiments of the present invention, the communication between the client and the encryption platform is established on a secure session, and the interaction sequence is as follows: Figure 5 As shown, when starting a session, the client's business system stores the encryption platform public key PK, the client system identifier S and the secret key K, wherein the encryption platform public key PK in the business system and the private key in the encryption platform are a pair. During the session establishment process, the business system generates a random secret key P, uses the random secret key P to encrypt the encryption platform public key PK to obtain the ciphertext EP, obtains the current time T, generates a summary D based on the current time T, and sends the ciphertext EP, the summary D, the system identifier S and the current time T to the encryption platform. The encryption platform obtains the system secret key K' based on the system identifier S, calculates the summary D' based on the system secret key K', compares the summary D' with the summary D to see if they are consistent, and if they are consistent, uses the encryption platform private key corresponding to the encryption platform public key PK to decrypt the ciphertext EP to obtain the random secret key P. The encryption platform generates a secret key SP, uses a random secret key P to encrypt the secret key SP to obtain a ciphertext SEP, and generates a secure session identifier SI; the secure session identifier and the ciphertext SEP are returned to the business system, and the business system decrypts the ciphertext SEP with a random secret key P to obtain the secret key SP, and saves the secret key SP and the secure session identifier SI.

[0115] User password information encryption, password ciphertext return, and user password verification all require encrypted communication between the client and the encryption platform. During the encrypted communication process, the original message (including user identification, password plaintext, and other information) M is encrypted using the secret key SP to obtain the ciphertext E, and the secure session identifier SI and ciphertext E are sent to the encryption platform. The encryption platform finds the secret key SP based on the secure session identifier SI, and uses the secret key SP to decrypt the ciphertext E to obtain the original message M, i.e., the user password information, to encrypt the user password information, ensuring that the data transmission between the client and the encryption platform is not leaked.

[0116] In the embodiment of the present invention, the password ciphertext structure is shown in Table 2.

[0117] Table 2 Password ciphertext structure table

[0118] length 4 bytes 4 bytes 4 bytes 64 bytes content Fixed prefix Algorithm version Key Number Ciphertext

[0119] Some software applications for real estate transactions by users have relatively simple user passwords of only six digits, which are easily cracked. The method described in the above embodiment can improve the security of user passwords.

[0120] In some embodiments of the present invention, Figure 6 As shown, the encryption platform is connected to the database and the encryption machine. The business architecture includes the business system, administrator, password encryption module, data encryption module, login module, permission management module, key configuration module, password verification module, data decryption module, user maintenance module, application configuration module, user authentication module, application authentication module (application authentication is application authentication on the business side, and user authentication is user authentication on the encryption platform), current limiting strategy module, key storage module and key generation module, etc.

[0121] In some embodiments of the present invention, the encryption program is implemented based on Java, and bouncycastle-1.56 is used to provide general encryption and decryption capabilities. The encryption platform architecture is built using SpringBoot2.1.8, the permission system is implemented by integrating the shiro framework, the front-end framework uses vue, and the data storage uses Mysql.

[0122] Figure 7 A schematic diagram of the physical structure of a computer device is shown as an example. Figure 7 As shown, the computer device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the outbound call method, which includes: the encryption platform obtains user password information, the user password information includes the user password plain text and the user identification; the encryption platform determines the encryption algorithm used to encrypt the user password information and the original secret key generated and sent by the encryption machine, and uses the original secret key and the encryption algorithm to encrypt the user password plain text and the user identification to obtain the user password ciphertext; and sends the user password ciphertext.

[0123] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0124] An embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the method for managing user passwords as described above is implemented, including: an encryption platform obtains user password information, the user password information includes a user password plaintext and a user identifier; the encryption platform determines an encryption algorithm used to encrypt the user password information and an original secret key generated and sent by an encryption machine, uses the original secret key and the encryption algorithm to perform encryption operations on the user password plaintext and the user identifier to obtain a user password ciphertext; and sends the user password ciphertext.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A user password management method, characterized in that: include: The encryption platform obtains user password information, wherein the user password information includes a plain text user password and a user identifier; The encryption platform determines the encryption algorithm used to encrypt the user password information and the original key generated and sent by the encryption machine, and uses the original key and the encryption algorithm to perform an encryption operation on the user password plaintext and the user identifier to obtain the user password ciphertext; The encryption platform determines an encryption algorithm for encrypting the user password information, including: the encryption platform determines an algorithm version number according to a business system that sends the user password information; and determines the encryption algorithm according to the algorithm version number; Before the encryption platform determines the algorithm version number according to the business system that sends the user password information, the encryption platform also includes: The algorithm version number corresponding to the business system is configured on the encryption platform; in response to an update instruction of the algorithm version number corresponding to the business system, the algorithm version number corresponding to the business system is configured to be the updated algorithm version number, and the correspondence between the algorithm version number and the encryption algorithm before the update is retained.

2. The user password management method according to claim 1, characterized in that: The encryption platform determines the encryption algorithm used to encrypt the user password information and the original key generated and sent by the encryption machine, including: The encryption platform determines the key number according to the business system that sends the user password information; Searching for a key ciphertext according to the key number, wherein the key ciphertext includes two sub-key ciphertexts; The corresponding original key is obtained according to the two sub-key ciphertexts, where the original key includes a first sub-key and a second sub-key.

3. The user password management method according to claim 2, characterized in that: Using the original secret key and the encryption algorithm to perform an encryption operation on the user password and the user identification includes: Performing digest calculation on the user ID and the user password using the encryption algorithm according to the first sub-key to obtain a user ID digest and a user password digest; Performing a position-shifted XOR calculation on the user identification digest and the user password digest according to the second sub-key to obtain a symmetric encryption key; Perform a symmetric encryption operation on the user password summary using the symmetric encryption key and the encryption algorithm to obtain the original ciphertext of the user password; The original ciphertext of the user password is concatenated with the key number and the algorithm version number to obtain the ciphertext of the user password.

4. The user password management method according to claim 1, characterized in that: The method further comprises: The encryption platform obtains a password verification request; The encryption platform performs verification according to the password verification request.

5. The user password management method according to claim 4, characterized in that: The password verification request includes the plain text of the input password, the user ID, and the ciphertext of the user password corresponding to the user ID stored in the business system; The encryption platform performs verification according to the password verification request, including: Parsing the secret key number and algorithm version number from the user password ciphertext; Determine the corresponding key ciphertext according to the key number, and determine the original key according to the key ciphertext; Determining the encryption algorithm according to the algorithm version number; Encrypt the input password plaintext and the user identifier according to the original secret key and the encryption algorithm to obtain the input password ciphertext; The input password ciphertext is compared with the user password ciphertext, and in response to the two being the same, the input password passes the verification.

6. The user password management method according to claim 1, characterized in that: Before the encryption platform obtains the user password information, the method further includes: The encryption platform initializes and loads a key number and a key ciphertext corresponding to the key number, and sends the key ciphertext to the encryption machine; Receive the original secret key obtained after the encryption machine decrypts the secret key ciphertext.

7. The user password management method according to claim 2, characterized in that: Before the encryption platform determines the key number according to the business system that sends the user password information, the method further includes: Configuring the key number corresponding to the business system on the encryption platform; In response to an update instruction of the key number corresponding to the business system, the key number corresponding to the business system is configured as the updated key number, and the correspondence between the key number and the key ciphertext before the update is retained.

8. The user password management method according to claim 1, characterized in that: The method further includes: the encryption platform configures a preset flow limiting strategy, matches the user's real-time operation information with the preset flow limiting strategy, and limits the flow of the real-time operation that successfully matches; The current limiting strategy includes an operation type, an operation dimension, and an operation frequency, and the operation type includes at least one of password encryption, password verification, interface access, and login.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the user password management method as described in any one of claims 1 to 8 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the user password management method according to any one of claims 1 to 8 is implemented.

Images