IP unlocking method and device, equipment and medium

Abstract

The invention discloses an ip unlocking method and device, equipment and a medium, and relates to the technical field of computers, and the method comprises the following steps: obtaining first account information sent by an unlocking terminal; if second account information consistent with the first account information exists in a local database and a login ip corresponding to the current second account information is in a locked state, obtaining multiple pieces of unlocking password information sent by an unlocking terminal; if each piece of unlocking password information contains a preset target identifier, generating a corresponding to-be-verified unlocking password based on an unlocking password field carried by each piece of unlocking password information; and searching a preset legal unlocking password corresponding to the to-be-unlocked ip sent by the unlocking terminal from the local database, and if the to-be-verified unlocking password is consistent with the preset legal unlocking password, unlocking the to-be-unlocked ip. By means of the technical scheme, the situation that normal login operation is recognized as brute force cracking, and consequently login operation cannot be carried out again can be solved, and ip unlocking flexibility and safety are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an IP unlocking method, device, equipment and medium. Background Art

[0002] The way that the Web (World Wide Web) system identifies brute force attacks is generally simple. Through simple threshold settings, the number of failed login attempts of the IP (Internet Protocol, a protocol for interconnecting networks) is recorded and compared with the threshold. When the threshold is reached, the request is no longer responded to, so as to achieve the effect of resisting brute force attacks. For example, if there are more than 5 consecutive failed login attempts, it will be identified as a brute force attack and its subsequent login operations will no longer be accepted. When an IP is identified as a brute force attack, the current IP will be restricted from continuing to log in. Even if the password is just forgotten and it is not a brute force attack, it will be identified as a brute force attack. This one-size-fits-all behavior affects a series of operations such as login and use. At present, after most IPs are locked, the operator will contact the system administrator to unlock the operation. The system administrator needs to log in to the system to unlock the corresponding account or IP. The disadvantages are as follows: some systems may not have this function; the system administrator cannot be contacted in time, which seriously affects user use. This one-size-fits-all blocking method is not friendly to users who forget complex passwords.

[0003] It can be seen that how to solve the problem that a normal login operation is identified as a brute force crack, resulting in the inability to perform the login operation again, and how to improve the flexibility and security of IP unlocking are problems that technical personnel in this field need to solve. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide an IP unlocking method, device, equipment and medium, which can solve the situation where a normal login operation is identified as a brute force crack, resulting in the inability to perform the login operation again, and improve the flexibility and security of IP unlocking.

[0005] In a first aspect, the present application discloses an IP unlocking method, comprising:

[0006] Obtain the first account information sent by the unlocking terminal;

[0007] If there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, then obtaining multiple unlocking password information sent by the unlocking terminal;

[0008] If each of the unlocking password information contains a preset target identifier, then a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information;

[0009] The preset legal unlocking password corresponding to the to-be-unlocked IP sent by the unlocking terminal is searched from the local database, and if the to-be-verified unlocking password is consistent with the preset legal unlocking password, the to-be-unlocked IP is unlocked.

[0010] Optionally, before obtaining the first account information sent by the unlocking terminal, the method further includes:

[0011] The preset legal account and password information and IP lock conditions are saved to the local database; the legal account and password information includes the account information and the matching password information;

[0012] Obtaining a login request sent by the terminal to be logged in, and using the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking condition is currently met;

[0013] If the IP locking condition is currently met, the login IP of the terminal to be logged in is locked.

[0014] Optionally, the step of saving the preset legal account and password information and the IP lock condition to a local database includes:

[0015] Performing information processing on the account information and the matching password information and the IP locking condition in the legal account password information to obtain the processed legal account password information and the IP locking condition; the information processing includes encryption processing and hash processing;

[0016] The processed legal account password information and the IP locking condition are saved in the local database.

[0017] Optionally, the local database also includes automatic unlocking time;

[0018] Optionally, the IP unlocking method further includes:

[0019] Record the lock time of the login IP in the locked state;

[0020] If the time difference between the current time and the locking time is consistent with the automatic unlocking time, the login IP in the locked state is automatically unlocked.

[0021] Optionally, the local database also includes a login lock threshold;

[0022] Optionally, the using the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking condition is currently met, includes:

[0023] Determine the current target variable value corresponding to the login request for determining whether IP locking is required, and judge whether the current target variable value is less than the login locking threshold in the local database;

[0024] If the current target variable value is less than the login lock threshold, then calculating the similarity between the password information in the legal account password information and the password information in the login request, and updating the current target variable value based on the similarity;

[0025] If the updated current target variable value is not less than the login lock threshold, it is determined that the IP lock condition is currently met.

[0026] Optionally, calculating the similarity between the password information in the legitimate account password information and the password information in the login request, and updating the current target variable value based on the similarity includes:

[0027] Calculate the unsorted edit distance and the maximum number of characters between the password information in the legitimate account password information and the password information in the login request;

[0028] Sorting the password information in the legitimate account password information and the password information in the login request to calculate the sorting edit distance;

[0029] Calculating a first similarity for characterizing the degree of content similarity between the password information in the legitimate account password information and the password information in the login request using the sorting edit distance and the maximum number of characters;

[0030] Calculating a second similarity for characterizing the degree of similarity between the password information in the legitimate account password information and the password information in the login request using the unsorted edit distance and the maximum number of characters;

[0031] The current target variable value is updated based on the first similarity and the second similarity.

[0032] Optionally, updating the current target variable value based on the first similarity and the second similarity includes:

[0033] If the first similarity is less than a first similarity threshold, updating the current target variable value using the first similarity;

[0034] If the first similarity is equal to the first similarity threshold, and the second similarity is less than the second similarity threshold, then using the second similarity to update the current target variable value;

[0035] If the first similarity is equal to the first similarity threshold, and the second similarity is not less than the second similarity threshold, the current target variable value remains unchanged.

[0036] Optionally, the acquiring of multiple unlocking password information sent by the unlocking terminal; if each of the unlocking password information includes a preset target identifier, generating a corresponding unlocking password to be verified based on an unlocking password field carried by each of the unlocking password information, includes:

[0037] Acquire the unlocking password information sent by the unlocking terminal multiple times in succession, and perform identification detection on each of the unlocking password information;

[0038] If each of the unlocking password information contains a preset target identifier, the unlocking password fields carried by each of the unlocking password information are concatenated to generate a corresponding unlocking password to be verified.

[0039] Optionally, after searching the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal, the method further includes:

[0040] Determine whether the unlock password to be verified is consistent with the preset legal unlock password;

[0041] If the unlock password to be verified is inconsistent with the preset legal unlock password, the verification times and verification actions are recorded;

[0042] An alarm log is generated based on the verification times and the verification actions, so that an administrator can monitor the alarm log.

[0043] Optionally, after recording the number of verifications and the verification actions, the following further includes:

[0044] Determine whether the number of verifications reaches a preset verification number threshold;

[0045] If the number of verifications reaches a preset verification threshold, a load balancing algorithm is used to send a new unlock request sent by the unlocking terminal to a preset microservice, so that the preset microservice responds to the new unlock request and randomly returns request failure information and password error prompt information.

[0046] Optionally, after obtaining the first account information sent by the unlocking terminal, the method further includes:

[0047] Determine whether there is second account information consistent with the first account information in the local database;

[0048] If the second account information that is consistent with the first account information does not exist in the local database, an account information error prompt message is generated and returned to the unlocking terminal.

[0049] Optionally, after unlocking the IP to be unlocked, the method further includes:

[0050] Add the unlocked login IP to the local whitelist, and set the unlocked login IP to login with unlimited number of times within a preset fixed time.

[0051] In a second aspect, the present application discloses an electronic device, comprising:

[0052] Memory for storing computer programs;

[0053] The processor is used to load and execute the computer program to implement the aforementioned IP unlocking method.

[0054] In a third aspect, the present application discloses a computer program product, including a computer program / instruction, which implements the steps of the aforementioned IP unlocking method when executed by a processor.

[0055] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program implements the aforementioned IP unlocking method when executed by a processor.

[0056] It can be seen that the present application provides an IP unlocking method, including obtaining first account information sent by an unlocking terminal; if there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, then obtaining multiple unlocking password information sent by the unlocking terminal; if each of the unlocking password information contains a preset target identifier, then generating a corresponding unlocking password to be verified based on the unlocking password field carried by each of the unlocking password information; searching the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal, and if the unlocking password to be verified is consistent with the preset legal unlocking password, then releasing the lock on the IP to be unlocked. The present application obtains the first account information sent by the unlocking terminal, and determines whether there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state. The account information is stored in the local database, which can prevent malicious unlocking by internal personnel. If it exists, the unlocking password information of the preset target identifier and the carried unlocking password field are included to generate the corresponding unlocking password to be verified. The unlocking password to be verified is generated by using a specific preset target identifier and a corresponding unlocking password field, which is concealed and can ensure the security of the system. The preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database. If the unlocking password to be verified is consistent with the preset legal unlocking password, the lock of the IP to be unlocked is released, which can solve the problem that the normal login operation is identified as brute force cracking, resulting in the inability to log in again, thereby improving the flexibility and security of IP unlocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A flowchart of an IP unlocking method disclosed in this application;

[0059] Figure 2 A specific flow chart of IP locking disclosed in this application;

[0060] Figure 3 This is a system architecture diagram of an IP unlocking method disclosed in this application;

[0061] Figure 4 This is a flow chart of another IP unlocking method disclosed in this application;

[0062] Figure 5A specific flow chart of IP unlocking disclosed in this application;

[0063] Figure 6 This is a schematic diagram of the structure of an IP unlocking device disclosed in this application;

[0064] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] The way that a Web system identifies brute force cracking is generally relatively simple. Through a simple threshold setting, the number of failed IP logins is recorded and compared with the threshold. When the threshold is reached, the request is no longer responded to, so as to achieve the effect of resisting brute force attacks. For example, if the number of consecutive login attempts fails for more than 5 times, it will be identified as brute force cracking, and its subsequent login operations will no longer be accepted. When an IP is identified as a brute force cracking, the current IP's continued login operation will be restricted. Even if the password is just forgotten and it is not a brute force attack, it will be identified as a brute force attack. This one-size-fits-all behavior affects a series of operations such as login and use. At present, after most IPs are locked, the operator will contact the system administrator to unlock the operation. The system administrator needs to log in to the system to unlock the corresponding account or IP. The disadvantages are as follows: some systems may not have this function; the system administrator cannot be contacted in time, which seriously affects user use. This one-size-fits-all blocking method is not friendly to users who forget complex passwords. It can be seen that how to solve the problem that normal login operations are identified as brute force cracking, resulting in the inability to log in again, and improving the flexibility and security of IP unlocking are problems that technicians in this field need to solve.

[0067] See also Figure 1 As shown, the embodiment of the present invention discloses an IP unlocking method, which may specifically include:

[0068] Step S11: Obtain the first account information sent by the unlocking terminal.

[0069] In this embodiment, before obtaining the first account information sent by the unlocking terminal, it also includes: saving the preset legal account and password information and IP locking conditions to a local database; the legal account and password information includes account information and matching password information; obtaining a login request sent by the terminal to be logged in, and using the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking conditions are currently met; if the IP locking conditions are currently met, the login IP of the terminal to be logged in is locked.

[0070] Among them, saving the preset legal account and password information and IP locking conditions to the local database includes: performing information processing on the account information and the matching password information and the IP locking conditions in the legal account and password information to obtain the processed legal account and password information and the IP locking conditions; the information processing includes encryption processing and hash processing; and saving the processed legal account and password information and the IP locking conditions to the local database.

[0071] In addition, the local database also includes a login lock threshold. Accordingly, the use of the legal account password information to determine whether the account information and password information in the login request match to determine whether the IP lock condition is currently met includes: determining the current target variable value corresponding to the login request for determining whether the IP lock is required, and judging whether the current target variable value is less than the login lock threshold in the local database; if the current target variable value is less than the login lock threshold, calculating the similarity between the password information in the legal account password information and the password information in the login request, and updating the current target variable value based on the similarity; if the updated current target variable value is not less than the login lock threshold, determining that the IP lock condition is currently met.

[0072] In this embodiment, the process of calculating the similarity is as follows: calculate the unsorted edit distance and the maximum number of characters between the password information in the legal account and password information and the password information in the login request; sort the password information in the legal account and password information and the password information in the login request to calculate the sorted edit distance; use the sorted edit distance and the maximum number of characters to calculate a first similarity that is used to characterize the degree of content similarity between the password information in the legal account and password information and the password information in the login request; use the unsorted edit distance and the maximum number of characters to calculate a second similarity that is used to characterize the degree of password sequence similarity between the password information in the legal account and password information and the password information in the login request; and update the current target variable value based on the first similarity and the second similarity.

[0073] In this embodiment, the process of updating the current target variable value based on the first similarity and the second similarity is as follows: if the first similarity is less than the first similarity threshold, the current target variable value is updated using the first similarity; if the first similarity is equal to the first similarity threshold, and the second similarity is less than the second similarity threshold, the current target variable value is updated using the second similarity; if the first similarity is equal to the first similarity threshold, and the second similarity is not less than the second similarity threshold, the current target variable value remains unchanged.

[0074] The specific process of locking the login IP of the login terminal proposed in this application is as follows Figure 2 As shown, (1) the account information account in the legal account and password information, as well as the matching password information passwd, login lock threshold loginCount, preset legal unlock password unlockpasswd, and automatic unlock time autotime are set on the page and saved in the local database; (2) the user sends a login request from the terminal to be logged in (IPA) and tries to log in to accountA. When the login fails, the login failure information of IPA is recorded. The database fields are IP, account, and count, and the corresponding values ​​are IPA and accountA respectively. The current target variable value is x. There are records of IPA and accountA in the local database; (3) the unsorted edit distance distance_2 and the maximum number of characters max(len(str1), len(str2)) between the password information in the legal account and password information and the password information in the login request accountA are calculated. The password information in the legal account and password information and the password information in the login request are sorted by sorted() to calculate the sorted edit distance distance. The ratio between 1-sorted edit distance distance and the maximum number of characters max(len(str1), len(str2)) is the first similarity K1, and the formula is:

[0075] distance=Levenshtein.distance(sort_str1, sort_str2);

[0076] K1=1-(distance / max(len(str1),len(str2)));

[0077] If K1=1 at this time, it means that the password information in the legitimate account password information is the same as the password information in the login request accountA. That is to say, at this time, the maximum number of characters max(len(str1), len(str2)) = the number of characters in the legitimate account password information len(str1) = the number of characters in the password information in the login request accountA len(str2). Therefore, the ratio between 1-unsorted edit distance distance_2 and len(str1) or len(str2) can be directly used as the second similarity K2, the formula is:

[0078] distance_2=Levenshtein.distance(str1, str2);

[0079] K2=1-(distance_2 / max(len(str1));

[0080] or K2=1-(distance_2 / max(len(str2));

[0081] (4) Update the current target variable value x based on the first similarity K1 and the second similarity K2: if K1 is less than 1, then x=x+0.5+K1*05; if K1 is equal to 1 and K2 is less than 0.5, then x=x+K2; if K1 is equal to 1 and K2 is not less than 0.5, then x remains unchanged. When the loginCount is reached, it is determined that the current IP lock condition is met and the request is discarded. All requests from IPA before unlocking are considered risky requests and are no longer processed; (5) When the user attempts to log in to accountA on IPA and the login is successful, the IPA login failure record data for accountA is deleted.

[0082] Step S12: If there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, then obtain multiple unlocking password information sent by the unlocking terminal.

[0083] Step S13: if each of the unlocking password information contains a preset target identifier, then a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information.

[0084] Step S14: searching the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal, and if the unlocking password to be verified is consistent with the preset legal unlocking password, unlocking the IP to be unlocked.

[0085] The system architecture of this application is as follows Figure 3 As shown, it includes a web (World Wide Web, global wide area network) user interface, a server, and a database storage. Users set account and password information, log in, and attempt to unblock through the web page; the server receives the account and password information set on the web page, and stores it in the database after a series of processing such as encryption and hashing on the server, and modifies the failure count of IP login to a certain account in the database according to the correctness of the password; the progress and success of the unblocking operation will be recorded in the memory; the data storage, that is, the database, saves the account and password information mentioned above. Login failure count. Subsequent user login operations or attacker's brute force cracking operations can be performed through the web login interface. After the server identifies it as a brute force cracking, it will store the blocked IP and account information in the database. When the blocked IP accesses again through the web, its request will be discarded, and no response will be given regardless of whether the password is correct or not.

[0086] In this embodiment, first account information sent by the unlocking terminal is obtained; if second account information consistent with the first account information exists in the local database, and the login IP corresponding to the second account information is currently in a locked state, multiple unlocking password information sent by the unlocking terminal is obtained; if each of the unlocking password information contains a preset target identifier, a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information; the preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database, and if the unlocking password to be verified is consistent with the preset legal unlocking password, the lock on the IP to be unlocked is released. The present application obtains the first account information sent by the unlocking terminal, and determines whether there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state. The account information is stored in the local database, which can prevent malicious unlocking by internal personnel. If it exists, the unlocking password information of the preset target identifier and the carried unlocking password field are included to generate the corresponding unlocking password to be verified. The unlocking password to be verified is generated by using a specific preset target identifier and a corresponding unlocking password field, which is concealed and can ensure the security of the system. The preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database. If the unlocking password to be verified is consistent with the preset legal unlocking password, the lock of the IP to be unlocked is released, which can solve the problem that the normal login operation is identified as brute force cracking, resulting in the inability to log in again, thereby improving the flexibility and security of IP unlocking.

[0087] See also Figure 4 As shown, the embodiment of the present invention discloses an IP unlocking method, which may specifically include:

[0088] Step S21: obtaining the first account information sent by the unlocking terminal, and determining whether there is second account information consistent with the first account information in the local database.

[0089] Step S22: If the second account information that is consistent with the first account information does not exist in the local database, an account information error prompt message is generated and returned to the unlocking terminal.

[0090] Step S23: If there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, then obtain multiple unlocking password information sent by the unlocking terminal.

[0091] Step S24: if each of the unlocking password information contains a preset target identifier, then a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information.

[0092] In this embodiment, if there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, the unlocking password information sent by the unlocking terminal for multiple consecutive times is obtained, and an identification detection is performed on each of the unlocking password information. If each of the unlocking password information contains a preset target identification, the unlocking password fields carried by each of the unlocking password information are spliced ​​to generate a corresponding unlocking password to be verified.

[0093] The present invention generates a corresponding unlocking password to be verified by presetting a target identifier and an unlocking password field, thereby performing subsequent unlocking operations, which is concealed, does not display any interface or prompt to attackers, ensures system security, and only unlocks the specified IP to be unlocked, rather than unlocking all IPs logged into the account, thereby avoiding internal brute force cracking.

[0094] Step S25: Search the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal. If the unlocking password to be verified is consistent with the preset legal unlocking password, unlock the IP to be unlocked, add the unlocked login IP to the local whitelist, and set the unlocked login IP to login for an unlimited number of times within a preset fixed time.

[0095] In this embodiment, the preset legal unlock password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database to determine whether the unlock password to be verified is consistent with the preset legal unlock password. If the unlock password to be verified is inconsistent with the preset legal unlock password, the verification times and verification actions are recorded, and an alarm log is generated based on the verification times and verification actions so that the administrator can monitor the alarm log; if the unlock password to be verified is consistent with the preset legal unlock password, the lock on the IP to be unlocked is released. If the unlocking mark is leaked, it needs to be updated and notified to all account users. Through log analysis, whether malicious unlocking has occurred and whether the unlocking mark needs to be replaced can be improved to improve the confidentiality of unlocking.

[0096] Furthermore, after recording the number of verification times and the verification action, it also includes: determining whether the number of verification times reaches a preset verification times threshold; if the number of verification times reaches the preset verification times threshold, a load balancing algorithm is used to send a new unlock request sent by the unlocking terminal to a preset microservice, so that the preset microservice responds to the new unlock request and randomly returns request failure information and password error prompt information.

[0097] The present invention includes two microservices, microservice 1 is a microservice for normal business, and microservice 2 is a microservice for processing multiple IP unlocking requests. For requests with too many unlocking times, a new unlocking request sent by the unlocking terminal is loaded to microservice 2 through a load balancing algorithm. Microservice 2 responds to the new unlocking request and randomly returns login failure information, prompts password errors and other information to avoid leaking the real content of microservice 1 and consuming attack resources at the same time. The present invention processes brute force cracking requests through independent microservice 2, and no longer consumes normal login microservice resources.

[0098] In addition, the local database also includes the automatic unlocking time; accordingly, the IP unlocking method also includes: recording the locking time of the login IP in the locked state; if the time difference between the current time and the locking time is consistent with the automatic unlocking time, the login IP in the locked state is automatically unlocked. After the IP is locked, if the user forgets the preset legal unlocking password, the system can also automatically unlock the locked IP after the automatic unlocking time has passed.

[0099] In this embodiment, the specific process of releasing the IP lock is as follows: Figure 5As shown: (1) When the terminal IPA to be logged in meets the IP locking condition and has been locked, you can use other access terminals (i.e., unlocking terminal IPB) to perform the unlocking operation and obtain the first account information sent by the unlocking terminal IPB, where the first account information needs to be consistent with the accountA to be logged in and locked; (2) Parse the password field: obtain and parse multiple unlock password information sent by the unlocking terminal, and classify the unlocking; (3) If the unlock password information contains a preset target identifier, such as "unlock", determine whether to enter the unlocking process. The unlocking process requires entering the preset target identifier "unlock" + unlock password field unlockpasswd[i] multiple times until the complete unlock password to be verified unlockpasswd_new is spelled out, and the password starting with unlock will not It is recorded as a login failure to ensure that the unlocking operation is completed; if the preset target identifier of the password exists in the unlocking password information, the unlocking password to be verified is directly updated; (3) After unlockpasswd_new has been entered, the preset target IP identifier unlockip+unlocking IP is required in the login information password, and the preset legal unlocking password unlockpasswd corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database, and the unlocking password to be verified unlockpasswd_new and the preset legal unlocking password unlockpasswd are compared to see if they are the same. If the passwords are different, it is considered that the login has failed once, and the above process is repeated; (4) If they are the same, the lock on the IP to be unlocked is released, and the IP to be unlocked can be added to the whitelist later, and its login times are no longer restricted. The successfully unlocked IP is set as the login whitelist of a fixed account within a fixed time to avoid repeated unlocking operations after multiple attempts.

[0100] In this embodiment, first account information sent by the unlocking terminal is obtained; if second account information consistent with the first account information exists in the local database, and the login IP corresponding to the second account information is currently in a locked state, multiple unlocking password information sent by the unlocking terminal is obtained; if each of the unlocking password information contains a preset target identifier, a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information; the preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database, and if the unlocking password to be verified is consistent with the preset legal unlocking password, the lock on the IP to be unlocked is released. The present application obtains the first account information sent by the unlocking terminal, and determines whether there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state. The account information is stored in the local database, which can prevent malicious unlocking by internal personnel. If it exists, the unlocking password information of the preset target identifier and the carried unlocking password field are included to generate the corresponding unlocking password to be verified. The unlocking password to be verified is generated by using a specific preset target identifier and a corresponding unlocking password field, which is concealed and can ensure the security of the system. The preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database. If the unlocking password to be verified is consistent with the preset legal unlocking password, the lock of the IP to be unlocked is released, which can solve the problem that the normal login operation is identified as brute force cracking, resulting in the inability to log in again, thereby improving the flexibility and security of IP unlocking.

[0101] See also Figure 6 As shown, the embodiment of the present invention discloses an IP unlocking device, which may specifically include:

[0102] A first account information acquisition module 11, used to acquire the first account information sent by the unlocking terminal;

[0103] The unlocking password information acquisition module 12 is used to acquire multiple unlocking password information sent by the unlocking terminal if there is a second account information consistent with the first account information in the local database and the login IP corresponding to the second account information is currently in a locked state;

[0104] The unlocking password to be verified generating module 13 is used to generate the corresponding unlocking password to be verified based on the unlocking password field carried by each of the unlocking password information if each of the unlocking password information contains a preset target identifier;

[0105] The IP unlocking module 14 is used to search the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal, and if the unlocking password to be verified is consistent with the preset legal unlocking password, unlocking the IP to be unlocked.

[0106] In this embodiment, first account information sent by the unlocking terminal is obtained; if second account information consistent with the first account information exists in the local database, and the login IP corresponding to the second account information is currently in a locked state, multiple unlocking password information sent by the unlocking terminal is obtained; if each of the unlocking password information contains a preset target identifier, a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information; the preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database, and if the unlocking password to be verified is consistent with the preset legal unlocking password, the lock on the IP to be unlocked is released. The present application obtains the first account information sent by the unlocking terminal, and determines whether there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state. The account information is stored in the local database, which can prevent malicious unlocking by internal personnel. If it exists, the unlocking password information of the preset target identifier and the carried unlocking password field are included to generate the corresponding unlocking password to be verified. The unlocking password to be verified is generated by using a specific preset target identifier and a corresponding unlocking password field, which is concealed and can ensure the security of the system. The preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal is searched from the local database. If the unlocking password to be verified is consistent with the preset legal unlocking password, the lock of the IP to be unlocked is released, which can solve the problem that the normal login operation is identified as brute force cracking, resulting in the inability to log in again, thereby improving the flexibility and security of IP unlocking.

[0107] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0108] A saving module is used to save the preset legal account and password information and IP lock conditions to a local database; the legal account and password information includes account information and matching password information;

[0109] A matching module, used to obtain a login request sent by the terminal to be logged in, and use the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking condition is currently met;

[0110] The locking module is used to lock the login IP of the terminal to be logged in if the IP locking condition is currently met.

[0111] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0112] An information processing module, used for performing information processing on the account information and the matching password information and the IP locking condition in the legal account password information to obtain the processed legal account password information and the IP locking condition; the information processing includes encryption processing and hash processing;

[0113] The information and condition saving module is used to save the processed legal account password information and the IP locking condition to the local database.

[0114] In some specific embodiments, the IP unlocking device further includes:

[0115] The lock time recording module is used to record the lock time of the login IP in the locked state;

[0116] The automatic unlocking module is used to automatically unlock the login IP in a locked state if the time difference between the current time and the locking time is consistent with the automatic unlocking time.

[0117] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0118] A current target variable value judgment module is used to determine the current target variable value corresponding to the login request for determining whether IP locking is required, and to determine whether the current target variable value is less than the login locking threshold in the local database;

[0119] A similarity calculation module, configured to calculate the similarity between the password information in the legal account password information and the password information in the login request if the current target variable value is less than the login lock threshold, and update the current target variable value based on the similarity;

[0120] The locking condition determination module is used to determine whether the IP locking condition is currently met if the updated current target variable value is not less than the login locking threshold.

[0121] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0122] An unsorted edit distance calculation module, used to calculate the unsorted edit distance and the maximum number of characters between the password information in the legal account password information and the password information in the login request;

[0123] A sorting edit distance calculation module, used to sort the password information in the legal account password information and the password information in the login request to calculate the sorting edit distance;

[0124] A first similarity calculation module, used to calculate a first similarity for representing the degree of content similarity between the password information in the legal account password information and the password information in the login request by using the sorting edit distance and the maximum number of characters;

[0125] A second similarity calculation module, used to calculate a second similarity for characterizing the degree of similarity between the password information in the legitimate account password information and the password information in the login request by using the unsorted edit distance and the maximum number of characters;

[0126] A current target variable value updating module is used to update the current target variable value based on the first similarity and the second similarity.

[0127] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0128] A first updating module, configured to update the current target variable value using the first similarity if the first similarity is less than a first similarity threshold;

[0129] A second updating module, configured to update the current target variable value using the second similarity if the first similarity is equal to the first similarity threshold and the second similarity is less than a second similarity threshold;

[0130] The third updating module is configured to keep the current target variable value unchanged if the first similarity is equal to the first similarity threshold and the second similarity is not less than the second similarity threshold.

[0131] In some specific embodiments, the unlocking password information obtaining module 12 may specifically include:

[0132] The identification detection module is used to obtain the unlocking password information sent by the unlocking terminal for multiple times in succession, and perform identification detection on each of the unlocking password information.

[0133] In some specific embodiments, the to-be-verified unlocking password generating module 13 may specifically include:

[0134] The splicing module is used for splicing the unlocking password fields carried by each of the unlocking password information to generate a corresponding unlocking password to be verified if each of the unlocking password information contains a preset target identifier.

[0135] In some specific embodiments, the IP unlocking module 14 may specifically include:

[0136] The unlock password to be verified is judged by a module for judging whether the unlock password to be verified is consistent with the preset legal unlock password;

[0137] A verification times recording module is used to record the verification times and verification actions if the unlock password to be verified is inconsistent with the preset legal unlock password;

[0138] The alarm log generation module is used to generate an alarm log based on the verification times and the verification actions, so that the administrator can monitor the alarm log.

[0139] In some specific embodiments, the IP unlocking module 14 may specifically include:

[0140] A verification number determination module is used to determine whether the verification number reaches a preset verification number threshold;

[0141] A new unlock request sending module is used to use a load balancing algorithm to send the new unlock request sent by the unlock terminal to a preset microservice if the number of verification times reaches a preset verification times threshold, so that the preset microservice responds to the new unlock request and randomly returns request failure information and password error prompt information.

[0142] In some specific embodiments, the first account information obtaining module 11 may specifically include:

[0143] A second account information determination module, used to determine whether there is second account information consistent with the first account information in the local database;

[0144] The account information error prompt information generating module is used to generate and return account information error prompt information to the unlocking terminal if the second account information consistent with the first account information does not exist in the local database.

[0145] In some specific embodiments, the IP unlocking module 14 may specifically include:

[0146] The whitelist adding and setting module is used to add the unlocked login IP to the local whitelist, and set the unlocked login IP to log in unlimited times within a preset fixed time.

[0147] Furthermore, the present application also discloses an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0148] Figure 7The present invention provides a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the IP unlocking method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be a computer.

[0149] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0150] In addition, the memory 22 as a carrier for resource storage may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The data 223 may include various data. The storage method may be temporary storage or permanent storage.

[0151] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the IP unlocking method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0152] Furthermore, the embodiment of the present application also discloses a computer-readable storage medium, wherein the computer-readable storage medium mentioned here includes a random access memory (Random Access Memory, RAM), a memory, a read-only memory (Read-Only Memory, ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk or an optical disk, or any other form of storage medium known in the technical field. Wherein, the computer program implements the aforementioned ****** method when executed by the processor. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0153] Furthermore, an embodiment of the present application also provides a computer program product, including a computer program / instruction, which implements any implementation method of the above-mentioned IP unlocking method when executed by a processor.

[0154] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0155] The steps of the IP unlocking method or algorithm described in the embodiments disclosed herein can be implemented directly by hardware, software modules executed by a processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0156] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0157] The above is a detailed introduction to an IP unlocking method, device, equipment and medium provided by the present invention. Specific examples are used in this article to illustrate the principle and implementation of the present invention. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. An IP unlocking method, characterized in that: include: Obtain the first account information sent by the unlocking terminal; If there is second account information consistent with the first account information in the local database, and the login IP corresponding to the second account information is currently in a locked state, then obtaining multiple unlocking password information sent by the unlocking terminal; If each of the unlocking password information contains a preset target identifier, then a corresponding unlocking password to be verified is generated based on the unlocking password field carried by each of the unlocking password information; The preset legal unlocking password corresponding to the to-be-unlocked IP sent by the unlocking terminal is searched from the local database, and if the to-be-verified unlocking password is consistent with the preset legal unlocking password, the to-be-unlocked IP is unlocked.

2. The IP unlocking method according to claim 1, characterized in that: Before obtaining the first account information sent by the unlocking terminal, the method further includes: The preset legal account and password information and IP lock conditions are saved to the local database; the legal account and password information includes the account information and the matching password information; Obtaining a login request sent by the terminal to be logged in, and using the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking condition is currently met; If the IP locking condition is currently met, the login IP of the terminal to be logged in is locked.

3. The IP unlocking method according to claim 2, characterized in that: The method of saving the preset legal account password information and IP lock conditions to the local database includes: Performing information processing on the account information and the matching password information and the IP locking condition in the legal account password information to obtain the processed legal account password information and the IP locking condition; the information processing includes encryption processing and hash processing; The processed legal account password information and the IP locking condition are saved in the local database.

4. The IP unlocking method according to claim 2, characterized in that: The local database also includes automatic unlocking time; Correspondingly, the IP unlocking method further includes: Record the lock time of the login IP in the locked state; If the time difference between the current time and the locking time is consistent with the automatic unlocking time, the login IP in the locked state is automatically unlocked.

5. The IP unlocking method according to claim 2, characterized in that: The local database also includes a login lock threshold; Correspondingly, the use of the legal account and password information to determine whether the account information and password information in the login request match, so as to determine whether the IP locking condition is currently met, includes: Determine the current target variable value corresponding to the login request for determining whether IP locking is required, and judge whether the current target variable value is less than the login locking threshold in the local database; If the current target variable value is less than the login lock threshold, then calculating the similarity between the password information in the legal account password information and the password information in the login request, and updating the current target variable value based on the similarity; If the updated current target variable value is not less than the login lock threshold, it is determined that the IP lock condition is currently met.

6. The IP unlocking method according to claim 5, characterized in that: The calculating the similarity between the password information in the legal account password information and the password information in the login request, and updating the current target variable value based on the similarity, includes: Calculate the unsorted edit distance and the maximum number of characters between the password information in the legitimate account password information and the password information in the login request; Sorting the password information in the legitimate account password information and the password information in the login request to calculate the sorting edit distance; Calculating a first similarity for characterizing the degree of content similarity between the password information in the legitimate account password information and the password information in the login request using the sorting edit distance and the maximum number of characters; Calculating a second similarity for characterizing the degree of similarity between the password information in the legitimate account password information and the password information in the login request using the unsorted edit distance and the maximum number of characters; The current target variable value is updated based on the first similarity and the second similarity.

7. The IP unlocking method according to claim 6, characterized in that: The updating of the current target variable value based on the first similarity and the second similarity includes: If the first similarity is less than a first similarity threshold, updating the current target variable value using the first similarity; If the first similarity is equal to the first similarity threshold, and the second similarity is less than the second similarity threshold, then using the second similarity to update the current target variable value; If the first similarity is equal to the first similarity threshold, and the second similarity is not less than the second similarity threshold, the current target variable value remains unchanged.

8. The IP unlocking method according to claim 1, characterized in that: The acquiring of multiple unlocking password information sent by the unlocking terminal; if each of the unlocking password information contains a preset target identifier, generating a corresponding unlocking password to be verified based on the unlocking password field carried by each of the unlocking password information, includes: Acquire the unlocking password information sent by the unlocking terminal multiple times in succession, and perform identification detection on each of the unlocking password information; If each of the unlocking password information contains a preset target identifier, the unlocking password fields carried by each of the unlocking password information are concatenated to generate a corresponding unlocking password to be verified.

9. The IP unlocking method according to claim 1, characterized in that: After searching the local database for a preset legal unlocking password corresponding to the IP to be unlocked sent by the unlocking terminal, the method further includes: Determine whether the unlock password to be verified is consistent with the preset legal unlock password; If the unlock password to be verified is inconsistent with the preset legal unlock password, the verification times and verification actions are recorded; An alarm log is generated based on the verification times and the verification actions, so that an administrator can monitor the alarm log.

10. The IP unlocking method according to claim 9, characterized in that: After recording the number of verifications and the verification actions, the following is also included: Determine whether the number of verifications reaches a preset verification number threshold; If the number of verifications reaches a preset verification threshold, a load balancing algorithm is used to send a new unlock request sent by the unlocking terminal to a preset microservice, so that the preset microservice responds to the new unlock request and randomly returns request failure information and password error prompt information.

11. The IP unlocking method according to claim 1, characterized in that: After obtaining the first account information sent by the unlocking terminal, the method further includes: Determine whether there is second account information consistent with the first account information in the local database; If the second account information that is consistent with the first account information does not exist in the local database, an account information error prompt message is generated and returned to the unlocking terminal.

12. The IP unlocking method according to any one of claims 1 to 11, characterized in that: After unlocking the IP to be unlocked, the method further includes: Add the unlocked login IP to the local whitelist, and set the unlocked login IP to login with unlimited number of times within a preset fixed time.

13. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to load and execute the computer program to implement the IP unlocking method according to any one of claims 1 to 12.

14. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the IP unlocking method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein the computer program, when executed by a processor, implements the IP unlocking method according to any one of claims 1 to 12.

Images