Password protection method, password verification method, password protection device, password verification device and terminal

Abstract

The embodiment of the invention discloses a password protection method, a password verification method, a password protection device, a password verification device and a terminal. Performing slow hash calculation on the correct plaintext password in response to a storage request for the correct plaintext password; determining a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determining a second hash value of the correct plaintext password after the slow hash calculation; splicing the first hash value and the second hash value to obtain ciphertext data corresponding to the correct plaintext password, and storing the ciphertext data; wherein the first hash value is used for performing first consistency comparison with the target password; the ciphertext data is used for performing second consistency comparison with the target password after the target password passes the first consistency comparison. On the premise that it is guaranteed that ciphertext data still have high cracking difficulty, computing resources consumed during password verification are reduced through verification comparison of the two stages.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and more particularly to a password protection method, a password verification method, a device, and a terminal. Background Art

[0002] In the information security protection scenario, verifying the identity of the data accessor first and then disclosing the data content to the user based on the verification result has become a common information protection technology. By entering the correct account and password, the system can confirm the user's identity and allow the user to access the corresponding resources or services based on the user's identity. The security of the account and password is directly related to the risk of leakage of user privacy data and internal data, so a series of complex calculations are often used to encrypt and protect the account and password. As the encryption protection strategy becomes more complicated, the password also needs to be calculated accordingly during verification, which results in a large number of verification requests, which will occupy a large amount of computing resources and make other services in the system unavailable. Summary of the invention

[0003] The embodiments of this specification provide a password protection method, a password verification method, a device and a terminal, which can solve the technical problem of consuming a large amount of computing resources due to attack defense in the related art.

[0004] In a first aspect, an embodiment of the present specification provides a password protection method, the method comprising:

[0005] In response to a storage request for a correct plaintext password, performing a slow hash calculation on the correct plaintext password;

[0006] Determine a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine a second hash value of the correct plaintext password after the slow hash calculation;

[0007] Concatenate the first hash value and the second hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data;

[0008] Among them, the above-mentioned first hash value is used for the first consistency comparison with the first hash value to be verified obtained after the target password is calculated through the above-mentioned first hash during password verification; the above-mentioned ciphertext data is used for the second consistency comparison with the ciphertext data to be verified obtained after the above-mentioned target password passes the above-mentioned first consistency comparison.

[0009] The beneficial effects brought about by the technical solution of the first aspect above include at least: in the process of slow hash calculation of the correct plaintext password, the value of the first hash and the value of the last hash are concatenated, and the final result is stored as ciphertext data to ensure that the ciphertext data still has a high degree of cracking difficulty. During password verification, the input target password is directly compared with the first hash value of the corresponding ciphertext data after the first hash. If they are consistent, the complete slow hash result is compared; if they are inconsistent, the verification failure result is directly returned, so that most of the wrong passwords can be detected with only one hash calculation, which greatly reduces the occupation and consumption of terminal computing resources by hash calculation during password verification, and improves the efficiency of password verification.

[0010] In some possible implementations, the above-mentioned determining the first hash value of the above-mentioned correct plaintext password after the first hash calculation in the above-mentioned slow hash calculation includes: determining the first calculation result of the above-mentioned correct plaintext password after the first hash calculation in the above-mentioned slow hash calculation, and selecting the first hash value from the above-mentioned first calculation result based on a preset selection logic.

[0011] Through the technical solutions in the above possible implementation methods, the first hash value used in the first verification can be an excerpt of the first hash result, so that while ensuring that the difficulty of cracking the final ciphertext data remains unchanged, the amount of data compared in the first stage of verification is reduced, making the first stage verification process faster.

[0012] In a second aspect, an embodiment of the present specification provides a password verification method, the method comprising:

[0013] In response to a password verification request for a target password, determine ciphertext data for verifying the target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password;

[0014] Perform the first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified;

[0015] If they are consistent, the above slow hash calculation is continued for the above target password to obtain the ciphertext data to be verified corresponding to the above target password, and the legitimacy of the above target password is verified based on the above ciphertext data to be verified and the above ciphertext data;

[0016] If they are inconsistent, the verification failure result corresponding to the above target password is determined.

[0017] The beneficial effects brought about by the technical solution of the second aspect include at least: during password verification, the target password input by the user this time is directly compared with the first hash value after the first hash calculation in the correct ciphertext data corresponding to the correct plaintext password after the first hash calculation; if the two are consistent, then the complete slow hash results are compared; if they are inconsistent, it means that the target password this time must be different from the correct plaintext password, and the verification failure result can be directly returned, which makes it possible for a large number of incorrect passwords to be detected with almost only one hash calculation in the first stage, greatly reducing the occupation and consumption of computing resources by slow hash calculations during password verification.

[0018] In some possible implementations, the above-mentioned verification of the legitimacy of the above-mentioned target password based on the above-mentioned ciphertext data to be verified and the above-mentioned ciphertext data includes: verifying whether the above-mentioned ciphertext data to be verified is consistent with the above-mentioned ciphertext data; if they are consistent, determining the verification success result corresponding to the above-mentioned target password; if they are inconsistent, determining the verification failure result corresponding to the above-mentioned target password.

[0019] Through the technical solutions in the above possible implementation methods, when verifying the complete slow hash result, if the slow hash result is consistent with the ciphertext data in the library, it means; if it is inconsistent, it means that the target password is different from the correct plaintext password. At this time, the verification failure result can be directly returned. Through the first stage of fast verification, a large number of malicious accesses can be effectively intercepted quickly, and then further slow but accurate verification is performed to ensure the accuracy of the verification result.

[0020] In some possible implementations, the method further includes: recording the number of consecutive password verification failure results corresponding to the ciphertext data; when the consecutive number reaches a preset number, ignoring the password verification request for the ciphertext data within a preset time period.

[0021] Through the technical solution in the above possible implementation method, the number of consecutive password verification failures of the same account is recorded. If there are multiple consecutive failures, the request of the account is locked for a period of time to avoid responding to malicious requests that affect the stability and security of the system.

[0022] In a third aspect, an embodiment of the present specification provides a password protection device, the device comprising:

[0023] A storage request receiving module, configured to perform a slow hash calculation on a correct plaintext password in response to a storage request for the correct plaintext password;

[0024] The first stage calculation module is used to determine the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine the second hash value of the correct plaintext password after the slow hash calculation;

[0025] The second stage calculation module is used to concatenate the first hash value and the second hash value to obtain the ciphertext data corresponding to the correct plaintext password, and store the ciphertext data;

[0026] Among them, the above-mentioned first hash value is used for the first consistency comparison with the first hash value to be verified obtained after the target password is calculated through the above-mentioned first hash during password verification; the above-mentioned ciphertext data is used for the second consistency comparison with the ciphertext data to be verified obtained after the above-mentioned target password passes the above-mentioned first consistency comparison.

[0027] In a fourth aspect, an embodiment of the present specification provides a password verification device, the device comprising:

[0028] A verification request receiving module, configured to determine, in response to a password verification request for a target password, ciphertext data for verifying the target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password;

[0029] The first-stage verification module is used to perform the first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, and verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified;

[0030] The second-stage verification module is used to continue to perform the above slow hash calculation on the above target password to obtain the ciphertext data to be verified corresponding to the above target password if they are consistent, and verify the legitimacy of the above target password based on the above ciphertext data to be verified and the above ciphertext data;

[0031] The verification result returning module is used to determine the verification failure result corresponding to the above target password if they are inconsistent.

[0032] In a fifth aspect, an embodiment of the present specification provides a computer program product comprising instructions, which, when the computer program product is run on a computer or a processor, enables the computer or the processor to execute the steps of the above method.

[0033] In a sixth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the steps of the above method.

[0034] In a seventh aspect, an embodiment of the present specification provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is suitable for being loaded by the processor and executing the steps of the method described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0036] Figure 1 An exemplary system architecture diagram of a password protection method provided in an embodiment of this specification;

[0037] Figure 2 A flowchart of a password protection method provided in an embodiment of this specification;

[0038] Figure 3 An example diagram of the logical steps of a password protection method provided in an embodiment of this specification;

[0039] Figure 4 A flowchart of a password verification method provided in an embodiment of this specification;

[0040] Figure 5 An example diagram of the logical steps of a password verification method provided in an embodiment of this specification;

[0041] Figure 6 A structural block diagram of a password protection device provided in an embodiment of this specification;

[0042] Figure 7 A structural block diagram of a password verification device provided in an embodiment of this specification;

[0043] Figure 8 A schematic diagram of the structure of a terminal provided in an embodiment of this specification;

[0044] Fig. 9 A schematic diagram of the structure of a terminal provided in an embodiment of this specification. DETAILED DESCRIPTION

[0045] In order to make the features and advantages of the embodiments of this specification more obvious and easy to understand, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the embodiments of this specification.

[0046] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this specification. Instead, they are only examples of devices and methods consistent with some aspects of the embodiments of this specification as detailed in the attached claims.

[0047] In the digital age, whether it is information on websites, applications or systems, or each user's personal information, transaction records, communication content and other private data, all need to be properly protected. Therefore, in the information security protection scenario, verifying the identity of the data accessor first and then disclosing the data content to him based on the verification results has become a common information protection technology means, and user accounts and passwords have also become the first line of defense for network security and personal privacy protection. From a technical point of view, account and password are the most direct and common authentication methods. By entering the correct account and password, the system can confirm the user's identity and allow him to access the corresponding resources or services based on the user's identity. Especially in confidentiality systems, this mechanism ensures that only legitimate users can access sensitive information or perform key operations. Account and password are the keys for users to access data, and their security is directly related to the risk of leakage of user privacy data and internal data. If the account and password are maliciously cracked, the attacker may perform malicious operations, such as stealing data, destroying the system or conducting fraudulent activities, which poses a great danger to network security and information security. Therefore, effective measures are often needed to protect account and password from being maliciously cracked or abused.

[0048] In order to maintain the security of account and password, the password can generally be hashed before being stored in the database. Hash is to transform an input of any length into an output of fixed length through a hash algorithm. The output is the hash value. The hash algorithm is a compression mapping that can compress a message of any length into a message digest of a fixed length. In addition, the hash algorithm is a one-way conversion encryption form. It is almost technically impossible to reversely derive the original plaintext password from the hash value. Therefore, by hashing the plaintext password before storing it, even if the database is leaked, the attacker cannot directly obtain the user's plaintext password from it, thereby effectively protecting the user's plaintext password. However, the traditional single hash algorithm can effectively protect the password from being read directly, but it may face the threat of brute force cracking. Brute force cracking is to try all possible password combinations, convert each combination into a hash value, and then compare it with the hash value stored in the database to find a match. With the improvement of computing power, the computational efficiency of brute force cracking methods is also constantly improving, making some simple or common password combinations easy to crack.

[0049] In order to deal with malicious attacks such as brute force, the slow hash algorithm came into being. The slow hash algorithm significantly increases the difficulty of password cracking by increasing the computational complexity and time required. Specifically, the slow hash algorithm deliberately introduces computational delays during its design, such as through multiple iterations, increased memory usage, or the use of complex mathematical operations, which greatly increases the time cost of generating a hash value. If the slow hash algorithm is used to increase the computational time by 10,000 times, then in theory, the time it takes for an attacker to obtain a password through brute force will also be extended by 10,000 times, which greatly increases the difficulty and cost of cracking.

[0050] However, the most significant disadvantage of the slow hash algorithm is the consumption of system resources. Every time a user logs in, the system needs to perform a slow hash calculation process to verify the correctness of the password. If an attacker uses automated tools to launch a large number of login attempts (i.e., password guessing attacks), the website server will have to allocate a large amount of computing resources for each attempted password to verify, which may cause the server resources to be quickly exhausted, affecting the access experience of normal users, or even causing the service to be completely unavailable.

[0051] Therefore, the embodiments of this specification provide a password protection method to solve the above-mentioned technical problem of consuming a large amount of computing resources due to attack defense.

[0052] See also Figure 1 , Figure 1 An exemplary system architecture diagram of a password protection method provided in an embodiment of this specification.

[0053] like Figure 1 As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 is used to provide a medium for a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired communication links or wireless communication links, for example, the wired communication link includes an optical fiber, a twisted pair, or a coaxial cable, and the wireless communication link includes a Bluetooth communication link, a Wireless-Fidelity (Wi-Fi) communication link, or a microwave communication link.

[0054] The terminal 101 can interact with the server 103 through the network 102 to receive messages from the server 103 or send messages to the server 103, or the terminal 101 can interact with the server 103 through the network 102 to receive messages or data sent by other users to the server 103. The terminal 101 can be hardware or software. When the terminal 101 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 101 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0055] In the embodiment of the present specification, the terminal 101 first responds to a storage request for a correct plaintext password and performs a slow hash calculation on the correct plaintext password; then the terminal 101 determines the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determines the second hash value of the correct plaintext password after the slow hash calculation; further, the terminal 101 concatenates the first hash value and the second hash value to obtain ciphertext data corresponding to the correct plaintext password, and stores the ciphertext data; wherein the first hash value is used for a first consistency comparison with the first hash value to be verified obtained after the target password is calculated after the first hash during password verification; the ciphertext data is used for a second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated after the slow hash after the target password passes the first consistency comparison.

[0056] The server 103 may be a business server that provides various services. It should be noted that the server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 103 is software, it may be implemented as multiple software or software modules (for example, for providing distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.

[0057] Alternatively, the system architecture may not include the server 103. In other words, the server 103 may be an optional device in the embodiments of this specification, that is, the method provided in the embodiments of this specification may be applied to a system structure that only includes the terminal 101, and the embodiments of this specification do not limit this.

[0058] It should be understood that Figure 1The number of terminals, networks and servers in the example is only illustrative, and any number of terminals, networks and servers may be used according to the implementation requirements. It should be noted that in the embodiments of this specification, a similar system architecture can also be used to implement the password verification method, so the exemplary system architecture diagram of the password verification method is not repeated.

[0059] See also Figure 2 , Figure 2 A flowchart of a password protection method provided in an embodiment of this specification. The execution subject of the embodiment of this specification can be a terminal that executes password protection, a processor in the terminal that executes the password protection method, or a password protection service in the terminal that executes the password protection method. For the convenience of description, the specific execution process of the password protection method is introduced below by taking the execution subject as the processor in the terminal as an example.

[0060] like Figure 2 As shown, the password protection method may at least include:

[0061] S202: In response to a storage request for a correct plaintext password, perform a slow hash calculation on the correct plaintext password.

[0062] Optionally, in the application scenario of encrypting passwords, in order to deal with malicious attacks against brute force cracking of ordinary hash calculations, slow hash algorithms came into being. The reason why the slow hash algorithm is "slow" is not due to technical defects, but a deliberate strategy. The slow hash algorithm significantly increases the difficulty of cracking passwords by increasing the computational complexity and time required. Specifically, the slow hash algorithm deliberately introduces computational delays through a series of carefully designed computational obstacles during design, such as implementing multiple iterative loops, deliberately increasing the complexity of memory access, or incorporating highly specialized mathematical problems, such as large number prime factorization, discrete logarithm solution, etc., to significantly extend the generation time of hash values. If a slow hash algorithm is used to increase the calculation time by 10,000 times, then in theory, the time it takes for an attacker to obtain a password through brute force will also be extended by 10,000 times, which greatly increases the difficulty and cost of cracking. This process forces any cracking tool that attempts to crack the password quickly to extend the cracking speed of the password. In addition to reducing the possibility of the password being cracked from the perspective of cracking time, more complex calculations also greatly reduce the probability of the password being cracked by chance due to hash conflicts.

[0063] Optionally, whenever a user sets a correct plaintext password for an account, the terminal can receive and respond to a storage request for the correct plaintext password, and then the terminal will start a slow hash calculation process to perform a slow hash calculation on the correct plaintext password. This process ensures that even if the password information stored in the system is stolen, it is difficult to quickly restore it to the original plaintext, thereby effectively curbing the chain reaction after the password is leaked.

[0064] S204: Determine a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine a second hash value of the correct plaintext password after the slow hash calculation.

[0065] Optionally, it can be known from the above introduction that during the verification process, the password needs to perform a calculation process consistent with the encryption method, and compare the final result with the pre-stored encryption result, so as to realize the verification of the user's identity. This results in that when a large number of verification requests appear, the verification process will consume a large amount of computing resources, resulting in the unavailability of services in the system. Therefore, in the embodiment of this specification, when calculating the ciphertext data corresponding to the correct plaintext password, the ciphertext data contains not only the slow hash result corresponding to the correct plaintext password, but also the fast hash value with fast calculation speed, simple and effective comparison. This part of the hash value obtained by fast hash calculation can be used for the first fast verification of the target password entered by the user later. After this fast verification is passed, the second accurate verification between the final ciphertext data is combined with the complete slow hash value of the target password. In this way, in the password verification scenario, the first fast verification can use less computing resources to quickly determine a part of the wrong target password, reduce the computing resources consumed during the overall password verification, and improve the verification efficiency under the premise of ensuring the security of the password.

[0066] Specifically, the slow hash value is obtained through multiple hash calculations, so the fast hash value in the ciphertext data can be obtained based on the previous hash calculations of the slow hash. For example, the fast hash can be the first hash calculation in the slow hash process, or the third hash calculation in the slow hash process. The earlier the number of fast hashes in the slow hash process, the shorter the calculation process of the fast hash value in the ciphertext data, and the faster the first stage of fast verification. Based on this, in a preferred implementation, please refer to Figure 3 , Figure 3 This is an example diagram of the logical steps of a password protection method provided in the embodiment of this specification. Figure 3As shown, in the process of slow hash calculation of the correct plaintext password, the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation is first determined, and then the second hash value of the correct plaintext password is determined after the complete slow hash. Among them, the first hash value is used for the first consistency comparison with the first hash value to be verified obtained after the target password is calculated after the first hash calculation during password verification; the ciphertext data is used for the second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated after the slow hash calculation after the target password passes the first consistency comparison. If the first consistency comparison fails, it can be directly judged that the target password is wrong, and then the verification failure result is returned. This makes it possible for most of the wrong passwords to be detected with only one hash calculation, which greatly reduces the occupation and consumption of terminal computing resources by hash calculation during password verification, and improves the efficiency of password verification.

[0067] Furthermore, the first hash value can be a complete hash result after the first hash calculation, or it can be just an excerpt of the first hash result, that is, when determining the first hash value, the specific process is: determine the first calculation result of the correct plaintext password after the first hash calculation in the slow hash calculation, and select the first hash value from the first calculation result based on the preset excerpt logic. The excerpt operation reduces the amount of data of the first hash value and speeds up the verification comparison, which is particularly prominent in improving the verification efficiency when a large number of verification requests are received at the same time.

[0068] Optionally, there may be multiple feasible solutions for setting the preset excerpt logic. For example, taking the first calculation result as "sn83ygh9isj9wjy8", the preset excerpt logic may be the last half of the first calculation result, that is, the first hash value is "isj9wjy8"; the preset excerpt logic may also be the first half of the first calculation result, that is, the first hash value is "sn83ygh9"; the preset excerpt logic may also be the last five digits of the first calculation result, that is, the first hash value is "9wjy8", etc. The embodiments of this specification do not limit the specific setting of the preset excerpt logic.

[0069] S206. Concatenate the first Hash value and the second Hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data.

[0070] Optionally, see Figure 3 After obtaining the first hash value and the second hash value, all hash calculations are completed. Then, the first hash value and the second hash value are concatenated to obtain the ciphertext data corresponding to the correct plaintext password. The ciphertext data is then stored in the database so that it can be used for password verification in subsequent verification requests.

[0071] In an embodiment of the present specification, a password protection method is provided. In response to a storage request for a correct plaintext password, a slow hash calculation is performed on the correct plaintext password; a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation is determined, and a second hash value of the correct plaintext password after the slow hash calculation is determined; the first hash value and the second hash value are concatenated to obtain ciphertext data corresponding to the correct plaintext password, and the ciphertext data is stored; wherein the first hash value is used for a first consistency comparison with a first hash value to be verified obtained after the target password is calculated after the first hash calculation during password verification; the ciphertext data is used for a second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated after the slow hash calculation after the first consistency comparison. In the process of performing a slow hash calculation on the correct plaintext password, the value of the first hash and the value of the last hash are concatenated, and the final result is stored as ciphertext data, ensuring that the ciphertext data still has a high degree of cracking difficulty. During password verification, the input target password is directly compared with the first hash value of the corresponding ciphertext data after the first hash. If they are consistent, the complete slow hash result is compared; if they are inconsistent, the verification failure result is directly returned, so that most incorrect passwords can be detected with only one hash calculation, which greatly reduces the occupancy and consumption of terminal computing resources by hash calculation during password verification and improves the efficiency of password verification.

[0072] See also Figure 4 , Figure 4 A flowchart of a password verification method provided in an embodiment of this specification.

[0073] like Figure 4 As shown, the password verification method may at least include:

[0074] S402: In response to a password verification request for a target password, determine ciphertext data for verifying the target password, where the ciphertext data is obtained by performing a slow hash calculation on a correct plaintext password.

[0075] Optionally, when a password verification request initiated by a user entering a target password is received, in response to the password verification request for the target password, the ciphertext data used to verify the target password can be determined through the user account corresponding to the request. The ciphertext data is obtained by performing a slow hash calculation on the correct plaintext password corresponding to the user account and stored in the database.

[0076] S404, performing the first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, verifying whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified.

[0077] Optionally, when verifying the consistency between the target password and the correct plaintext password, the target password needs to be subjected to the same calculation steps as when the correct plaintext password is converted into ciphertext data. Figure 5 , Figure 5 This is an example diagram of the logical steps of a password verification method provided in an embodiment of this specification, such as Figure 5 As shown, first, in the process of performing slow hash calculation on the target password, the first hash value to be verified for the first consistency verification is obtained. The calculation method of the first hash value to be verified is the same as the first hash value in the ciphertext data. Therefore, if the first hash value in the ciphertext data is obtained based on the first hash calculation, then the first hash value to be verified should also be obtained after the first hash calculation for the target password. At this time, do not continue other hash calculations in the slow hash temporarily, but verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, so as to determine whether the target password and the correct plaintext password are likely to be the same or definitely different.

[0078] S406: If they are consistent, continue to perform slow hash calculation on the target password to obtain the ciphertext data to be verified corresponding to the target password, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data.

[0079] Optionally, see Figure 5 If the first hash value to be verified is consistent with the first hash value in the ciphertext data, it means that the target password and the correct plaintext password have obtained the same result after the first hash and the same excerpt processing. However, considering that different values ​​have a certain probability of obtaining the same hash result due to hash conflicts during hash calculation, it means that the target password and the correct plaintext password may be the same or different. Furthermore, it is necessary to obtain the final ciphertext data to be verified through a complete slow hash, perform a second consistency comparison, and further accurately determine whether the target password and the correct plaintext password are really consistent. In other words, it is necessary to continue to perform slow hash calculations on the target password to obtain the ciphertext data to be verified corresponding to the target password, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data.

[0080] Specifically, see Figure 5 When verifying the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data, it is to directly verify whether the ciphertext data to be verified is consistent with the ciphertext data; similarly, if the two are consistent, it is determined that the target password is legal, and the verification success result corresponding to the target password can be returned to the user; if the two are inconsistent, it is determined that the target password is illegal, and the verification failure result corresponding to the target password can be returned to the user.

[0081] S408: If they are inconsistent, determine the verification failure result corresponding to the target password.

[0082] Optionally, see Figure 5 If the first hash value to be verified is inconsistent with the first hash value in the ciphertext data, the target password must be different from the correct plaintext password, that is, the target password must be illegal, and the verification failure result corresponding to the target password can be returned to the user. This allows a large number of incorrect passwords to be detected with almost only one hash calculation in the first stage, greatly reducing the occupation and consumption of computing resources by slow hash calculations during password verification.

[0083] S410, recording the number of consecutive password verification failure results corresponding to the ciphertext data; when the consecutive number reaches a preset number, ignoring the password verification request for the ciphertext data within a preset time period.

[0084] Optionally, if the same account has consecutive and multiple verification failures within a period of time, it may indicate that it has encountered malicious attacks. In this case, when a password verification failure occurs, the number of consecutive password verification failure results corresponding to the ciphertext data can be recorded. When the number of consecutive times reaches a preset number, in order to avoid unnecessary computing resources consumed by a large number of requests and to maintain the stable operation of the system, password verification requests for the ciphertext data can be ignored within a preset time period to lock the account and avoid responses to malicious requests that affect the stability and security of the system.

[0085] In an embodiment of the present specification, a password verification method is provided. In response to a password verification request for a target password, ciphertext data for verifying the target password is determined, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password; the first hash calculation in the slow hash calculation is performed on the target password to obtain a first hash value to be verified corresponding to the target password, and it is verified whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified; if they are consistent, the slow hash calculation is continued on the target password to obtain the ciphertext data to be verified corresponding to the target password, and the legitimacy of the target password is verified based on the ciphertext data to be verified and the ciphertext data; if they are inconsistent, a verification failure result corresponding to the target password is determined. During password verification, the target password entered by the user is directly compared with the first hash value after the first hash calculation in the correct ciphertext data corresponding to the correct plaintext password after the first hash calculation during password verification; if the two are consistent, the complete slow hash results are compared again; if they are inconsistent, it means that the target password must be different from the correct plaintext password, and the verification failure result can be directly returned. This means that a large number of incorrect passwords can be detected with almost only one hash calculation in the first stage, greatly reducing the occupation and consumption of computing resources by slow hash calculations during password verification.

[0086] See also Figure 6 , Figure 6This is a structural block diagram of a password protection device provided in the embodiments of this specification. Figure 6 As shown, the password protection device 600 includes:

[0087] A storage request receiving module 610, configured to perform a slow hash calculation on the correct plaintext password in response to a storage request for the correct plaintext password;

[0088] The first stage calculation module 620 is used to determine the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine the second hash value of the correct plaintext password after the slow hash calculation;

[0089] The second stage calculation module 630 is used to concatenate the first hash value and the second hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data;

[0090] Among them, the first hash value is used for the first consistency comparison with the first hash value to be verified obtained after the target password is calculated through the first hash during password verification; the ciphertext data is used for the second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated through the slow hash after the target password passes the first consistency comparison.

[0091] Optionally, the first-stage calculation module 620 is further used to determine a first calculation result of the correct plaintext password after the first hash calculation in the slow hash calculation, and select a first hash value from the first calculation result based on a preset selection logic.

[0092] In an embodiment of the present specification, a password protection device is provided, wherein a storage request receiving module is used to perform a slow hash calculation on the correct plaintext password in response to a storage request for a correct plaintext password; a first-stage calculation module is used to determine the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and to determine the second hash value of the correct plaintext password after the slow hash calculation; a second-stage calculation module is used to concatenate the first hash value and the second hash value to obtain the ciphertext data corresponding to the correct plaintext password, and store the ciphertext data; wherein the first hash value is used to perform a first consistency comparison with the first hash value to be verified obtained after the target password is calculated after the first hash calculation during password verification; the ciphertext data is used to perform a second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated after the slow hash calculation after the first consistency comparison. In the process of performing a slow hash calculation on the correct plaintext password, the value of the first hash and the value of the last hash are concatenated, and the final result is stored as the ciphertext data, ensuring that the ciphertext data still has a high degree of cracking difficulty. During password verification, the input target password is directly compared with the first hash value of the corresponding ciphertext data after the first hash. If they are consistent, the complete slow hash result is compared; if they are inconsistent, the verification failure result is directly returned, so that most incorrect passwords can be detected with only one hash calculation, which greatly reduces the occupancy and consumption of terminal computing resources by hash calculation during password verification and improves the efficiency of password verification.

[0093] See also Figure 7 , Figure 7 This is a structural block diagram of a password verification device provided in an embodiment of this specification. Figure 7 As shown, the password verification device 700 includes:

[0094] A verification request receiving module 710, configured to determine, in response to a password verification request for a target password, ciphertext data for verifying the target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password;

[0095] The first phase verification module 720 is used to perform the first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, and verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified;

[0096] The second-stage verification module 730 is used to continue to perform slow hash calculation on the target password to obtain the ciphertext data to be verified corresponding to the target password if they are consistent, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data;

[0097] The verification result returning module 740 is used to determine the verification failure result corresponding to the target password if they are inconsistent.

[0098] Optionally, the second-stage verification module 730 is further used to verify whether the ciphertext data to be verified is consistent with the ciphertext data; if they are consistent, a verification success result corresponding to the target password is determined; if they are inconsistent, a verification failure result corresponding to the target password is determined.

[0099] Optionally, the password verification device 700 further includes: a verification times limiting module, which is used to record the consecutive times of password verification failure results corresponding to the ciphertext data; when the consecutive times reach a preset number, the password verification request for the ciphertext data is ignored within a preset time period.

[0100] In an embodiment of the present specification, a password verification device is provided, wherein a verification request receiving module is used to determine ciphertext data used to verify the target password in response to a password verification request for a target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password; a first-stage verification module is used to perform a first hash calculation in a slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, and verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified; a second-stage verification module is used to continue to perform a slow hash calculation on the target password to obtain the ciphertext data to be verified corresponding to the target password if they are consistent, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data; a verification result returning module is used to determine a verification failure result corresponding to the target password if they are inconsistent. During password verification, the target password entered by the user is directly compared with the first hash value after the first hash calculation in the correct ciphertext data corresponding to the correct plaintext password after the first hash calculation during password verification; if the two are consistent, the complete slow hash results are compared again; if they are inconsistent, it means that the target password must be different from the correct plaintext password, and the verification failure result can be directly returned. This means that a large number of incorrect passwords can be detected with almost only one hash calculation in the first stage, greatly reducing the occupation and consumption of computing resources by slow hash calculations during password verification.

[0101] The embodiments of this specification provide a computer program product including instructions. When the computer program product is executed on a computer or a processor, the computer or the processor executes the steps of any one of the methods in the above embodiments.

[0102] The embodiments of this specification also provide a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing the steps of any method in the above embodiments.

[0103] See also Figure 8 , Figure 8 This is a schematic diagram of the structure of a terminal provided in an embodiment of this specification. Figure 8 As shown, the terminal 800 may include: at least one terminal processor 801 , at least one network interface 804 , a user interface 803 , a memory 805 , and at least one communication bus 802 .

[0104] The communication bus 802 is used to realize the connection and communication between these components.

[0105] The user interface 803 may include a display screen (Display) and a camera (Camera), and the optional user interface 803 may also include a standard wired interface and a wireless interface.

[0106] The network interface 804 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0107] Among them, the terminal processor 801 may include one or more processing cores. The terminal processor 801 uses various interfaces and lines to connect various parts in the entire terminal 800, and executes various functions and processes data of the terminal 800 by running or executing instructions, programs, code sets or instruction sets stored in the memory 805, and calling data stored in the memory 805. Optionally, the terminal processor 801 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The terminal processor 801 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the terminal processor 801, and it can be implemented separately through a chip.

[0108] Among them, the memory 805 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 805 includes a non-transitory computer-readable storage medium. The memory 805 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 805 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 805 may also be optionally at least one storage device located away from the aforementioned terminal processor 801. As Figure 8 As shown, the memory 805 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a password protection program.

[0109] exist Figure 8 In the terminal 800 shown, the user interface 803 is mainly used to provide an input interface for the user and obtain the data input by the user; and the terminal processor 801 can be used to call the password protection program stored in the memory 805 and specifically perform the following operations:

[0110] In response to a storage request for a correct plaintext password, performing a slow hash calculation on the correct plaintext password;

[0111] Determine a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine a second hash value of the correct plaintext password after the slow hash calculation;

[0112] Concatenate the first Hash value and the second Hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data;

[0113] Among them, the first hash value is used for the first consistency comparison with the first hash value to be verified obtained after the target password is calculated through the first hash during password verification; the ciphertext data is used for the second consistency comparison with the ciphertext data to be verified obtained after the target password is calculated through the slow hash after the target password passes the first consistency comparison.

[0114] In some embodiments, when the terminal processor 801 determines the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, it specifically performs the following steps: determine the first calculation result of the correct plaintext password after the first hash calculation in the slow hash calculation, and select the first hash value from the first calculation result based on a preset selection logic.

[0115] See also Fig. 9 , Fig. 9 This is a schematic diagram of the structure of a terminal provided in an embodiment of this specification. Fig. 9 As shown, the terminal 900 may include: at least one terminal processor 901 , at least one network interface 904 , a user interface 903 , a memory 905 , and at least one communication bus 902 .

[0116] The communication bus 902 is used to realize the connection and communication between these components.

[0117] The user interface 903 may include a display screen (Display) and a camera (Camera), and the optional user interface 903 may also include a standard wired interface and a wireless interface.

[0118] The network interface 904 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0119] Among them, the terminal processor 901 may include one or more processing cores. The terminal processor 901 uses various interfaces and lines to connect various parts within the entire terminal 900, and executes various functions and processes data of the terminal 900 by running or executing instructions, programs, code sets or instruction sets stored in the memory 905, and calling data stored in the memory 905. Optionally, the terminal processor 901 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The terminal processor 901 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the terminal processor 901, and it can be implemented separately through a chip.

[0120] Among them, the memory 905 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 905 includes a non-transitory computer-readable storage medium. The memory 905 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 905 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 905 may also be optionally at least one storage device located away from the aforementioned terminal processor 901. As Fig. 9 As shown, the memory 905 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a password verification program.

[0121] exist Fig. 9 In the terminal 900 shown, the user interface 903 is mainly used to provide an input interface for the user and obtain the data input by the user; and the terminal processor 901 can be used to call the password verification program stored in the memory 905 and specifically perform the following operations:

[0122] In response to a password verification request for a target password, determine ciphertext data for verifying the target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password;

[0123] Perform the first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified;

[0124] If they are consistent, the target password is further slow hashed to obtain the ciphertext data to be verified corresponding to the target password, and the legitimacy of the target password is verified based on the ciphertext data to be verified and the ciphertext data;

[0125] If they are inconsistent, the verification failure result corresponding to the target password is determined.

[0126] In some embodiments, when the terminal processor 901 verifies the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data, it specifically performs the following steps: verify whether the ciphertext data to be verified is consistent with the ciphertext data; if they are consistent, determine the verification success result corresponding to the target password; if they are inconsistent, determine the verification failure result corresponding to the target password.

[0127] In some embodiments, the terminal processor 901 further specifically performs the following steps: recording the consecutive number of password verification failure results corresponding to the ciphertext data; when the consecutive number reaches a preset number, ignoring the password verification request for the ciphertext data within a preset time period.

[0128] In the several embodiments provided in this specification, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0129] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0130] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of this specification is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state drives (SSD)), etc.

[0131] It should be noted that, for the convenience of description, the aforementioned method embodiments are all described as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0132] In addition, it should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the correct plaintext password, target password, ciphertext data, ciphertext data to be verified, etc. involved in this specification are all obtained with full authorization.

[0133] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0134] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0135] The above is a description of a password protection method, a password verification method, a device and a terminal provided in the embodiments of this specification. For technicians in this field, according to the ideas of the embodiments of this specification, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the embodiments of this specification.

Claims

1. A password protection method, the method comprising: In response to a storage request for a correct plaintext password, performing a slow hash calculation on the correct plaintext password; Determine a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and determine a second hash value of the correct plaintext password after the slow hash calculation; Concatenate the first Hash value and the second Hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data; The first hash value is used for performing a first consistency comparison with a first to-be-verified hash value obtained after the target password is subjected to the first hash calculation during password verification; The ciphertext data is used for a second consistency comparison with the ciphertext data to be verified obtained after the target password passes the slow hash calculation after the target password passes the first consistency comparison.

2. According to the method of claim 1, the determining of the first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation comprises: Determine a first calculation result of the correct plaintext password after the first hash calculation in the slow hash calculation, and select a first hash value from the first calculation result based on a preset selection logic.

3. A password verification method, the method comprising: In response to a password verification request for a target password, determine ciphertext data for verifying the target password, the ciphertext data being obtained by performing a slow hash calculation on a correct plaintext password; Performing a first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, verifying whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified; If they are consistent, continue to perform the slow hash calculation on the target password to obtain the ciphertext data to be verified corresponding to the target password, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data; If they are inconsistent, the verification failure result corresponding to the target password is determined.

4. The method according to claim 3, wherein the verifying the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data comprises: Verifying whether the ciphertext data to be verified is consistent with the ciphertext data; If they are consistent, determining the verification success result corresponding to the target password; If they are inconsistent, the verification failure result corresponding to the target password is determined.

5. The method according to claim 3, further comprising: Record the number of consecutive password verification failure results corresponding to the ciphertext data; When the consecutive times reach a preset number, the password verification request for the ciphertext data is ignored within a preset time period.

6. A password protection device, comprising: A storage request receiving module, configured to perform a slow hash calculation on a correct plaintext password in response to a storage request for the correct plaintext password; A first-stage calculation module, used to determine a first hash value of the correct plaintext password after the first hash calculation in the slow hash calculation, and to determine a second hash value of the correct plaintext password after the slow hash calculation; A second-stage calculation module, configured to concatenate the first Hash value and the second Hash value to obtain ciphertext data corresponding to the correct plaintext password, and store the ciphertext data; The first hash value is used for performing a first consistency comparison with a first to-be-verified hash value obtained after the target password is subjected to the first hash calculation during password verification; The ciphertext data is used for a second consistency comparison with the ciphertext data to be verified obtained after the target password passes the slow hash calculation after the target password passes the first consistency comparison.

7. A password verification device, comprising: A verification request receiving module, configured to determine, in response to a password verification request for a target password, ciphertext data for verifying the target password, wherein the ciphertext data is obtained by performing a slow hash calculation on a correct plaintext password; A first-stage verification module, configured to perform a first hash calculation in the slow hash calculation on the target password to obtain a first hash value to be verified corresponding to the target password, and verify whether the first hash value to be verified is consistent with the first hash value in the ciphertext data, and the calculation method of the first hash value is the same as that of the first hash value to be verified; The second-stage verification module is used to continue to perform the slow hash calculation on the target password to obtain the ciphertext data to be verified corresponding to the target password if they are consistent, and verify the legitimacy of the target password based on the ciphertext data to be verified and the ciphertext data; The verification result returning module is used to determine the verification failure result corresponding to the target password if they are inconsistent.

8. A computer program product comprising instructions, which, when executed on a computer or a processor, causes the computer or the processor to execute the steps of the method according to any one of claims 1 to 3 or 5 to 6.

9. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the method according to any one of claims 1-3 or 5-6.

10. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 3 or 5 to 6 when executing the computer program.

Images