Method, device and electronic device for strengthening existing password storage and transmission architecture

Abstract

The present application relates to a method, device and electronic device for reinforcing an existing password storage and transmission architecture. The method includes obtaining the first hash algorithm corresponding to the current password processing method to be reinforced, constructing a second hash algorithm based on the first hash algorithm, using the second hash algorithm to calculate the password hash value stored in the password processing method to be reinforced, obtaining a new password hash value, using the first hash algorithm and the second hash algorithm to calculate the new password to be stored, and obtaining the corresponding new input password hash value, and storing the new input password hash value. This method can solve the technical problems that arise when using a new password scheme to reinforce an old system with a large number of users, while effectively increasing the time difficulty of brute force cracking and supporting the salting measures of the original hash algorithm.

Description

Technical Field

[0001] The present application relates to the field of password security, and in particular to a method, device and electronic device for reinforcing an existing password storage and transmission architecture. Background Art

[0002] For a mature system backend, the user's login password is not allowed to be stored in plain text. Instead, a hash algorithm is used to store the hash value. Generally, MD5, SHA-1, SHA-256, etc. are used. The common feature of these algorithms is that they are irreversible, that is, the original user password plain text cannot be deduced from the password hash value stored in the backend database. The traditional password verification mechanism is that the backend will generate a hash value for the password plain text sent by the front end through a specific hash algorithm for password storage and login verification. Since the password sent from the front end to the back end is plain text, although this path is encrypted and protected by https, it is still relatively weak. It is not ruled out that hackers can intercept the password plain text of users with weak awareness of prevention through middleman attacks such as tampering with certificates.

[0003] When reinforcing the existing password storage and transmission architecture, the general solution is that the front end will use a new round of hash algorithm to generate a password hash value as the transmission password, so that even if the password transmitted from the front end to the back end is intercepted, it is difficult to crack the password plain text. However, for a system that already has a large number of users using a traditional password verification mechanism, when upgrading and reinforcing the system using a general solution, there will be a technical problem that the user experience must be destroyed in order to reinforce the security of existing users. Summary of the invention

[0004] In view of this, the present application proposes a method for reinforcing the existing password storage and transmission architecture to solve the problems embodied in the above-mentioned background technology.

[0005] According to one aspect of the present application, a method for reinforcing an existing password storage and transmission architecture is provided, comprising the following steps:

[0006] Obtaining a first hash algorithm corresponding to the current password processing method to be reinforced;

[0007] Constructing a second Hash algorithm according to the first Hash algorithm;

[0008] The password hash value stored in the password processing method to be strengthened is calculated by using the second hash algorithm to obtain a new password hash value;

[0009] Using the first hash algorithm and the second hash algorithm to calculate the new password to be stored, and obtain the corresponding new input password hash value;

[0010] Storing the newly input password hash value;

[0011] The first hash algorithm and the second hash algorithm satisfy the following conditions:

[0012] When the first Hash algorithm and the second Hash algorithm are used simultaneously to perform hash calculation on the same content, the results obtained are the same even if the execution order of the first Hash algorithm and the second Hash algorithm is different.

[0013] As an optional implementation scheme of the present application, optionally, constructing a second Hash algorithm according to the first Hash algorithm includes:

[0014] A second Hash algorithm that is the same as the first Hash algorithm is constructed based on the first Hash algorithm.

[0015] As an optional implementation scheme of the present application, optionally, the password hash value stored in the password processing method to be strengthened is calculated using the second hash algorithm to obtain a new password hash value, including:

[0016] The backend obtains the password hash value stored in the password processing method to be strengthened from the database;

[0017] The back-end script uses the second hash algorithm to calculate the password hash value stored in the password processing method to be strengthened to obtain a new password hash value.

[0018] As an optional implementation scheme of the present application, optionally, the first hash algorithm and the second hash algorithm are used to calculate the new password to be stored, and the corresponding new input password hash value is obtained, including:

[0019] The front end uses the second hash algorithm to calculate the new password to be stored to obtain the first encrypted password hash value;

[0020] The backend uses the first hash algorithm to calculate the first encrypted password hash value to obtain the corresponding new input password hash value.

[0021] As an optional implementation scheme of the present application, optionally, constructing a second hash algorithm that is the same as the first hash algorithm further includes:

[0022] The second Hash algorithm and the first Hash algorithm have the same execution results when executing the same content in different orders.

[0023] As an optional implementation scheme of the present application, optionally, the first Hash algorithm is used as the basis for construction, including:

[0024] The first Hash algorithm is nested multiple times to obtain the second Hash algorithm.

[0025] As an optional implementation scheme of the present application, optionally, the structure is based on the first hash algorithm and further includes:

[0026] Necessary parameters of the first hash algorithm and the second hash algorithm;

[0027] There are two necessary parameters for constructing the second hash algorithm, namely the password and the "salt".

[0028] According to the second aspect of the present application, a device for reinforcing the existing password storage and transmission architecture is provided, comprising the following modules:

[0029] A hash algorithm acquisition module is used to acquire a first hash algorithm corresponding to the current password processing method to be reinforced;

[0030] An algorithm construction module, used to construct a second Hash algorithm according to the first Hash algorithm;

[0031] An execution algorithm module is used to calculate the password hash value stored in the password processing method to be strengthened and the new password to be stored;

[0032] The password hash value storage module is used to store new password hash values.

[0033] As an optional implementation scheme of the present application, optionally, the algorithm construction module includes:

[0034] A parameter transmission module, used for transmitting necessary parameters of the first hash algorithm and the second hash algorithm;

[0035] An algorithm construction module is used to construct the first Hash algorithm to obtain the second Hash algorithm.

[0036] According to the third aspect of the present application, an electronic device is proposed, comprising:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to implement the above-mentioned method for reinforcing the existing password storage and transmission architecture when executing the executable instructions.

[0040] Beneficial effects of this application:

[0041] In the present invention, the existing password is encrypted once by using the constructed second hash algorithm, so that when the existing password storage and transmission architecture is reinforced, the old solution can be uniformly upgraded to the new solution, without the need for existing users to reset their passwords, and without the need for new and old users to use their own solutions. When the solution is upgraded, the backend only needs to use a script to perform a round of calculations on the password hash values ​​in the existing database and refresh the database, which meets the requirements of the front-end slow hash algorithm and greatly improves the time difficulty of brute force cracking. Except that the logic of adding salt requires the addition of a salt-taking API, the backend code does not need to be changed at all, and the database table structure does not need to be changed at all, and the salting measures of the original hash algorithm are supported.

[0042] Other features and aspects of the present application will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present application and, together with the description, serve to explain the principles of the present application.

[0044] Figure 1 A flow chart showing a method for reinforcing an existing password storage and transmission architecture according to an embodiment of the present application;

[0045] Figure 2 A flowchart showing a method for strengthening the existing password storage and transmission architecture according to an embodiment of the present application for registering a new user or modifying a password;

[0046] Figure 3 The process of using a script in the backend when upgrading the old solution of the reinforcement method for the existing password storage and transmission architecture according to the embodiment of the present application to the new solution is shown;

[0047] Figure 4 A block diagram of a device for reinforcing an existing password storage and transmission architecture according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0048] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0049] Among them, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise", "axial", "radial", "circumferential" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application or simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0050] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0051] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0052] In the existing password preservation and reinforcement methods, the password is generally encrypted and saved using a back-end hash algorithm or using different hash algorithms at the front and back ends. This application proposes a method of reinforcing the existing password preservation method by constructing a front-end hash algorithm for password encryption based on a back-end hash algorithm. In addition, in order to better illustrate this application, many specific details are given in the specific implementation methods below. Those skilled in the art should understand that the present application can also be implemented without certain specific details. In some instances, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of this application.

[0053] Example 1

[0054] Figure 1 A flowchart of a method for reinforcing an existing password storage and transmission architecture according to an embodiment of the present application is shown. Figure 1 As shown, the flow chart includes:

[0055] S100. Obtain a first hash algorithm corresponding to the current password processing method to be reinforced.

[0056] In this embodiment, the front end needs to obtain the first hash algorithm corresponding to the current password processing method to be reinforced, so as to generate a new password to be stored as a password hash value.

[0057] S200: Construct a second Hash algorithm according to the first Hash algorithm.

[0058] In this embodiment, the first hash algorithm is an encryption algorithm used at the back end, and the second hash algorithm is a hash algorithm used at the front end. The general password reinforcement method is that the front end and the back end use different hash algorithms to encrypt the password. In this application, the second hash algorithm hashB at the front end is constructed based on the first hash algorithm hashA at the back end to reinforce the password. The specific principle is: for two different hash algorithms hashA and hashB, in principle, hashA(hashB(X)) is not equal to hashB(hashA(X)). However, if the front end and the back end use the same hash algorithm, that is, hashA is equal to hashB, then the nesting of the two layers of hash functions becomes hashA(hashA(X)). In this case, the commutative law of the front end and the back end hash functions is naturally satisfied, that is, XAB is equal to XBA (essentially XAA is equal to XAA).

[0059] S300: Using the second hash algorithm to calculate the password hash value stored in the password processing method to be strengthened, to obtain a new password hash value.

[0060] In this embodiment, the backend obtains the password hash value to be reinforced that is stored in the database, and the backend uses the script to calculate the password hash value using the second hash algorithm to obtain a reinforced new password hash value.

[0061] S400: Use the first hash algorithm and the second hash algorithm to calculate the new password to be stored, and obtain the corresponding new input password hash value.

[0062] In this embodiment, the front end receives the new password input by the user and uses the second hash algorithm to calculate the new password, and transmits the calculated result to the back end. After the back end obtains the calculation result, it uses the first hash algorithm to calculate and obtain the hash value of the newly input password.

[0063] S500: Store the newly input password hash value.

[0064] In this embodiment, the backend stores the new password hash value and the new input password hash value obtained by calculation into a database.

[0065] As an optional implementation scheme of the present application, optionally, in step S200, constructing a second Hash algorithm according to the first Hash algorithm includes:

[0066] Based on the first hash algorithm, a second hash algorithm identical to the first hash algorithm is constructed, and the second hash algorithm and the first hash algorithm have the same execution results when the execution order of the same content is different. According to the mathematical principle of the commutative law of the front-end and back-end hash functions, as long as the hash algorithm hashB used by the front end is the same as the hash algorithm hashA used by the back end, for example, if the back end uses MD5, the front end also uses the MD5 algorithm.

[0067] As an optional implementation scheme of the present application, optionally, in step S300, the password hash value stored in the password processing method to be strengthened is calculated using the second hash algorithm to obtain a new password hash value, including:

[0068] The back end obtains the password hash value stored in the password processing method to be strengthened from the database.

[0069] In order to strengthen the stored password hash value, the backend needs to obtain the password hash value stored in the password processing method to be strengthened in the database.

[0070] The back-end script uses the second hash algorithm to calculate the password hash value stored in the password processing method to be strengthened to obtain a new password hash value.

[0071] The backend code and database table structure do not need to be modified. You only need to use a script to retrieve the password hash values ​​XA of all existing users from the database, and then use hashB to perform a hash calculation on XA to obtain the result XAB, which is saved back to the original location as XBA. Figure 3 , the backend script obtains the hash value of the existing user's old password from the database. After the database returns the result to the backend, the backend uses the second hash algorithm to recalculate the hash value and finally stores the result in the original location.

[0072] As an optional implementation scheme of the present application, optionally, in step S400, the new password to be stored is calculated using the first hash algorithm and the second hash algorithm, and the corresponding new input password hash value is obtained, including:

[0073] The front end uses the second hash algorithm to calculate the new password to be stored to obtain the first encrypted password hash value, that is, the front end performs a hash calculation on the password plaintext and transmits the password hash value XB to the back end, such as Figure 2 The front end waits for the user to input the plain text password, uses the second hash algorithm to calculate the plain text password, and transmits the calculation result to the back end after obtaining the calculation result.

[0074] The backend uses the first hash algorithm to calculate the first encrypted password hash value to obtain the corresponding new input password hash value. That is, after the backend receives the first encrypted password hash value transmitted by the front end to the backend, it uses the first hash algorithm to encrypt the newly input password for the second time to obtain the corresponding new input password hash value.

[0075] As an optional implementation scheme of the present application, optionally, in step S500, storing the newly input password hash value includes:

[0076] A new password hash value obtained by calculating the password hash value stored in the password processing method to be strengthened by using the second hash algorithm is stored in the original position of the password hash value stored in the password processing method to be strengthened in the database.

[0077] The hash value of the new input password obtained by calculating the new password to be stored using the first hash algorithm and the second hash algorithm is stored in the corresponding position of the database.

[0078] As an optional implementation scheme of the present application, optionally, the structure is based on the first hash algorithm and further includes:

[0079] The first Hash algorithm is nested multiple times to obtain the second Hash algorithm.

[0080] According to the advantage of slow hash algorithm that can effectively improve the time difficulty of brute force cracking, if the front end uses ordinary hash algorithm in order to meet the exchange rate of hash function, it can only be said that the security upgrade is partially achieved, but not complete, so it is necessary to construct a hash algorithm that can meet the exchangeability and take longer time.

[0081] According to the mathematical logic of the commutative law of the front-end and back-end hash functions mentioned above, the ordinary hash algorithm hashA of the back-end can be nested multiple times, that is, hashB(X)=hashA(hashA(hashA(hashA(X)))); Obviously, based on such a special construction, it is easy to prove that hashB(hashA(X)) is still equivalent to hashA(hashB(X)), that is, it still satisfies the commutative law of the front-end and back-end hash functions. As for the number of nested layers, there is no limit, which depends entirely on how much computing power you want to consume. According to experiments, 50-100 layers of MD5 algorithm nesting will not bring any perception to users, but greatly increase the time difficulty of brute force cracking. Similarly, the upgrade plan does not require any code changes in the back-end, nor does it require changes to the database table structure. It only needs to use a script to extract the password hash values ​​of all existing users from the database, and then use the second hash algorithm to perform a hash calculation, and the calculation result is used as the new password of the existing user after password reinforcement and stored back in place.

[0082] As an optional implementation scheme of the present application, optionally, the first hash algorithm is multiple-nested to obtain the second hash algorithm, further comprising:

[0083] Necessary parameters of the first hash algorithm and the second hash algorithm.

[0084] The password and "salt" are necessary parameters for the first hash algorithm and the second hash algorithm. The password is the plain text password entered by the user or the transmission password transmitted from the front end to the back end or the password hash value stored in the existing database. The salt is randomly generated by the back end and recorded in the database in plain text. Because the password is generally not directly hashed with the user's plain text password, but a random "salt" is mixed into the plain text.

[0085] There are two necessary parameters for constructing the second hash algorithm, namely the password and the "salt".

[0086] The main purpose of adding salt to the required parameters is that when different users use the same password, the resulting password hash values ​​are completely different. Therefore, the input parameters of the hash algorithm become two, that is, the backend hash algorithm hashA(X) becomes hashA(X,S) (X is the password, S is the salt). Therefore, we can make the following construction: hashB(X,S)=hashA(hashA(hashA(hashA(X,S),S),S),S). That is, all conditions remain unchanged, and the same salt must be used for each nested layer. Obviously, hashB(hashA(X,S),S) is still equal to hashA(hashB(X,S),S), and the commutative law of this specially constructed hash function still holds. However, because the frontend is not clear about the backend salting process, let alone the value of the added salt. Therefore, a new API needs to be introduced to obtain the plaintext of the salt from the frontend to the backend. Fortunately, the plaintext transmission and storage of the salt does not affect the security of the entire process.

[0087] Example 2

[0088] Based on the same principle as the above method, a device for strengthening the existing password storage and transmission architecture is also proposed, see Figure 4 , a device 100 for reinforcing an existing password storage and transmission architecture according to an embodiment of the present disclosure includes:

[0089] A hash algorithm acquisition module 110 is used to acquire a first hash algorithm corresponding to the current password processing method to be reinforced;

[0090] An algorithm construction module 120, configured to construct a second Hash algorithm according to the first Hash algorithm;

[0091] The execution algorithm module 130 is used to calculate the password hash value stored in the password processing method to be strengthened and the new password to be stored.

[0092] The password hash value storage module 140 is used to store the calculated new password hash value.

[0093] As an optional implementation scheme of the present application, optionally, the algorithm construction module includes:

[0094] A parameter transmission module, used for transmitting necessary parameters of the first hash algorithm and the second hash algorithm;

[0095] An algorithm construction module is used to construct the first Hash algorithm to obtain the second Hash algorithm.

[0096] Obviously, those skilled in the art should understand that all or part of the processes in the above-mentioned embodiment method can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned control methods. The modules or steps of the present invention can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be implemented by program codes executable by computing devices, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules respectively, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the present invention is not limited to any specific combination of hardware and software.

[0097] Those skilled in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned control methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated as: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0098] Example 3

[0099] Furthermore, an electronic device is proposed, comprising:

[0100] processor;

[0101] a memory for storing processor-executable instructions;

[0102] Wherein, the processor is configured to implement the method for reinforcing the existing password storage and transmission architecture described in Example 1 when executing the executable instructions.

[0103] The electronic device of the embodiment of the present disclosure includes a processor and a memory for storing processor executable instructions, wherein the processor is configured to implement any of the above-mentioned methods for reinforcing the existing password storage and transmission architecture when executing the executable instructions.

[0104] It should be noted that the number of processors may be one or more. At the same time, the electronic device of the embodiment of the present disclosure may also include an input device and an output device. The processor, memory, input device, and output device may be connected via a bus or in other ways, which are not specifically limited here.

[0105] The memory is a computer-readable storage medium that can be used to store software programs, computer executable programs, and various modules, such as the program or module corresponding to the method for reinforcing the existing password storage and transmission architecture in the embodiment of the present disclosure. The processor executes various functional applications and data processing of the electronic device by running the software programs or modules stored in the memory.

[0106] The input device can be used to receive input numbers or signals. The signal can be a key signal related to user settings and function control of the device / terminal / server. The output device can include a display device such as a display screen.

[0107] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

[0108] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for reinforcing an existing password storage and transmission architecture, characterized in that: The existing password is encrypted once using a second hash algorithm, and the method includes: Obtaining a first hash algorithm corresponding to the current password processing method to be reinforced; Constructing a second Hash algorithm according to the first Hash algorithm; The password hash value stored in the password processing method to be strengthened is calculated by using the second hash algorithm to obtain a new password hash value; Using the first hash algorithm and the second hash algorithm to calculate the new password to be stored, and obtain the corresponding new input password hash value; Storing the newly input password hash value; The first hash algorithm and the second hash algorithm satisfy the following conditions: When the first hash algorithm and the second hash algorithm are used simultaneously to perform hash calculation on the same content, the same result is obtained when the first hash algorithm and the second hash algorithm are executed in different orders; The new password to be stored is calculated using the first hash algorithm and the second hash algorithm to obtain the corresponding new input password hash value, including: The front end uses the second hash algorithm to calculate the new password to be stored to obtain the first encrypted password hash value; The backend uses the first hash algorithm to calculate the first encrypted password hash value to obtain the corresponding new input password hash value.

2. A method for reinforcing an existing password storage and transmission architecture as claimed in claim 1, characterized in that: Constructing a second Hash algorithm according to the first Hash algorithm includes: A second Hash algorithm that is the same as the first Hash algorithm is constructed based on the first Hash algorithm.

3. A method for reinforcing an existing password storage and transmission architecture as claimed in claim 1, characterized in that: The password hash value stored in the password processing method to be strengthened is calculated by using the second hash algorithm to obtain a new password hash value, including: The backend obtains the password hash value stored in the password processing method to be strengthened from the database; The back-end script uses the second hash algorithm to calculate the password hash value stored in the password processing method to be strengthened to obtain a new password hash value.

4. A method for reinforcing an existing password storage and transmission architecture as claimed in claim 2, characterized in that: Constructing a second hash algorithm that is the same as the first hash algorithm, comprising: The second Hash algorithm and the first Hash algorithm have the same execution results when executing the same content in different orders.

5. A method for reinforcing an existing password storage and transmission architecture as claimed in claim 2, characterized in that: The method is constructed based on the first Hash algorithm and further includes: The first Hash algorithm is nested multiple times to obtain the second Hash algorithm.

6. A method for reinforcing an existing password storage and transmission architecture as claimed in claim 2, characterized in that: There are two parameters when constructing the second hash algorithm, namely the password and "Salt".

7. A device for reinforcing an existing password storage and transmission architecture, characterized in that: The device can perform the reinforcement method according to any one of claims 1 to 6, comprising: A hash algorithm acquisition module is used to acquire a first hash algorithm corresponding to the current password processing method to be reinforced; An algorithm construction module, used to construct a second Hash algorithm according to the first Hash algorithm; An execution algorithm module is used to calculate the password hash value stored in the password processing method to be strengthened and the new password to be stored; The password hash value storage module is used to store new password hash values.

8. The device for strengthening the existing password storage and transmission architecture as claimed in claim 7, characterized in that: The algorithm construction module includes: A parameter transmission module, used to pass in the password and "salt" in the first hash algorithm and the second hash algorithm; An algorithm construction module is used to construct the first Hash algorithm to obtain the second Hash algorithm.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the method for reinforcing the existing password storage and transmission architecture as described in any one of claims 1 to 6 when executing the executable instructions.

Images