Password management method, firewall mainboard, device, program product and medium

Abstract

The embodiment of the invention provides a password management method, a firewall main board, equipment, a program product and a medium, a firewall system comprises the firewall main board and control software, the firewall main board is provided with a programmable logic device, the programmable logic device is called through an interface provided by the control software, and the method comprises the following steps: responding to a password management request of a user; obtaining the operation authority of the user; the password management request comprises a password storage request, a password modification request or a password deletion request; if the operation authority of the user comprises the password management authority, calling the programmable logic device through an interface provided by the control software; and executing a management operation corresponding to the password management request on a pre-stored password in the programmable logic device. By utilizing the characteristic that the programmable logic device on the firewall mainboard can only be called through a software interface provided by the control software, the password is stored in the programmable logic device of the firewall mainboard through the control software, so that the password storage security is enhanced.

Description

Technical Field

[0001] The present application relates to the technical field of password management, and more specifically, to a password management method, a firewall mainboard, a device, a program product and a medium. Background Art

[0002] With the rapid development of the Internet and information technology, the security of user data has become particularly important, especially the storage security of user passwords. In the related art, the password storage method is usually to directly store the plain text password in the configuration file or to protect it using an encryption algorithm. However, this storage method is extremely vulnerable to hacker attacks, and the configuration file is easily cracked by hackers. Even if the password is encrypted, there is still a risk of the password being cracked. Therefore, how to improve the security of password storage is a technical problem that needs to be solved urgently in this field. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a password management method, a firewall mainboard, a device, a program product and a medium to achieve the technical effect of improving the security of password storage.

[0004] A first aspect of an embodiment of the present application provides a password management method, which is applied to a firewall system, wherein the firewall system includes a firewall mainboard and control software, wherein the firewall mainboard is deployed with a programmable logic device, and the programmable logic device is called through an interface provided by the control software, and the method includes: In response to a password management request of a user, obtaining the operation authority of the user; the password management request includes one or more of a password storage request, a password modification request and a password deletion request; If the user's operating authority includes password management authority, calling the programmable logic device through the interface provided by the control software; A management operation corresponding to the password management request is performed on the pre-stored password in the programmable logic device.

[0005] In the above implementation process, the characteristic that the programmable logic device on the firewall mainboard can only be called through the software interface provided by the firewall system control software is utilized, and the password is stored in the programmable logic device of the firewall mainboard through the control software, thereby enhancing the security of password storage.

[0006] Furthermore, the programmable logic device includes a complex programmable logic device (CPLD).

[0007] In the above implementation process, the characteristic that the CPLD on the firewall mainboard can only be called through the software interface provided by the firewall system control software is utilized, and the password is stored in the CPLD of the firewall mainboard through the control software, thereby enhancing the security of password storage.

[0008] Furthermore, the CPLD includes a non-volatile storage resource, and the password is stored in the non-volatile storage resource.

[0009] In the above implementation process, by storing the password in the non-volatile storage resource of the CPLD, it is possible to avoid the loss of the pre-stored password after the firewall mainboard is powered off.

[0010] A second aspect of an embodiment of the present application provides a user login method, which is applied to a firewall system, wherein the firewall system includes a firewall mainboard and control software, wherein the firewall mainboard is deployed with a programmable logic device, and the programmable logic device is called through an interface provided by the control software, and the method includes: Obtaining user login information from a login request sent by a user, wherein the user login information includes a user account and a password to be authenticated; Calling the programmable logic device through the interface provided by the control software; Reading a pre-stored password corresponding to the user account from the programmable logic device; In the case that the pre-stored password matches the password to be authenticated, it is determined that the user has passed the login authentication.

[0011] In the above implementation process, the characteristic that the programmable logic device on the firewall mainboard can only be called through the software interface provided by the firewall system control software is utilized, and the password is stored in the programmable logic device of the firewall mainboard through the control software, thereby enhancing the password storage security. When the user logs in to various systems, the firewall system reads the pre-stored password from the programmable logic device to match it with the password to be authenticated in the user login request, thereby realizing user login authentication of various systems.

[0012] Further, the reading a pre-stored password corresponding to the user account from the programmable logic device includes: According to the correspondence between the preset account number and the storage address and the user account number, obtaining the storage address of the pre-stored password in the programmable logic device; The pre-stored password is read from the storage address.

[0013] In the above implementation process, by presetting the correspondence between the account and the storage address in the firewall system, the storage address corresponding to the user account can be found in the correspondence, and then the pre-stored password can be read by addressing the storage address in the programmable logic device to perform user login authentication.

[0014] Furthermore, the programmable logic device includes a complex programmable logic device (CPLD), and the pre-stored password is stored in a non-volatile storage resource of the CPLD.

[0015] In the above implementation process, by storing the password in the non-volatile storage resource of the CPLD, it is possible to avoid the loss of the pre-stored password after the firewall mainboard is powered off.

[0016] A third aspect of an embodiment of the present application provides a firewall mainboard, the firewall mainboard comprising: processor; a memory for storing processor-executable instructions; A programmable logic device for storing passwords; Wherein, when the processor calls the executable instruction, it implements the operation of any method described in the first aspect or the second aspect.

[0017] A fourth aspect of an embodiment of the present application provides an electronic device, which includes the firewall mainboard as described in the third aspect.

[0018] A fifth aspect of an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the method described in any one of the first aspect or the second aspect is implemented.

[0019] A sixth aspect of an embodiment of the present application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods described in the first aspect or the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flowchart of a password management method provided in an embodiment of the present application; Figure 2 A flowchart of a user login method provided in an embodiment of the present application; Figure 3 A flowchart of another user login method provided in an embodiment of the present application; Figure 4 A hardware structure diagram of a firewall mainboard provided in an embodiment of the present application; Figure 5 A hardware structure diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0023] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0024] In the related technologies of password security storage, in order to improve security, a password storage method based on hash functions has emerged. Passwords are processed by one-way hash functions before storage, which can increase the difficulty of password cracking. However, with the improvement of computing power and the development of pre-calculated attack technology, encryption methods based on hash functions have gradually exposed hidden dangers of insecurity. For this reason, the salted hashing technology was further introduced, that is, adding a randomly generated salt value before the password hash, so that the same password will produce different hash values ​​after being processed with different salt values. Despite this, simple salted hashing still has the risk of cracking when facing attacks such as offline brute force cracking.

[0025] In recent years, more advanced password storage schemes such as PBKDF2 (Password-Based Key Derivation Function 2, pseudo-random function to derive keys) algorithm and key derivation function algorithm have been proposed. They increase the difficulty of cracking by increasing computational complexity and memory requirements, but still face potential threats from hardware-accelerated cracking and quantum computing.

[0026] It can be seen that in related technologies, the difficulty of cracking is often increased by increasing the complexity of password encryption, thereby increasing the security of password storage. However, as password encryption becomes more complex, the encryption algorithm will gradually increase the computing power requirements of the device, and the encryption password will also gradually increase the memory requirements, which is not friendly to ordinary devices.

[0027] To this end, the first aspect of the present application provides a password management method that is different from the complicated password encryption process. It is understandable that in order to protect the internal network from external threats and prevent unauthorized access, electronic devices, especially electronic devices that can access the external network, will be deployed with a firewall system to monitor and control network traffic. The electronic devices include but are not limited to servers, mobile terminals, personal computers, tablet computers, laptop computers, or built-in devices in motor vehicles, etc., or any combination thereof. Among them, the firewall system includes a software part and a hardware part. The software part includes control software for monitoring and controlling network traffic and managing various traffic rules. The hardware part includes a firewall mainboard, and a programmable logic device is deployed on the firewall mainboard. The programmable logic device is used to expand and control physical interfaces (such as Ethernet, serial ports), assist in hardware-level access control, hardware acceleration and parallel processing, etc. The programmable logic device needs to be called through an interface provided by the control software, such as a software interface.

[0028] Based on this, the first aspect of the present application provides a password management method, which is compiled into the control software and specifically includes the following steps: Figure 1 Steps 110 to 130 are shown.

[0029] Step 110: In response to the user's password management request, obtain the user's operation authority.

[0030] The password management request includes one or more of a password storage request, a password modification request and a password deletion request.

[0031] Exemplarily, the control software manages the operation permissions of multiple users. The operation permissions include at least password management permissions, and may also include traffic rule management permissions, data viewing permissions, etc. Different users may have different operation permissions. For example, ordinary users may only have data viewing permissions, administrator users may have password management permissions, and technicians may have traffic rule management permissions, etc. In this way, when a password management request from a user is received, the operation permissions of the user may be queried first.

[0032] Step 120: If the user's operating authority includes password management authority, the programmable logic device is called through the interface provided by the control software.

[0033] For example, if the user has password management authority, the programmable logic device on the firewall mainboard can be called through the software interface provided by the control software. On the contrary, if the user does not have password management authority, a prompt message indicating that the operation failed can be returned to the user.

[0034] Step 130: Execute a management operation corresponding to the password management request on the pre-stored password in the programmable logic device.

[0035] Exemplarily, the programmable logic device includes storage resources, and the pre-stored password can be stored in the storage resources of the programmable logic device. In this way, after determining that the user has the password management authority, the storage resources of the programmable device can be accessed through the software interface provided by the control software, the pre-stored password can be read therefrom, and the management operation corresponding to the password management request can be performed on the pre-stored password.

[0036] As an example, if the password management request includes a password storage request, and the password storage request carries the password to be stored, then step 130 may include: storing the password to be stored carried in the password storage request into the storage resources of the programmable logic device, thereby completing the storage operation of the password to be stored carried in the password storage request.

[0037] As an example, if the password management request includes a password modification request, and the password modification request indicates a pre-stored password to be modified, and a target password for overwriting the pre-stored password, then step 130 may include: reading the pre-stored password indicated in the password modification request from the programmable logic device, and overwriting the pre-stored password with the target password carried by the password modification request, thereby completing the modification operation of the pre-stored password indicated in the password modification request.

[0038] As an example, if the password management request includes a password deletion request, and the password deletion request indicates a pre-stored password to be deleted, then step 130 may include: reading the pre-stored password indicated in the password deletion request from the programmable logic device, and deleting the pre-stored password from the storage resources of the programmable logic device, thereby completing the deletion operation of the pre-stored password indicated in the password deletion request.

[0039] It is understandable that programmable logic devices are often used to perform various logical operations, such as AND, OR, NOT, XOR, etc., as well as for complex functions such as timing and counting to meet different control requirements. However, this application proposes for the first time to use programmable logic devices for password storage, because programmable logic devices are deployed on the firewall mainboard and need to be called through the software interface provided by the control software of the firewall system. If a hacker wants to obtain the pre-stored password in the programmable logic device, he needs to crack the entire firewall system first, which undoubtedly greatly increases the difficulty of the attack. In addition, programmable logic devices are commonly used hardware components on the firewall mainboard, so when applying this embodiment, there is no need to modify the hardware equipment, reducing the application cost. It can be seen that this embodiment provides a password management method that is different from the complicated password encryption process, and improves the password storage security from the perspective of the password storage location. Specifically, the programmable logic device on the firewall mainboard can only be called through the software interface provided by the firewall system control software, and the password is stored in the programmable logic device of the firewall mainboard through the control software, thereby enhancing the password storage security.

[0040] According to some embodiments of the present application, the programmable logic device includes a CPLD (Complex Programmable Logic Device). The CPLD includes a variety of storage resources, such as but not limited to registers, distributed RAM (Random Access Memory), block RAM, lookup table, non-volatile storage resources, etc. The pre-stored password can be stored in any one or more storage resources of the CPLD.

[0041] According to some embodiments of the present application, in order to avoid the loss of pre-stored passwords after the firewall mainboard is powered off, the pre-stored passwords can be stored in the non-volatile storage resources of the CPLD.

[0042] Based on any of the above embodiments, the second aspect of the present application further provides a user login method, which is compiled in the control software of the firewall system and specifically includes the following steps: Figure 2 Steps 210 to 240 are shown.

[0043] Step 210: Obtain user login information from the login request sent by the user, wherein the user login information includes a user account and a password to be authenticated.

[0044] Exemplarily, the user login request may be a login request initiated by the user for various systems. The systems include, but are not limited to, business systems, logistics systems, firewall systems, internal enterprise systems, and other systems that require authentication and login of user identities. If the system is a firewall system, then the login request is sent to the firewall system, and the control software can directly obtain the login request. If the system is a system other than the firewall system, then the login request is not sent directly to the firewall system, but to other systems. At this time, the firewall system can intercept the login request sent by the user to other systems, thereby obtaining the user login information from the login request. The user login information includes the user's login account and the password to be authenticated.

[0045] Step 220: Call the programmable logic device through the interface provided by the control software.

[0046] Exemplarily, in response to a user's login request, the programmable logic device is called through a software interface provided by the control software.

[0047] Step 230: Read a pre-stored password corresponding to the user account from the programmable logic device.

[0048] Exemplarily, one or more pre-stored passwords are stored in the programmable logic device. After obtaining the user account, the control software can read the pre-stored password corresponding to the user account from the programmable logic device through the software interface.

[0049] Step 240: When the pre-stored password matches the password to be authenticated, determine that the user has passed the login authentication.

[0050] Exemplarily, the read pre-stored password can be matched with the password to be authenticated in the user login information. If the pre-stored password matches the password to be authenticated, for example, they are the same, it can be determined that the user has passed the login authentication. If the pre-stored password does not match the password to be authenticated, for example, they are not the same, it can be determined that the user has not passed the login authentication.

[0051] As an example, if the user login request is initiated by the user to the firewall system, then if the pre-stored password matches the password to be authenticated, it can be determined that the user has passed the login authentication of the firewall system.

[0052] As an example, if the user login request is initiated by the user to another system, then when the control software determines that the pre-stored password matches the password to be authenticated, a prompt message indicating that the user has passed the login authentication can be sent to the other system, so that the other system allows the user to log in and access. When the control software determines that the pre-stored password does not match the password to be authenticated, a prompt message indicating that the user has not passed the login authentication can be sent to the other system, so that the other system refuses the user to log in and access.

[0053] As another example, if the user login request is initiated by the user to other systems, in addition to the firewall system performing login authentication on the user through the above steps, the control software can also read the pre-stored password corresponding to the user account from the programmable logic device, and send the pre-stored password to other systems, so that other systems can use the received pre-stored password to match the password to be authenticated obtained from the login request to determine whether the user passes the login authentication.

[0054] It can be seen that the user login method provided by the present application improves the password security from the perspective of changing the password storage location. Specifically, it utilizes the characteristic that the programmable logic device on the firewall mainboard can only be called through the software interface provided by the firewall system control software, and stores the password in the programmable logic device of the firewall mainboard through the control software, thereby enhancing the password storage security. In the process of users logging into various systems, the firewall system reads the pre-stored password from the programmable logic device to match it with the password to be authenticated in the user login request, thereby realizing user login authentication of various systems.

[0055] According to some embodiments of the present application, the step 230 of reading the pre-stored password corresponding to the user account from the programmable logic device may specifically include: Figure 3 Steps 231 - 232 are shown.

[0056] Step 231: According to the correspondence between the preset account number and the storage address, and the user account, the storage address of the pre-stored password in the programmable logic device is obtained.

[0057] Step 232: Read the pre-stored password from the storage address.

[0058] Exemplarily, the firewall system may be preset with a correspondence between an account and a storage address. The storage address is used to store a pre-stored password corresponding to each account. In this way, the control software may search for the storage address corresponding to the user account from the correspondence, and then address the programmable logic device based on the storage address, and read the pre-stored password corresponding to the user account from the storage address.

[0059] It can be seen that this embodiment presets the correspondence between the account and the storage address in the firewall system, so that the storage address corresponding to the user account can be found in the correspondence, and then the pre-stored password can be read by addressing the storage address in the programmable logic device to perform user login authentication.

[0060] According to some embodiments of the present application, the programmable logic device includes a CPLD. The CPLD includes a variety of storage resources, such as but not limited to registers, distributed RAM (Random Access Memory), block RAM, lookup table, non-volatile storage resources, etc. The pre-stored password can be stored in the non-volatile storage resource of the CPLD, thereby avoiding the loss of the pre-stored password after the firewall mainboard is powered off.

[0061] Based on a password management method or a user login method described in any of the above embodiments, the present application also provides Figure 4 The schematic diagram of the structure of a firewall mainboard is shown in FIG. Figure 4 At the hardware level, the firewall mainboard includes a processor, an internal bus, a network interface, a memory, a programmable logic device, and a non-volatile memory, and may also include hardware required for other services. Among them, the programmable logic device is used to store passwords. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement a password management method or a user login method described in any of the above embodiments.

[0062] Based on a password management method or a user login method described in any of the above embodiments, the present application also provides Figure 5 A schematic diagram of the structure of an electronic device is shown in FIG. Figure 5 At the hardware level, the electronic device includes Figure 4 The firewall mainboard shown. The firewall mainboard includes a processor, an internal bus, a network interface, a memory, a programmable logic device and a non-volatile memory, and may also include hardware required for other services. Among them, the programmable logic device is used to store passwords. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement a password management method or a user login method described in any of the above embodiments.

[0063] As an example, the electronic device may be a gateway device or other network intermediate device equipped with a firewall system.

[0064] Based on a password management method or a user login method described in any of the above embodiments, the present application also provides a computer program product, which includes one or more computer programs or instructions. The computer program or instruction can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. When the computer program is executed by a processor, a password management method or a user login method described in any of the above embodiments is implemented.

[0065] The present application also provides a computer storage medium, which stores a computer program. When the computer program is executed by a processor, it can be used to execute a password management method or a user login method described in any of the above embodiments.

[0066] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0067] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0068] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0069] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0070] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0071] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A password management method, characterized in that: The method is applied to a firewall system, the firewall system includes a firewall mainboard and control software, the firewall mainboard is deployed with a programmable logic device, the programmable logic device is called through an interface provided by the control software, and the method includes: In response to a password management request of a user, obtaining the operation authority of the user; the password management request includes one or more of a password storage request, a password modification request and a password deletion request; If the user's operating authority includes password management authority, calling the programmable logic device through the interface provided by the control software; A management operation corresponding to the password management request is performed on the pre-stored password in the programmable logic device.

2. The method according to claim 1, characterized in that The programmable logic device includes a complex programmable logic device (CPLD).

3. The method according to claim 2, characterized in that The CPLD includes a non-volatile storage resource, and the password is stored in the non-volatile storage resource.

4. The method according to claim 1, characterized in that The method further comprises: Obtaining user login information from a login request sent by a user, wherein the user login information includes a user account and a password to be authenticated; Calling the programmable logic device through the interface provided by the control software; Reading a pre-stored password corresponding to the user account from the programmable logic device; In the case that the pre-stored password matches the password to be authenticated, it is determined that the user has passed the login authentication.

5. The method according to claim 4, characterized in that The step of reading a pre-stored password corresponding to the user account from the programmable logic device includes: According to the correspondence between the preset account number and the storage address and the user account number, obtaining the storage address of the pre-stored password in the programmable logic device; The pre-stored password is read from the storage address.

6. The method according to claim 4 or 5, characterized in that: The programmable logic device includes a complex programmable logic device (CPLD), and the pre-stored password is stored in a non-volatile storage resource of the CPLD.

7. A firewall mainboard, characterized in that: The firewall mainboard comprises: processor; a memory for storing processor-executable instructions; A programmable logic device for storing passwords; Wherein, when the processor calls the executable instruction, it implements the operation of any method described in claims 1-6.

8. An electronic device, characterized in that: The electronic device comprises the firewall mainboard as claimed in claim 7.

9. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed by a processor, the steps of any method described in claims 1-6 are implemented.

Images