Password transmission method and system, client and server

Abstract

The invention discloses a password transmission method and system, a client and a server, and belongs to the technical field of data transmission, the method is applied to the client, the client communicates with the server, and a registration information database including an account and an encrypted password corresponding to the account is pre-stored in the server. The method comprises the steps that user login information input by a user and a client timestamp corresponding to the current moment are acquired, and the user login information comprises a login password and a login account; encrypting the login password based on a first preset encryption algorithm to obtain a first encrypted password; generating a first user login request according to the login account, the first encrypted password and the client timestamp; sending the first user login request to a server; and receiving and displaying a first login result returned by the server. According to the application, the login password input by the user is encrypted at the client, and the user login request is generated in combination with the timestamp, so that the security of password transmission in the intranet can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a password transmission method, system, client, and server. Background Art

[0002] Username and password login is a common login method. To prevent middlemen from stealing password information, passwords are usually encrypted during transmission. Currently, https is generally used as the network transmission protocol, which encrypts the transmitted data. However, https generally only prevents passwords from being stolen when transmitted over the public network. https verification is generally performed at the company's access layer gateway, while subsequent intranet communications are usually based on http, which does not encrypt data, resulting in the risk of password theft. Therefore, the password transmission method used in the existing technology has the problem of low security when transmitting passwords over the intranet. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a method, system, client and server for password transmission, so as to solve the problem that the password transmission method adopted in the prior art has low security when the password is transmitted in the intranet.

[0004] To achieve the above objectives, a first aspect of an embodiment of the present application provides a password transmission method, which is applied to a client, wherein the client communicates with a server, and the server pre-stores a registration information database including account numbers and encrypted passwords corresponding to the account numbers. The method includes:

[0005] Obtain the user login information entered by the user and the client timestamp corresponding to the current moment, where the user login information includes the login password and login account;

[0006] Encrypting the login password based on a first preset encryption algorithm to obtain a first encrypted password;

[0007] Generate a first user login request according to the login account, the first encrypted password and the client timestamp;

[0008] The first user login request is sent to the server, and the server searches the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database, matches the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request, and returns the first login result to the client;

[0009] Receive and display the first login result returned by the server.

[0010] In an embodiment of the present application, the method also includes: based on a second preset encryption algorithm, combining the first encrypted password and the client timestamp for secondary encryption to obtain a second encrypted password; generating a second user login request based on the second encrypted password, the client timestamp and the login account; sending the second user login request to the server, and the server, based on the second preset encryption algorithm, combining the target encrypted password and the client timestamp for secondary encryption to obtain target encrypted information, comparing the second encrypted password with the target encrypted information, determining a second login result corresponding to the second user login request, and returning the second login result to the client; receiving the second login result returned by the server and displaying it.

[0011] In an embodiment of the present application, the method also includes: obtaining account registration information input by the user, the account registration information including a registered account and a registered password; encrypting the registration password according to a first preset encryption algorithm to obtain an encrypted registration password; generating an account registration request based on the encrypted registration password and the registered account; sending the account registration request to the server, and the server associating the encrypted registration password and the registered account to store them in a registration information database, and returning registration success information to the client; receiving and displaying the registration success information returned by the server.

[0012] A second aspect of an embodiment of the present application provides a password transmission method, which is applied to a server, wherein the server communicates with a client, and a registration information database including account numbers and encrypted passwords corresponding to the account numbers is pre-stored in the server. The method includes:

[0013] Receiving a first user login request sent by a client, wherein the first user login request is generated by the client after obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account, encrypting the login password based on a first preset encryption algorithm to obtain an encrypted login password, and generating the encrypted login password based on the login account, the encrypted login password, and the client timestamp;

[0014] Search the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database;

[0015] Matching the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request;

[0016] The first login result is returned to the client.

[0017] In an embodiment of the present application, the method also includes: receiving a second user login request sent by the client, wherein the second user login request is performed by the client based on a second preset encryption algorithm, combining the first encrypted password and the client timestamp for secondary encryption to obtain a second encrypted password, and is generated based on the second encrypted password, the client timestamp and the login account; based on the second preset encryption algorithm, combining the target encrypted password and the client timestamp for secondary encryption to obtain target encrypted information; comparing the second encrypted password with the target encrypted information to determine the second login result corresponding to the second user login request; and returning the second login result to the client.

[0018] In an embodiment of the present application, the method also includes: obtaining the server timestamp at the current moment; determining the interval between the client timestamp and the server timestamp; if the interval is longer than a preset time, returning a login failure message to the client.

[0019] In an embodiment of the present application, the method further includes: receiving an account registration request sent by a client, wherein the account registration request is made by the client after obtaining account registration information input by a user, wherein the account registration information includes a registration account and a registration password, encrypting the registration password according to a first preset encryption algorithm to obtain an encrypted registration password, and generating the encrypted registration password based on the encrypted registration password and the registration account; associating the encrypted registration password and the registration account with each other and storing them in a registration information database; and returning registration success information to the client.

[0020] A third aspect of an embodiment of the present application provides a client, including:

[0021] The first acquisition module is used to obtain the user login information input by the user and the client timestamp corresponding to the current moment, wherein the user login information includes the login password and login account;

[0022] A first encryption module, configured to encrypt the login password based on a first preset encryption algorithm to obtain a first encrypted password;

[0023] A first generating module, configured to generate a first user login request according to the login account, the first encrypted password, and the client timestamp;

[0024] A first sending module is configured to send a first user login request to a server, where the server searches a registration information database based on the login account to obtain a target encrypted password corresponding to the login account stored in the registration information database, matches the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request, and returns the first login result to the client;

[0025] The first receiving module is used to receive and display the first login result returned by the server.

[0026] A fourth aspect of an embodiment of the present application provides a server, including:

[0027] a second receiving module, configured to receive a first user login request sent by a client, wherein the first user login request is generated by the client after obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account, encrypting the login password based on a first preset encryption algorithm to obtain an encrypted login password, and generating the encrypted login password based on the login account, the encrypted login password, and the client timestamp;

[0028] A second search module is used to search the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database;

[0029] a second comparison module, configured to match the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request;

[0030] The second sending module is used to return the first login result to the client.

[0031] A fifth aspect of an embodiment of the present application provides a password transmission system, comprising: the above-mentioned client; and the above-mentioned server.

[0032] The above technical solution encrypts the login password input by the user on the client and generates a user login request in combination with a timestamp, which is conducive to improving the security of the password when it is transmitted within the intranet.

[0033] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following detailed description, they are used to explain the embodiments of the present application but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0035] Figure 1 A flowchart of a password transmission method provided in an embodiment of the present application;

[0036] Figure 2 A flowchart of a password transmission method provided in another embodiment of the present application;

[0037] Figure 3 A flowchart of an account registration method provided in a specific embodiment of the present application;

[0038] Figure 4A flowchart of a user login method provided in a specific embodiment of the present application;

[0039] Figure 5 A structural block diagram of a client provided in an embodiment of the present application;

[0040] Figure 6 A structural block diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] To make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0042] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the various components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indications will also change accordingly.

[0043] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of such features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0044] Figure 1 This is a flow chart of a password transmission method provided in an embodiment of the present application. Figure 1 As shown, an embodiment of the present application provides a password transmission method, which is applied to a client, the client communicates with a server, and the server pre-stores a registration information database including an account number and an encrypted password corresponding to the account number. The method may include the following steps.

[0045] Step S101: Obtain user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account.

[0046] Step S102: Encrypt the login password based on a first preset encryption algorithm to obtain a first encrypted password.

[0047] Step S103: Generate a first user login request according to the login account, the first encrypted password and the client timestamp.

[0048] Step S104: Send the first user login request to the server. The server searches the registration information database based on the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database. The first encrypted password is matched with the target encrypted password to obtain the first login result corresponding to the first user login request, and the first login result is returned to the client.

[0049] Step S105: Receive and display the first login result returned by the server.

[0050] In an embodiment of the present application, a client can communicate with a server. The server pre-stores a registration information database, which includes multiple associated account numbers and corresponding encrypted passwords. The data stored in the registration information database is all data sent by the client during the account registration phase. When a user logs in to an account, the client can obtain the user login information entered by the user, including the login password and login account number. The client also obtains the current client timestamp to prevent replay attacks. The client can then encrypt the login password using a first preset encryption algorithm to obtain a first encrypted password, i.e., the login password encrypted using the first preset algorithm. In one embodiment, the first preset encryption algorithm can be set according to actual needs, such as sha256. In another example, to ensure the security of the password, an embodiment of the present application can encrypt the login password using an irreversible encryption method. Furthermore, the client can package the login account number, the first encrypted password, and the client timestamp, and encrypt them using a public key to obtain a first user login request, which is then sent to the server. The public key is a secret key pre-negotiated between the client and the server. The public key is configured on the client, while the private key is configured on the server. In this way, the security of the password transmission within the intranet can be guaranteed, and the password leakage during the intranet transmission can be prevented. After the client sends the first user login request to the server, the server will return the first login result corresponding to the first user login request. After receiving the first login result, the client will display the first login result to prompt the user.

[0051] It is understood that after receiving the first user login request sent by the client, the server can use the private key to decrypt the first user login request to obtain the login account, first encrypted password, and client timestamp in the first user login request. Then, to determine the login result corresponding to the first user login request, the server can search the registration information database based on the login account to find the target encrypted password corresponding to the login account. The target encrypted password is the encrypted password stored in the registration information database associated with the same account as the login account. It should be noted that the encrypted password stored in the registration information database is obtained using the same encryption method as the first encrypted password. Therefore, the first login result can be determined by matching the first encrypted password with the target encrypted password without decrypting the first encrypted password, and the first login result can be returned to the client. In one example, if the first encrypted password successfully matches the target encrypted password, the first login result is determined to be a successful login. In another example, if the first encrypted password fails to match the target encrypted password, the first login result is determined to be a failed login. In this way, directly processing the encrypted password can ensure the security of the password.

[0052] The above technical solution encrypts the login password input by the user on the client and generates a user login request in combination with a timestamp, which is conducive to improving the security of the password when it is transmitted within the intranet.

[0053] In an embodiment of the present application, the method may further include: based on a second preset encryption algorithm, combining the first encrypted password and the client timestamp for secondary encryption to obtain a second encrypted password; generating a second user login request based on the second encrypted password, the client timestamp and the login account; sending the second user login request to the server, and the server, based on a second preset encryption algorithm, combining the target encrypted password and the client timestamp for secondary encryption to obtain target encrypted information, comparing the second encrypted password with the target encrypted information, determining a second login result corresponding to the second user login request, and returning the second login result to the client; receiving and displaying the second login result returned by the server.

[0054] Specifically, in order to prevent the attacker from directly obtaining the first encrypted password from the client, the first encrypted password is used to simulate the login process. In an embodiment of the present application, after the client obtains the first encrypted password based on the first preset encryption algorithm, it can also combine the first encrypted password and the client timestamp for secondary encryption based on the second preset encryption algorithm to obtain the second encrypted password. That is, a double encryption method is adopted. Since the client timestamp is a variable, even if the attacker obtains the second encrypted password for a replay attack, the login will fail due to the change in the client timestamp. Therefore, the attacker can be prevented from performing a replay attack on the system, which is beneficial to improving the security of the system. Furthermore, the client can package the login account, the second encrypted password and the client timestamp, and encrypt them using the public key to obtain a second user login request, and send the second login request to the server, and finally receive the second login result returned by the server and display it to prompt the user. In this way, while ensuring the security of password transmission in the intranet, it can also prevent replay attacks, which is beneficial to improving the security of the system.

[0055] In one example, the first preset encryption algorithm and the second preset encryption algorithm are the same, which is beneficial to improving processing efficiency. In another example, the first preset encryption algorithm and the second preset encryption algorithm are different, which is beneficial to further improve the security of the password. The specific algorithm used can be set according to actual needs.

[0056] It will be appreciated that, after receiving the second user login request from the client, the server may decrypt the second user login request using the private key to obtain the login account, second encrypted password, and client timestamp contained in the second user login request. To determine the login result corresponding to the second user login request, the server may search the registration information database based on the login account to find the target encrypted password corresponding to the login account. The server then re-encrypts the target encrypted password and the client timestamp using a second pre-set encryption algorithm to obtain target encrypted information. Furthermore, the second encrypted password and the target encrypted information are matched to determine the second login result. In one example, if the second encrypted password successfully matches the target encrypted information, the second login result is determined to be a successful login. In another example, if the second encrypted password fails to match the target encrypted information, the first login result is determined to be a failed login. There are two possible reasons for a failed login: the user entered an incorrect login password, or an attacker used the second encrypted password to launch a replay attack. However, due to the change in the client timestamp when the attacker initiated the login request, the target encrypted information obtained after encryption using the second pre-set encryption algorithm is inconsistent with the second encrypted password. This approach ensures password security while also preventing replay attacks.

[0057] In an embodiment of the present application, the method also includes: obtaining account registration information input by the user, the account registration information including a registered account and a registered password; encrypting the registration password according to a first preset encryption algorithm to obtain an encrypted registration password; generating an account registration request based on the encrypted registration password and the registered account; sending the account registration request to the server, and the server associating the encrypted registration password and the registered account to store them in a registration information database, and returning registration success information to the client; receiving and displaying the registration success information returned by the server.

[0058] Specifically, during the account registration phase, the client can obtain the account registration information entered by the user and then encrypt the registration password in the account registration information using a first preset encryption algorithm to obtain an encrypted registration password. The client can then package the encrypted registration password and the registered account number and generate an account registration request through public key encryption. The client then sends the account registration request to the server. After registration is complete, the client can receive and display a successful registration message returned by the server.

[0059] It is understood that after receiving the account registration request sent by the client, the server can decrypt the account registration request using the private key to obtain the encrypted registration password and registration account number, then associate the encrypted registration password and registration account number and store them in the established registration information database to update the registration information database, and return a successful registration message to the client. This provides a basis for determining the subsequent login result.

[0060] Figure 2 This is a flowchart of a password transmission method provided by another embodiment of the present application. Figure 2 As shown, an embodiment of the present application provides a password transmission method, which is applied to a server, where the server communicates with a client, and a registration information database including an account number and an encrypted password corresponding to the account number is pre-stored in the server. The method may include the following steps.

[0061] Step S201: receiving a first user login request sent by a client, wherein the first user login request is generated by the client after obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account, encrypting the login password based on a first preset encryption algorithm to obtain an encrypted login password, and generating the encrypted login password based on the login account, the encrypted login password, and the client timestamp;

[0062] Step S202: searching the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database.

[0063] Step S203: Match the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request.

[0064] Step S204: Return the first login result to the client.

[0065] Specifically, after receiving a first user login request from a client, the server can decrypt the first user login request using a private key to obtain the login account, first encrypted password, and client timestamp contained in the first user login request. Then, to determine the login result corresponding to the first user login request, the server can search the registration information database based on the login account to find the target encrypted password corresponding to the login account. The target encrypted password is the encrypted password stored in the registration information database and associated with the account with the same login account. It should be noted that the encrypted password stored in the registration information database is obtained using the same encryption method as the first encrypted password. Therefore, the first login result can be determined by matching the first encrypted password with the target encrypted password without decrypting the first encrypted password, and the first login result can be returned to the client. In one example, if the first encrypted password successfully matches the target encrypted password, the first login result is determined to be a successful login. In another example, if the first encrypted password fails to match the target encrypted password, the first login result is determined to be a failed login. In this way, directly processing the encrypted password ensures password security.

[0066] In an embodiment of the present application, the method may further include: receiving a second user login request sent by the client, wherein the second user login request is performed by the client based on a second preset encryption algorithm, combining the first encrypted password and the client timestamp for secondary encryption to obtain a second encrypted password, and is generated based on the second encrypted password, the client timestamp and the login account; based on the second preset encryption algorithm, combining the target encrypted password and the client timestamp for secondary encryption to obtain target encrypted information; comparing the second encrypted password with the target encrypted information to determine the second login result corresponding to the second user login request; and returning the second login result to the client.

[0067] Specifically, after receiving a second user login request from a client, the server can use the private key to decrypt the second user login request to obtain the login account, second encrypted password, and client timestamp in the second user login request. Then, to determine the login result corresponding to the second user login request, the server can search the registration information database based on the login account to find the target encrypted password corresponding to the login account. The server then re-encrypts the target encrypted password and the client timestamp using a second preset encryption algorithm to obtain target encrypted information. Furthermore, the second encrypted password and the target encrypted information are matched to determine the second login result. In one example, if the second encrypted password successfully matches the target encrypted information, the second login result is determined to be a successful login. In another example, if the second encrypted password fails to match the target encrypted information, the first login result is determined to be a failed login. There are two possible reasons for a failed login: the user entered an incorrect login password, or an attacker used the second encrypted password to launch a replay attack. However, due to the change in the client timestamp when the attacker initiated the login request, the target encrypted information obtained after encryption using the second preset encryption algorithm is inconsistent with the second encrypted password. This approach ensures password security while also preventing replay attacks.

[0068] In an embodiment of the present application, the method may further include: obtaining a server timestamp of the current moment;

[0069] Determine the interval between the client timestamp and the server timestamp; if the interval is longer than the preset time, return a login failure message to the client.

[0070] Specifically, after receiving a user login request and obtaining the parameters in the request, the server can first obtain the server timestamp of the time the request was received. The user login request includes a client timestamp. Before performing a password match, the server can first determine the time interval between the client timestamp and the server timestamp and determine whether the time interval is greater than a preset duration. If the preset duration is exceeded, a login failure is directly returned to the client. If the preset duration is not exceeded, the server proceeds to the next step. The preset duration can be set based on actual conditions, and an attacker cannot perform a replay attack within the preset duration.

[0071] In an embodiment of the present application, the method may further include: receiving an account registration request sent by a client, wherein the account registration request is made by the client after obtaining account registration information input by a user, wherein the account registration information includes a registration account and a registration password, encrypting the registration password according to a first preset encryption algorithm to obtain an encrypted registration password, and generating the encrypted registration password based on the encrypted registration password and the registration account; associating the encrypted registration password and the registration account with each other and storing them in a registration information database; and returning registration success information to the client.

[0072] Specifically, after receiving the account registration request from the client, the server can decrypt the request using the private key to obtain the encrypted registration password and registered account number. The server then associates the encrypted registration password and registered account number and stores them in a pre-built registration information database, updating the database and returning a successful registration message to the client. This provides a basis for determining the subsequent login result.

[0073] Figure 3 This is a flowchart of an account registration method provided in a specific embodiment of the present application. Figure 3 As shown, based on a password transmission method provided in an embodiment of the present application, taking the first preset encryption algorithm and the second preset encryption algorithm as the same and both using the sha256 algorithm as an example, a specific embodiment of the present application provides an account registration method, which may include the following steps.

[0074] S11. After the user password is input, the password input by the user is obtained and the password is encrypted using sha256.

[0075] S12. Perform public key encryption on the password encrypted with sha256.

[0076] S13. Send the encrypted password to the server.

[0077] S14. The server uses the private key to decrypt (the decrypted password is actually the password encrypted by sha256).

[0078] S15. The server saves the decrypted password into the database.

[0079] Specifically, when registering an account, the client will obtain the password entered by the user (hereinafter referred to as password), and then encrypt the password with sha256 (hereinafter referred to as sha256 (password)) to hide the original password and prevent the original password from being leaked. The client can then use the public key to encrypt sha256 (password) to ensure the security of the password's intranet transmission and prevent the password from being leaked during intranet transmission. Among them, the public key is a secret key negotiated in advance by the client and the server. The public key is configured on the client, and the private key is configured on the server. Furthermore, after receiving the encrypted password data, the server uses the private key to decrypt it. The decrypted data is sha256 (password). The server saves sha256 (password) to the database for subsequent login needs. Among them, the database is the encrypted password database in the embodiment of the present application. The reason for saving sha256 (password) in the database instead of password in the database is mainly to prevent the leakage of user passwords caused by the leakage of database data. It is understood that when registering an account, the client will send the registered account and encrypted password entered by the user to the server. To facilitate subsequent search, the server will associate the encrypted password and registered account and store them in the database.

[0080] Figure 4 This is a flowchart of a user login method provided in a specific embodiment of the present application. Figure 4 As shown, based on a password transmission method provided in an embodiment of the present application, a specific embodiment of the present application also provides a user login method, which may include the following steps.

[0081] S21. Obtain the password input by the user, encrypt the password with sha256, and obtain sha256 (pas sword).

[0082] S22. Perform sha256 encryption on the encrypted password and the current timestamp to obtain sha256(sha256(password)+timestamp).

[0083] S23. Send the username, current timestamp and sha256 (sha256 (pa ssword) + timestamp) together to the server (send a login request to the server).

[0084] S24. After receiving the login request, the server obtains parameters username, timestamp, and sha256 (sha256 (password) + timestamp).

[0085] S25. The server finds the corresponding user's password in the database through username, assuming it is sha256(password)_real.

[0086] S216. Perform sha256 encryption on the password found in the previous step and the timestamp in the login request parameter to obtain sha256(sha256(password)_real+timestamp).

[0087] S27. Determine whether sha256(sha256(password)+timestamp)=sha256(sha256(password)_real+timestamp) is true. If so, proceed to step S28; otherwise, proceed to step S29.

[0088] S28. Login successful.

[0089] S29. Login failed.

[0090] Specifically, when the user logs in, the client can obtain the password entered by the user, encrypt the password with sha256, and obtain sha256(password), which helps prevent the leakage of the plain text password. The client can then encrypt the sha256-encrypted password and the current timestamp with sha256 again to obtain sha256(sha256(password)+timestamp). Adding a timestamp can prevent replay attacks, and using sha256 to encrypt again helps prevent hackers from simulating the login process after obtaining sha256(password). Finally, the client will send a login request to the server. The parameters carried in the login request include the username username, timestamp timestamp, and

[0091] sha256(sha256(password)+timestamp).

[0092] After receiving the login request, the server obtains the parameters username, timestamp, and sha256 (sha256 (password) + timestamp) from the login request, and searches the database for the corresponding user's password based on the username. Here, sha256 (password)_real is used to represent the user password found from the database. Then, the server can perform a sha256 encryption on sha256 (password)_real and the timestamp in the login request to obtain

[0093] sha256(sha256(password)_real+timestamp). Further,

[0094] Compare sha256(sha256(password)_real+timestamp) with the sha256(sha256(password)+timestamp) in the login request. If the two are the same, then the username and password entered by the user are correct and the login is determined to be successful. Otherwise, the password entered by the user is incorrect and the login is determined to be failed.

[0095] In an example, after the server receives a login request and obtains the parameters in the login request, it can first compare the timestamp with the current server timestamp to determine whether the time interval exceeds the preset time interval. For example, the preset time interval is 5 minutes. Here, it is considered that replay attacks cannot be prevented within 5 minutes, that is, it is determined whether the time interval between the two is more than 5 minutes. If it exceeds 5 minutes, the server directly returns a login failure. If it does not exceed 5 minutes, it goes to the next step.

[0096] Thus, the embodiment of the present application adopts the faster sha256 encryption and adds a timestamp in the encryption process, which is beneficial for preventing replay attacks and preventing password leakage, thereby ensuring the security of password transmission. It should be noted that the sha256 encryption algorithm adopted in the above specific embodiment is only for illustration, and other encryption methods may also be adopted.

[0097] Figure 5 This is a structural block diagram of a client provided in an embodiment of the present application. Figure 5 As shown, the embodiment of the present application further provides a client 500, which may include.

[0098] The first acquisition module 510 is configured to acquire user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account.

[0099] The first encryption module 520 is configured to encrypt the login password based on a first preset encryption algorithm to obtain a first encrypted password.

[0100] The first generating module 530 is configured to generate a first user login request according to the login account, the first encrypted password, and the client timestamp.

[0101] The first sending module 540 is used to send the first user login request to the server, and the server searches the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database, matches the first encrypted password with the target encrypted password to obtain the first login result corresponding to the first user login request, and returns the first login result to the client.

[0102] The first receiving module 450 is configured to receive and display the first login result returned by the server.

[0103] The client 500 encrypts the login password input by the user and generates a user login request in combination with a timestamp, which is beneficial to improving the security of the password when it is transmitted within the intranet.

[0104] In one embodiment, the client 500 is further configured to: perform secondary encryption on the first encrypted password and the client timestamp based on a second preset encryption algorithm to obtain a second encrypted password; and generate a second user login request based on the second encrypted password, the client timestamp, and the login account;

[0105] The second user login request is sent to the server, and the server, based on a second preset encryption algorithm, combines the target encryption password and the client timestamp for secondary encryption to obtain target encryption information. The second encrypted password is compared with the target encryption information to determine the second login result corresponding to the second user login request, and the second login result is returned to the client; the second login result returned by the server is received and displayed.

[0106] In one embodiment, the client 500 is also used to: obtain account registration information entered by the user, the account registration information including the registration account and registration password; encrypt the registration password according to a first preset encryption algorithm to obtain an encrypted registration password; generate an account registration request based on the encrypted registration password and the registration account; send the account registration request to the server, and the server associates the encrypted registration password and the registration account and stores them in the registration information database, and returns the successful registration information to the client; receive the successful registration information returned by the server and display it.

[0107] Figure 6 This is a structural block diagram of a server provided in an embodiment of the present application. Figure 6 As shown, the embodiment of the present application further provides a server 600, which may include.

[0108] The second receiving module 601 is used to receive a first user login request sent by the client, wherein the first user login request is made by the client after obtaining the user login information input by the user and the client timestamp corresponding to the current moment, wherein the user login information includes the login password and the login account, and the login password is encrypted based on the first preset encryption algorithm to obtain an encrypted login password, and is generated according to the login account, the encrypted login password and the client timestamp.

[0109] The second search module 610 is configured to search the registration information database according to the login account to obtain the target encrypted password corresponding to the login account stored in the registration information database.

[0110] The second comparison module 520 is configured to match the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request.

[0111] The second sending module 640 is configured to return the first login result to the client.

[0112] The server 600 receives a user login request sent by a client and determines a login result according to the user login request and the encrypted password database, which is helpful to ensure the security of the password.

[0113] In one embodiment, the server 600 is also used to: receive a second user login request sent by the client, wherein the second user login request is generated by the client based on a second preset encryption algorithm, combining the first encrypted password and the client timestamp for secondary encryption to obtain a second encrypted password, and is generated based on the second encrypted password, the client timestamp and the login account; based on the second preset encryption algorithm, combining the target encrypted password and the client timestamp for secondary encryption to obtain target encrypted information; comparing the second encrypted password with the target encrypted information to determine the second login result corresponding to the second user login request; and returning the second login result to the client.

[0114] In one embodiment, the server 600 is further configured to: obtain a server timestamp of the current moment;

[0115] Determine the interval between the client timestamp and the server timestamp; if the interval is longer than the preset time, return a login failure message to the client.

[0116] In one embodiment, the server 600 is also used to: receive an account registration request sent by a client, wherein the account registration request is made by the client after obtaining the account registration information entered by the user, wherein the account registration information includes a registration account and a registration password, encrypting the registration password according to a first preset encryption algorithm to obtain an encrypted registration password, and generating it based on the encrypted registration password and the registration account; associating the encrypted registration password and the registration account and storing them in a registration information database; and returning registration success information to the client.

[0117] An embodiment of the present application further provides a password transmission system, comprising: the client in the above embodiment; and the server in the above embodiment.

[0118] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0119] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0123] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0124] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0126] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for password transmission, characterized in that: Applied to a client, the client communicating with a server, the server pre-stored with a registration information database including an account number and an encrypted password corresponding to the account number, the method comprising: Obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account; Encrypting the login password based on a first preset encryption algorithm to obtain a first encrypted password; Generate a first user login request according to the login account, the first encrypted password and the client timestamp; Sending the first user login request to the server, the server searching the registration information database according to the login account to obtain a target encrypted password corresponding to the login account stored in the registration information database, matching the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request, and returning the first login result to the client; Receive and display the first login result returned by the server.

2. The method according to claim 1, characterized in that The method further comprises: Based on a second preset encryption algorithm, the first encrypted password and the client timestamp are combined and re-encrypted to obtain a second encrypted password; generating a second user login request according to the second encrypted password, the client timestamp, and the login account; Sending the second user login request to the server, the server combining the target encryption password and the client timestamp to perform secondary encryption based on the second preset encryption algorithm to obtain target encrypted information, comparing the second encrypted password with the target encrypted information, determining a second login result corresponding to the second user login request, and returning the second login result to the client; The second login result returned by the server is received and displayed.

3. The method according to claim 1, characterized in that The method further comprises: Obtaining the account registration information entered by the user, the account registration information including the registration account and registration password; Encrypting the registration password according to the first preset encryption algorithm to obtain an encrypted registration password; generating an account registration request according to the encrypted registration password and the registration account; Sending the account registration request to the server, which associates the encrypted registration password with the registered account and stores it in the registration information database, and returns a successful registration message to the client; Receive and display the registration success information returned by the server.

4. A password transmission method, characterized in that: Applied to a server that communicates with a client, wherein a registration information database including an account number and an encrypted password corresponding to the account number is pre-stored in the server, the method comprising: receiving a first user login request sent by the client, wherein the first user login request is generated by the client after obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account, encrypting the login password based on a first preset encryption algorithm to obtain an encrypted login password, and generating the encrypted login password based on the login account, the encrypted login password, and the client timestamp; Searching the registration information database according to the login account to obtain a target encrypted password corresponding to the login account stored in the registration information database; Matching the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request; Return the first login result to the client.

5. The method according to claim 4, characterized in that The method further comprises: receiving a second user login request sent by the client, wherein the second user login request is performed by the client using a second preset encryption algorithm by combining the first encrypted password and the client timestamp to obtain a second encrypted password, and generating the second encrypted password based on the second encrypted password, the client timestamp, and the login account; Based on the second preset encryption algorithm, the target encryption password and the client timestamp are combined and re-encrypted to obtain target encrypted information; comparing the second encrypted password with the target encrypted information to determine a second login result corresponding to the second user login request; The second login result is returned to the client.

6. The method according to claim 4 or 5, characterized in that The method further comprises: Get the server timestamp of the current moment; Determining the duration of the interval between the client timestamp and the server timestamp; When the interval time is longer than the preset time, a login failure message is returned to the client.

7. The method according to claim 4, characterized in that The method further comprises: receiving an account registration request sent by the client, wherein the account registration request is generated by the client after obtaining account registration information input by the user, wherein the account registration information includes a registration account and a registration password, encrypting the registration password according to the first preset encryption algorithm to obtain an encrypted registration password, and generating the encrypted registration password based on the encrypted registration password and the registration account; Associating the encrypted registration password with the registration account and storing it in the registration information database; Return the registration success information to the client.

8. A client, characterized in that: include: A first acquisition module is used to obtain user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account; a first encryption module, configured to encrypt the login password based on a first preset encryption algorithm to obtain a first encrypted password; A first generating module, configured to generate a first user login request according to the login account, the first encrypted password, and the client timestamp; a first sending module, configured to send the first user login request to the server; the server searches the registration information database according to the login account to obtain a target encrypted password corresponding to the login account stored in the registration information database; matches the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request; and returns the first login result to the client; The first receiving module is used to receive and display the first login result returned by the server.

9. A server, characterized in that: include: a second receiving module, configured to receive a first user login request sent by the client, wherein the first user login request is generated by the client after obtaining user login information input by the user and a client timestamp corresponding to the current moment, wherein the user login information includes a login password and a login account, encrypting the login password based on a first preset encryption algorithm to obtain an encrypted login password, and generating the encrypted login password based on the login account, the encrypted login password, and the client timestamp; A second search module is configured to search the registration information database according to the login account to obtain a target encrypted password corresponding to the login account stored in the registration information database; a second comparison module, configured to match the first encrypted password with the target encrypted password to obtain a first login result corresponding to the first user login request; The second sending module is used to return the first login result to the client.

10. A password transmission system, characterized in that: include: The client according to claim 8; as well as A server according to claim 9.

Images