Password verification method and related device

Abstract

The invention discloses a password verification method and a related device, and the method comprises the steps: obtaining an identifier and a target change factor in response to a verification request from a client, and enabling the verification request to carry a first password generated by a management server; and determining a password variable corresponding to the target variation factor. And according to the identifier and the password variable, performing encryption through an encryption algorithm to obtain a plurality of second passwords. And verifying the first password and the plurality of second passwords, and if verification succeeds, establishing connection between the client and a container corresponding to the container arrangement platform. Therefore, by introducing the variation factor, the second password for verification is dynamically changed, and the possibility that the password is cracked due to the fact that the password is fixed and single is reduced. The dynamic first password and the plurality of second passwords are generated at the two ends respectively, the passwords do not need to be changed by modifying container configuration, the password generation speed and the password verification speed are higher, and the password verification safety before the client is connected with the container is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a password verification method and related devices. Background Art

[0002] In the system architecture formed by the container orchestration platform, the client, and the management server, the three ends coordinate with each other to provide services to the client. Among them, the container orchestration platform can automatically deploy, expand, and manage containerized applications, and is used to start and manage containers. The management server is used to monitor and schedule the container corresponding to the container orchestration platform, and the client is responsible for initiating a request to connect to the container corresponding to the container orchestration platform to use the application services provided by the container.

[0003] In the related art, the container orchestration platform and the management server inform each other of the preset fixed password to achieve password synchronization. Before the client connects to the container, the password provided by the management server is verified with the password provided by the container orchestration platform. However, this password verification method using interactive negotiation is less secure. Summary of the invention

[0004] In view of the above problems, the present application provides a password verification method and related devices for improving the security of password verification before a client connects to a container.

[0005] Based on this, this application discloses the following technical solutions:

[0006] In a first aspect, an embodiment of the present application provides a password verification method, which is applied to a container orchestration platform, wherein the container orchestration platform is used to start and manage containers, and the method includes:

[0007] In response to obtaining a verification request from a client, obtaining an identifier and a target variation factor, the verification request carries a first password generated by a management server, the management server and the container orchestration platform respectively have the identifier, the target variation factor is a variation factor used to generate a second password, and the first password is a password generated according to the identifier and the variation factor;

[0008] Determine the cryptographic variable corresponding to the target variation factor;

[0009] Encrypting the second password by using an encryption algorithm according to the identifier and the password variable;

[0010] The first password and the second password carried in the verification request are verified, and if the verification succeeds, the client establishes a connection with the container corresponding to the container orchestration platform.

[0011] Optionally, the variation factor is a timestamp, the target variation factor is a current timestamp, the cryptographic variable is a time slot, and determining the cryptographic variable corresponding to the target variation factor includes:

[0012] Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer;

[0013] Convert the current timestamp into a standard time stamp.

[0014] The standard current timestamp is normalized through the time window to obtain a time slot corresponding to the current timestamp.

[0015] Optionally, the width of the time window is smaller than a width threshold, and the width threshold is determined based on the validity period of the password and the number of password cracking attacks.

[0016] Optionally, determining the cryptographic variable corresponding to the variation factor includes:

[0017] Determine a plurality of the cryptographic variables corresponding to the target change factor, wherein the plurality of the cryptographic variables are a plurality of cryptographic variables that are numerically continuous, and a difference between adjacent cryptographic variables is less than a difference threshold;

[0018] The step of encrypting the identifier and the password variable by using an encryption algorithm to obtain the second password comprises:

[0019] According to the identifier and the plurality of password variables, encrypt them respectively by the encryption algorithm to obtain a plurality of the second passwords;

[0020] The verifying the first password and the second password carried in the verification request, and if the verification succeeds, establishing a connection between the client and the container corresponding to the container orchestration platform includes:

[0021] The first password and the plurality of second passwords carried in the verification request are verified, and if the plurality of second passwords include the first password, the client establishes a connection with a container corresponding to the container orchestration platform.

[0022] Optionally, if the variation factor is a timestamp, the target variation factor is a current timestamp, and the cryptographic variable is a time slot, then determining the plurality of cryptographic variables corresponding to the target variation factor includes:

[0023] Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer;

[0024] Convert the current timestamp into a standard time stamp.

[0025] Normalizing the standard current timestamp through the time window to obtain an initial time slot corresponding to the current timestamp;

[0026] Get the continuous time offset of multiple values;

[0027] The initial time slot is offset by using the multiple time offsets respectively to obtain multiple time slots corresponding to the current timestamp.

[0028] Optionally, the encryption algorithm is the secure hash algorithm SHA-256.

[0029] In a second aspect, an embodiment of the present application provides a password verification device, which is applied to a container orchestration platform, wherein the container orchestration platform is used to start and manage containers, and the device includes: an acquisition unit, a determination unit, an encryption unit, and a verification unit;

[0030] The acquisition unit is configured to acquire an identifier and a target variation factor in response to acquiring a verification request from a client, the verification request carries a first password generated by a management server, the management server and the container orchestration platform respectively have the identifier, the target variation factor is a variation factor used to generate a second password, and the first password is a password generated according to the identifier and the variation factor;

[0031] The determining unit is used to determine the cryptographic variable corresponding to the target variation factor;

[0032] The encryption unit is used to encrypt the second password by using an encryption algorithm according to the identifier and the password variable;

[0033] The verification unit is used to verify the first password and the second password carried in the verification request. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform.

[0034] In a third aspect, an embodiment of the present application provides a computer device, wherein the computer device includes a processor and a memory:

[0035] The memory is used to store a computer program and transmit the computer program to the processor;

[0036] The processor is configured to execute the method according to the first aspect of claim 1 according to the computer program.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method described in the first aspect above.

[0038] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer program, which, when executed on a computer device, enables the computer device to execute the method described in the first aspect above.

[0039] It can be seen from the above technical solutions that the present application has at least the following beneficial effects:

[0040] In response to obtaining a verification request from a client, an identifier and a target variable factor are obtained. The verification request carries a first password generated by a management server. The management server and the container orchestration platform each have an identifier. The target variable factor is a variable factor used to generate a second password. The first password is a password generated according to the identifier and the variable factor. The password variable corresponding to the target variable factor is determined. According to the identifier and the password variable, encryption is performed by an encryption algorithm to obtain a second password. The first password and the second password carried by the verification request are verified. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform. Therefore, by introducing a variable factor, the second password used for verification is dynamically changed, which reduces the possibility of being cracked due to a fixed single password. Compared with the password verification method of interactive negotiation, the management server and the container orchestration platform can generate dynamic first and second passwords respectively, and there is no need to change the password by modifying the container configuration. The password generation speed and verification speed are faster, which improves the security of password verification before the client connects to the container. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 A flowchart of a password verification method provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of a process for generating a second password provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of the structure of a password verification device provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0047] The interactive negotiation password verification method has a fixed single password. Users who already have a password can verify again with the password, which is more likely to be cracked and less secure. In related technologies, in order to improve security and prevent users who already have a password from using the same password to verify again, the password used for verification can be changed by modifying the container environment variables.

[0048] However, in order to reduce the time consumption of creating containers, pre-starting containers is usually used for preheating. When the environment variables of the preheated container are modified, the container will be reconfigured, which increases the time consumption. In addition, the interactive negotiation verification method requires the container orchestration platform and the management server to inform each other of the password, which makes the system implementation more complex.

[0049] Based on this, the embodiment of the present application provides a password verification method and related devices. By introducing a variable factor, the second password used for verification is dynamically changed, reducing the possibility of being cracked due to a fixed single password. Compared with the interactive negotiated password verification method, the management server and the container orchestration platform can generate dynamic first and second passwords respectively, without the need to change the password by modifying the container configuration. The password generation speed and verification speed are faster, which improves the security of password verification before the client connects to the container.

[0050] The password verification method provided in this application can be applied to computer devices with password verification capabilities, such as terminal devices and servers. Specifically, the terminal device can be a desktop computer, a laptop computer, a mobile phone, and a tablet computer; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this.

[0051] See also Figure 1, which is a flowchart of the password verification method provided in the embodiment of the present application. For the convenience of description, the following embodiment takes the execution subject of the password verification method as an example to introduce the server, which includes a container orchestration platform. Figure 1 As shown, the password verification method includes S101-S104.

[0052] S101: In response to obtaining a verification request from a client, obtaining an identifier and a target variation factor.

[0053] A container orchestration platform is a software system used to automatically deploy, scale, manage, and operate containerized applications. It can handle tasks such as resource allocation, network configuration, load balancing, health checks, and fault recovery in container clusters. For example, a container orchestration platform can be Kubernetes (K8s), Docker Swarm, etc.

[0054] The verification request is a password verification request initiated by the client requesting to connect to the container. The verification request carries the first password generated by the management server. The first password is a password generated based on the identifier and the variable factor. The second password is a password generated by the container orchestration platform for verification. Among them, the identifier is a unique identifier provided by the user or system to improve the unpredictability of the password. In other words, the management server and the container orchestration platform each have an identifier, which is data negotiated by both parties. The identifier can be written into the code or configuration file.

[0055] The variable factor is a factor that can change over time or with events. The variable factor ensures that each generated password is unique. If the password is generated based on the variable factor, it can increase the difficulty of cracking the password. For example, the variable factor can be a timestamp, a random number, or the geographic location information of the mobile device. The target variable factor is the variable factor used to generate the second password. For example, if the variable factor is a timestamp, the target variable factor is the current timestamp. If the variable factor is the geographic location information of the mobile device, the target variable factor is the current geographic coordinates of the mobile device.

[0056] After receiving the first password from the management server, the client sends a verification request to the container orchestration platform. After obtaining the verification request, the container orchestration platform needs to generate a second password for the verification request, thereby obtaining an identifier and a target change factor for generating the second password.

[0057] It should be noted that all data collected in this application (such as identifiers, target change factors) are collected with the consent and authorization of the object to which the data belongs (such as users, institutions or enterprises), and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0058] S102: Determine the cryptographic variable corresponding to the target change factor.

[0059] The second password is obtained by encrypting the data to be encrypted by an encryption algorithm. In the embodiment of the present application, the data to be encrypted includes an identifier and a password variable, that is, the password variable is a part of the data to be encrypted and is used to constitute the data to be encrypted. Determining the password variable corresponding to the target change factor is to determine the password variable with a standardized form that can be used for encryption according to the target change factor.

[0060] The embodiment of the present application does not specifically limit how to determine the password variable corresponding to the target change factor. The following is an explanation using three determination methods as examples.

[0061] Determination method 1: directly determine the target variable as the password variable. For example, the target variable is a random number generated in a section, and the random number can be directly determined as the password variable.

[0062] Determination method 2: convert the target variable to obtain the password variable. For example, the target variable is the coordinates of the client device. If the client is located at latitude 40.7128 and longitude -74.0060, the two values ​​can be concatenated to obtain the password variable "407128740060"; or convert the latitude and precision into integer form and then perform hash operation to obtain the password variable.

[0063] Determination method three, mapping the target change factor to the password variable. For example, if the target change factor is the current timestamp, the current timestamp can be mapped to the time slot corresponding to the current timestamp, and the time slot is determined as the password variable. The process will be described in detail in A1-A3 later, and will not be repeated here.

[0064] S103: Encrypting by an encryption algorithm according to the identifier and the password variable to obtain a second password.

[0065] An encryption algorithm is an algorithm used to encrypt plain text. Encryption by an encryption algorithm can convert plain text into an incomprehensible form.

[0066] For example, the identifier and the password variable may be combined to obtain the data to be encrypted, and then the data to be encrypted may be encrypted by an encryption algorithm to obtain the second password. Alternatively, the identifier and the password variable may be encrypted by two encryption algorithms to obtain two parts of the second password, and the two parts may be combined to obtain the second password.

[0067] In one possible implementation, the encryption algorithm is Secure Hash Algorithm 256-bit SHA-256, which is a cryptographically secure hash function and a member of the SHA-2 family. SHA-256 accepts data or messages of any length as input and outputs a hash value or message digest with a fixed length of 256 bits (32 bytes).

[0068] Specifically, the execution process of SHA-256 is as follows:

[0069] (1) First, the input message (identifier and password variable) is padded to make its length meet the specific requirements; then the padded message is split into 512-bit blocks.

[0070] (2) Set a set of initial hash values, which are constants preset by the encryption algorithm.

[0071] (3) For each 512-bit message block, a series of complex nonlinear transformation operations are performed, including logical operations, modular addition, etc. These operations involve the data of the current block and the results of the previous round of calculations.

[0072] (4) After all message blocks are processed, the obtained hash value is the final hash result (the second password).

[0073] Compared with other algorithms, SHA-256 receives two different data to be encrypted (such as identifiers and password variables), and the probability of outputting the same second password is extremely low, which is unique. In addition, it is computationally infeasible to reverse the plaintext data of the original input encryption algorithm from the hash result generated by SHA-256, which is irreversible. Therefore, when encrypting with SHA-256, it is more secure.

[0074] S104: Verify the first password and the second password carried in the verification request. If the verification succeeds, the client establishes a connection with the container corresponding to the container orchestration platform.

[0075] It should be noted that the first password is also obtained through the password generation process of S101-S103 above. By comparing the consistency of the first password and the second password, the legality of the client's identity is determined. If the first password and the second password are consistent, the verification is successful, and the client establishes a connection with the container corresponding to the container orchestration platform and can use the application services provided by the container. If the first password and the second password are inconsistent, the verification fails, and the client cannot establish a connection with the container corresponding to the container orchestration platform.

[0076] Specifically, the consistency can be determined by determining whether the first password is the same as the second password. If the second password includes multiple passwords, the consistency can be determined by determining whether the second password includes the first password. If both the first password and the second password include multiple passwords, the consistency can be determined by determining whether the first password and the second password include an intersection password.

[0077] It can be seen from the above technical solution that in response to obtaining a verification request from a client, an identifier and a target variable factor are obtained, the verification request carries a first password generated by the management server, the management server and the container orchestration platform respectively have an identifier, the target variable factor is a variable factor for generating a second password, and the first password is a password generated according to the identifier and the variable factor. Determine the password variable corresponding to the target variable factor. According to the identifier and the password variable, encrypt by an encryption algorithm to obtain the second password. Verify the first password and the second password carried by the verification request. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform. Therefore, by introducing a variable factor, the second password used for verification is dynamically changed, reducing the possibility of being cracked due to a fixed single password. Compared with the interactively negotiated password verification method, the management server and the container orchestration platform can generate dynamic first and second passwords respectively, without the need to change the password by modifying the container configuration. The password generation speed and verification speed are faster, which improves the security of password verification before the client connects to the container.

[0078] In one possible way, the cryptographic variable used for encryption can be determined based on the timestamp. The timestamp is data used to indicate the time point at which a specific event occurs. The timestamp is usually a numerical value used to record the amount of time that has passed since a fixed starting point (called an epoch). The most common epoch is the Unix epoch, which is midnight on January 1, 1970 (UTC). Among them, the variable factor is the timestamp, the target variable factor is the current timestamp, and the cryptographic variable is the time slot. For details, see A1-A3:

[0079] A1: Get the current timestamp and time window.

[0080] The current timestamp is the timestamp corresponding to the current moment. The time window is used to divide m timestamps into n password variables, where m is greater than n, m is a positive integer, and n is a positive integer.

[0081] A2: Convert the unit of the current timestamp to obtain the standard current timestamp.

[0082] The standard current timestamp is the current timestamp in standard units. In order to perform normalization better later, it is usually necessary to unify the units of the current timestamp to achieve standardization. The current timestamp is usually in milliseconds or seconds. If the current timestamp is in seconds, the current timestamp is directly determined as the standard current timestamp. If the current timestamp is in milliseconds, the standard current timestamp can be obtained by converting the units of the current timestamp to seconds.

[0083] For example, the standard current timestamp can be obtained by the following formula:

[0084]

[0085] Among them, currentTimestamp is the standard current timestamp, and Date.now() is used to return the current timestamp in milliseconds. Indicates that x is rounded down.

[0086] As an implementation manner, a target unit (not limited to seconds) may be set, and then the current timestamp may be converted into a standard current timestamp of the target unit.

[0087] A3: Normalize the standard current timestamp through the time window to obtain the time slot corresponding to the current timestamp.

[0088] A time window is a time period used to map consecutive and dense timestamps to the time slots corresponding to each timestamp. A time slot is the serial number of a time period obtained after normalization. For example, if the time window is 5 minutes, then a day (86400 seconds) can be mapped to 288 (86400 / 300=288) different time slots by the event window. This process is called normalization. Each time slot corresponds to a cryptographic variable, and different time slots correspond to different cryptographic variables.

[0089] For example, the standard current timestamp can be normalized by the following formula to obtain the time slot corresponding to the current timestamp:

[0090]

[0091] Among them, currentSlot is the time slot corresponding to the current timestamp, currentTimestamp is the standard current timestamp, and timeWindow is the time window. Indicates that x is rounded down.

[0092] Most programming languages ​​and operating systems have built-in functions for obtaining the current timestamp, such as JavaScript's Date.now(), Python's time.time(), etc. Compared with other target change factors, obtaining the current timestamp is faster, more convenient, and easier to implement. And when the time slot corresponding to the current timestamp is outside the range, the second password will become invalid, which can more effectively prevent attackers from obtaining unauthorized access by replaying the old second password, thereby improving the security of password verification.

[0093] In a possible implementation, the width of the time window is less than a width threshold, and the width threshold is determined based on the password validity period and the number of password cracking attacks. For example, the width threshold may be 30 seconds.

[0094] The larger the time window, the longer the same password is valid, and the longer the attacker has to try brute force or replay attacks. In other words, if the time window is greater than or equal to the width threshold, the second password generated based on the time slot is more likely to be cracked. As shown in Table 1:

[0095] Table 1

[0096] Time window size Cracking speed The number of successful cracking 30 seconds 100 times / second 1 / 10^6 times 300 seconds 100 times / second 1 / 10^5 times

[0097] With the same cracking speed, the time window increases 10 times, and the cracking difficulty is reduced by an order of magnitude.

[0098] Therefore, by limiting the width of the time window, the second password is made to expire quickly, so as to reduce the number and probability of the second password being cracked and attacked, thereby improving the security of password verification.

[0099] In a possible implementation, the embodiment of the present application provides a verification method for generating multiple second passwords to improve the fault tolerance of password verification, see B1-B3:

[0100] B1: Determine multiple password variables corresponding to the target change factor.

[0101] Among them, multiple password variables are multiple password variables that are numerically continuous, and the difference between adjacent password variables is less than the difference threshold, so as to improve the password verification failure caused by the lack of synchronization of the change factor on the container orchestration platform and the management server. There are many reasons for the lack of synchronization of the change factor, such as data transmission delay, hardware device error, etc.

[0102] For example, multiple closely continuous geographic coordinates within a preset distance of the geographic coordinates are determined based on the geographic coordinates of the device where the client is located, and then multiple password variables are determined for the multiple geographic coordinates to reduce the error caused by inaccurate positioning. For another example, multiple time slots are obtained by performing multiple offset operations on the time slot corresponding to the current timestamp to overcome the time delay in the data transmission process, see D1-D5 for details.

[0103] B2: Encrypt the identifier and the multiple password variables using an encryption algorithm to obtain multiple second passwords.

[0104] The multiple password variables and the identifiers respectively form multiple groups of data to be encrypted, and the multiple groups of data to be encrypted are encrypted by the encryption algorithm to obtain multiple second passwords. The specific encryption process is shown in S103 and will not be described here.

[0105] B3: Verify the first password and multiple second passwords carried in the verification request. If the multiple second passwords include the first password, the client establishes a connection with the container corresponding to the container orchestration platform.

[0106] For example, if you verify 1 first password and 3 second passwords carried in the verification request:

[0107] First password:

[0108] f57d2966f4d3dd997ece8e2126240dabd984be3cc99ca1663c9cc1f2a8bbcff7

[0109] Second password:

[0110] f57d2966f4d3dd997ece8e212feeaef2f4f44e3cc99ca1663c9cc1f2a43241553,f57d2966f4d3dd997ece8e2126240da bd984be3cc99ca1663c9cc1f2a8bbcff7,f57d2966f4d3dd997ece8e2126240dabd984be3cc99ca1663c9cc324123a234

[0111] The second password is consistent with the first password, indicating that the three second passwords include the first password. The verification is successful, and the client establishes a connection with the container corresponding to the container orchestration platform.

[0112] Therefore, by determining multiple password vectors corresponding to the target variation factor, the possibility of password verification failure due to the variation factor is reduced, and the fault tolerance of the password verification process is improved.

[0113] Taking determining multiple time slots corresponding to the current timestamp as an example, see D1-D5:

[0114] D1: Get the current timestamp and time window.

[0115] The current timestamp is the timestamp corresponding to the current moment. The time window is used to divide m timestamps into n password variables, where m is greater than n, m is a positive integer, and n is a positive integer.

[0116] D2: Convert the unit of the current timestamp to obtain the standard current timestamp.

[0117] See A2, which will not be repeated here.

[0118] D3: Normalize the standard current timestamp through the time window to obtain the initial time slot corresponding to the current timestamp.

[0119] The initial time slot is a time slot that has not been offset and has a benchmark function. The initial time slot is one of the multiple time slots corresponding to the current timestamp.

[0120] The normalization process is described in A3 and will not be described in detail here.

[0121] D4: Get the continuous time offset of multiple values.

[0122] The time offset is the amount used to perform an offset operation on the time slot, reflecting the degree to which the variation factor can be allowed to be out of sync between the container orchestration platform and the management server when generating passwords. For example, multiple time offsets can be multiple integer values ​​included in a symmetric integer set, {-3, -2, -1, 0, 1, 2, 3}, where if the time offset is 0, it is used to indicate that no offset operation is performed on the initial time slot.

[0123] D5: Use multiple time offsets to offset the initial time slot respectively to obtain multiple time slots corresponding to the current timestamp.

[0124] The offset operation is used to perform numerical calculations on the time offset and the initial time slot to calculate the new time slot number. For example, the offset operation can be performed using the following formula:

[0125] timeslot=currentSlot+offset

[0126] Where timeSlot is the time slot, currentSlot is the initial time slot, and offset is the time offset used for offset operation. Take the example of using 5 time offsets (-2, -1, 0, 1, 2) to offset the initial time slot and get the 5 time slots corresponding to the current timestamp:

[0127] Time slot 1 = initial time slot - 2;

[0128] Time slot 2 = initial time slot - 1;

[0129] Time slot 3 = initial time slot + 0;

[0130] Time slot 4 = initial time slot + 1;

[0131] Time slot 5 = initial time slot + 2.

[0132] Therefore, by performing multiple offset operations on the initial time slot to obtain multiple time slots corresponding to the current timestamp, it is possible to more effectively overcome the problem of data transmission delay causing the variable factor to be out of sync at both ends when generating the password, thereby improving the fault tolerance capability in the password verification process.

[0133] See also Figure 2 , Figure 2 A schematic diagram of a process for generating a second password provided in an embodiment of the present application.

[0134] First, obtain the current timestamp, and then process the current timestamp through unit conversion and time window-based normalization operations to obtain the current time slot, which is the initial time slot corresponding to the current timestamp. Then initialize an empty password set, which is combined with multiple second passwords used to store the generated passwords. After initializing the password set, traverse all time slots within the tolerance range. Specifically, the tolerance range is a symmetrical integer value that defines the offset range allowed before and after the current time slot. If the tolerance range is ±n, multiple time offsets can be determined according to the tolerance range and 2n+1 time slots can be generated according to the multiple time offsets, and then traverse the 2n+1 time slots. For each time slot, generate the combined input of the seed and the time slot in the following way:

[0135] input=seed+“:”+timeslot

[0136] Among them, input is the data input to the encryption algorithm, seed is the seed, which is an identifier, and timeslot is the time slot.

[0137] Use SHA-256 to generate the second password corresponding to each combination input and store it in the password set. Specifically, generate a SHA-256 hash value through the crypto module of Node.js, encrypt the combination input through the SHA-256 hash value, and assign the encrypted result to the second password in the form of a hexadecimal string, and then store it in the password set. When the second password is stored in the form of a hexadecimal string, data transmission is more convenient. When it is determined that the traversal is completed, return to the password set, and end the generation process of the second password. The password set is used to verify with the first password.

[0138] Therefore, through the above steps, the second password is generated non-interactively on the container orchestration platform, and there is no need to change the password by modifying the container configuration. The password generation speed and verification speed are faster, which improves the security of password verification before the client connects to the container. In addition, by generating multiple second passwords according to the tolerance range, the fault tolerance of password verification is improved.

[0139] See also Figure 3 , Figure 3 A password verification device provided in an embodiment of the present application, the device 300 includes an acquisition unit 301, a determination unit 302, an encryption unit 303 and a verification unit 304;

[0140] The acquisition unit 301 is used to obtain an identifier and a target variation factor in response to obtaining a verification request from a client, the verification request carries a first password generated by a management server, the management server and the container orchestration platform respectively have the identifier, the target variation factor is a variation factor used to generate a second password, and the first password is a password generated according to the identifier and the variation factor;

[0141] The determining unit 302 is used to determine the cryptographic variable corresponding to the target variation factor;

[0142] The encryption unit 303 is used to encrypt the identifier and the password variable by using an encryption algorithm to obtain the second password;

[0143] The verification unit 304 is used to verify the first password and the second password carried in the verification request. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform.

[0144] It can be seen from the above technical solution that the password verification device provided by the embodiment of the present application includes an acquisition unit, a determination unit, an encryption unit and a verification unit. In response to obtaining a verification request from a client, an identifier and a target change factor are obtained by the acquisition unit, the verification request carries a first password generated by the management server, the management server and the container orchestration platform respectively have identifiers, the target change factor is a change factor for generating a second password, and the first password is a password generated according to the identifier and the change factor. The password variable corresponding to the target change factor is determined by the determination unit. The encryption unit encrypts the second password by an encryption algorithm according to the identifier and the password variable. The first password and the second password carried by the verification request are verified by the verification unit. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform. Therefore, by introducing a change factor, the second password used for verification is dynamically changed, which reduces the possibility of being cracked due to a fixed single password. Compared with the password verification method of interactive negotiation, the management server and the container orchestration platform can generate dynamic first and second passwords respectively, without the need to change the password by modifying the container configuration. The password generation speed and verification speed are faster, which improves the security of password verification before the client connects to the container.

[0145] As a possible implementation manner, the variation factor is a timestamp, the target variation factor is a current timestamp, the password variable is a time slot, and the determination unit is specifically configured to:

[0146] Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer;

[0147] Convert the current timestamp into a standard time stamp.

[0148] The standard current timestamp is normalized through the time window to obtain a time slot corresponding to the current timestamp.

[0149] As a possible implementation manner, the width of the time window is smaller than a width threshold, and the width threshold is determined based on the validity period of the password and the number of password cracking attacks.

[0150] As a possible implementation manner, the determining unit is specifically configured to:

[0151] Determine a plurality of the cryptographic variables corresponding to the target change factor, wherein the plurality of the cryptographic variables are a plurality of cryptographic variables that are numerically continuous, and a difference between adjacent cryptographic variables is less than a difference threshold;

[0152] The step of encrypting the identifier and the password variable by using an encryption algorithm to obtain the second password comprises:

[0153] According to the identifier and the plurality of password variables, encrypt them respectively by the encryption algorithm to obtain a plurality of the second passwords;

[0154] The verifying the first password and the second password carried in the verification request, and if the verification succeeds, establishing a connection between the client and the container corresponding to the container orchestration platform includes:

[0155] The first password and the plurality of second passwords carried in the verification request are verified, and if the plurality of second passwords include the first password, the client establishes a connection with a container corresponding to the container orchestration platform.

[0156] As a possible implementation manner, if the variation factor is a timestamp, the target variation factor is a current timestamp, and the password variable is a time slot, the determining unit is specifically configured to:

[0157] Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer;

[0158] Convert the current timestamp into a standard time stamp.

[0159] Normalizing the standard current timestamp through the time window to obtain an initial time slot corresponding to the current timestamp;

[0160] Get the continuous time offset of multiple values;

[0161] The initial time slot is offset by using the multiple time offsets respectively to obtain multiple time slots corresponding to the current timestamp.

[0162] As a possible implementation, the encryption algorithm is the secure hash algorithm SHA-256.

[0163] See also Figure 4 , the embodiment of the present application further provides a computer device, the computer device comprising a memory 401 and a processor 402:

[0164] The memory is used to store a computer program and transmit the computer program to the processor;

[0165] The processor is configured to execute the method of the above method embodiment according to the computer program.

[0166] An embodiment of the present application also provides a computer-readable storage medium, characterized in that the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method of the above method embodiment.

[0167] The embodiment of the present application also provides a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the method of the above method embodiment.

[0168] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0169] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0170] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0171] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0172] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0173] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A password verification method, characterized in that: Applied to a container orchestration platform, the container orchestration platform is used to start and manage containers, the method includes: In response to obtaining a verification request from a client, obtaining an identifier and a target variation factor, the verification request carries a first password generated by a management server, the management server and the container orchestration platform respectively have the identifier, the target variation factor is a variation factor used to generate a second password, and the first password is a password generated according to the identifier and the variation factor; Determine the cryptographic variable corresponding to the target variation factor; Encrypting the second password by using an encryption algorithm according to the identifier and the password variable; The first password and the second password carried in the verification request are verified, and if the verification succeeds, the client establishes a connection with the container corresponding to the container orchestration platform.

2. The method according to claim 1, characterized in that The variation factor is a timestamp, the target variation factor is a current timestamp, the cryptographic variable is a time slot, and determining the cryptographic variable corresponding to the target variation factor includes: Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer; Convert the current timestamp into a standard time stamp. The standard current timestamp is normalized through the time window to obtain a time slot corresponding to the current timestamp.

3. The method according to claim 2, characterized in that The width of the time window is smaller than a width threshold, and the width threshold is determined based on the password validity period and the number of password cracking attacks.

4. The method according to claim 1, characterized in that: The step of determining the cryptographic variable corresponding to the variation factor comprises: Determine a plurality of the cryptographic variables corresponding to the target change factor, wherein the plurality of the cryptographic variables are a plurality of cryptographic variables that are numerically continuous, and a difference between adjacent cryptographic variables is less than a difference threshold; The step of encrypting the identifier and the password variable by using an encryption algorithm to obtain the second password comprises: According to the identifier and the plurality of password variables, encrypt them respectively by the encryption algorithm to obtain a plurality of the second passwords; The verifying the first password and the second password carried in the verification request, and if the verification succeeds, establishing a connection between the client and the container corresponding to the container orchestration platform includes: The first password and the plurality of second passwords carried in the verification request are verified, and if the plurality of second passwords include the first password, the client establishes a connection with a container corresponding to the container orchestration platform.

5. The method according to claim 4, characterized in that If the variation factor is a timestamp, the target variation factor is a current timestamp, and the cryptographic variable is a time slot, then determining a plurality of cryptographic variables corresponding to the target variation factor includes: Obtaining a current timestamp and a time window, wherein the time window is used to divide m timestamps into n password variables, wherein m is greater than n, m is a positive integer, and n is a positive integer; Convert the current timestamp into a standard time stamp. Normalizing the standard current timestamp through the time window to obtain an initial time slot corresponding to the current timestamp; Get the continuous time offset of multiple values; The initial time slot is offset by using the multiple time offsets respectively to obtain multiple time slots corresponding to the current timestamp.

6. The method according to claim 1, characterized in that The encryption algorithm is the secure hash algorithm SHA-256.

7. A password verification device, characterized in that: Applied to a container orchestration platform, the container orchestration platform is used to start and manage containers, the device includes: an acquisition unit, a determination unit, an encryption unit and a verification unit; The acquisition unit is configured to acquire an identifier and a target variation factor in response to acquiring a verification request from a client, the verification request carries a first password generated by a management server, the management server and the container orchestration platform respectively have the identifier, the target variation factor is a variation factor used to generate a second password, and the first password is a password generated according to the identifier and the variation factor; The determining unit is used to determine the cryptographic variable corresponding to the target variation factor; The encryption unit is used to encrypt the second password by using an encryption algorithm according to the identifier and the password variable; The verification unit is used to verify the first password and the second password carried in the verification request. If the verification is successful, the client establishes a connection with the container corresponding to the container orchestration platform.

8. A computer device, characterized in that: The computer device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is configured to execute the method according to any one of claims 1 to 6 according to the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that When the method is executed on a computer device, the computer device is enabled to execute the method according to any one of claims 1 to 6.

Images