Weak password checking method and device, equipment, storage medium and program product

Abstract

The invention provides a weak password checking method and device, equipment, a storage medium and a program product, and relates to the field of big data. The method comprises the steps that terminal equipment encrypts a user password by using a terminal salt value to obtain a password ciphertext, the password ciphertext and the terminal salt value are sent to a service application server, so that the service application server verifies the password ciphertext through a filtering model corresponding to the terminal salt value, and when the password is verified to be a weak password, the terminal salt value is sent to the service application server; sending modification prompt information to the user terminal; wherein the filtering model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by adopting the server salt value. According to the method, the whole-process plaintext-free processing is realized, so that the security of the user password is improved, the data leakage probability is reduced, and the user experience is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of big data, and in particular, to a weak password checking method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] User passwords (i.e., passwords) are an important way of identity authentication, but users often set weak passwords (e.g., birthdays, simple number / letter sequences), so passwords are easy to be cracked, causing data security risks.

[0003] The prior art transmits the encrypted password to the background after the user sets the password in the front end, obtains the plaintext by decrypting in the background, and checks according to the weak password rule.

[0004] However, the prior art uses the background to decrypt the plaintext, which violates the security requirements and cannot meet the security requirements of the financial field, further increasing the probability of data leakage and account theft. SUMMARY

[0005] The present application provides a weak password checking method, device, equipment, storage medium and program product to reduce the probability of data leakage and improve user experience.

[0006] In a first aspect, the present application provides a weak password checking method applied to a business application server, comprising:

[0007] Obtaining a terminal salt value and a password ciphertext uploaded by a user terminal, the password ciphertext being obtained by encrypting a user password based on the terminal salt value by the user terminal, and the terminal salt value being consistent with a server salt value;

[0008] Verifying the password ciphertext by a filtering model corresponding to the terminal salt value, and sending a modification prompt to the user terminal when the password ciphertext is verified as a weak password;

[0009] The filtering model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to a weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library using the server salt value.

[0010] In a second aspect, the present application provides a weak password checking method applied to a user terminal, comprising:

[0011] Receiving a user password input by a user, encrypting the user password based on a terminal salt value to obtain a password ciphertext, and the terminal salt value being consistent with a server salt value of a business application server;

[0012] send the password ciphertext and the terminal salt value to the service application server, so that the service application server verifies the password ciphertext through a filter model corresponding to the terminal salt value, and sends a modification prompt information to the user terminal when the password ciphertext is verified as a weak password;

[0013] The filter model corresponding to the terminal salt value is constructed by the service application server according to at least one weak password ciphertext corresponding to a weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using a server salt value by the service application server.

[0014] In a third aspect, the present application provides a weak password checking device applied to a service application server, comprising:

[0015] The obtaining module is configured to obtain a terminal salt value and a password ciphertext uploaded by a user terminal, the password ciphertext being obtained by encrypting a user password based on the terminal salt value by the user terminal, and the terminal salt value being consistent with a server salt value;

[0016] The first processing module is configured to verify the password ciphertext through a filter model corresponding to the terminal salt value, and send a modification prompt information to the user terminal when the password ciphertext is verified as a weak password.

[0017] The filter model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to a weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using a server salt value by the service application server.

[0018] In a fourth aspect, the present application provides a weak password checking device applied to a user terminal, comprising:

[0019] The receiving module is configured to receive a user password input by a user, encrypt the user password based on a terminal salt value to obtain a password ciphertext, and the terminal salt value is consistent with a server salt value of a service application server.

[0020] The second processing module is configured to send the password ciphertext and the terminal salt value to the service application server, so that the service application server verifies the password ciphertext through a filter model corresponding to the terminal salt value, and sends a modification prompt information to the user terminal when the password ciphertext is verified as a weak password.

[0021] The filter model corresponding to the terminal salt value is constructed by the service application server according to at least one weak password ciphertext corresponding to a weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using a server salt value by the service application server.

[0022] In a fifth aspect, an electronic device is provided, comprising a memory and a processor.

[0023] The memory stores computer-executable instructions;

[0024] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the embodiments of the first aspect and / or the second aspect.

[0025] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, and the computer-readable storage medium stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the computer-executable instructions are used to implement the embodiments of the first aspect and / or the second aspect.

[0026] In a seventh aspect, an embodiment of the present application provides a computer program product, and the computer program product comprises a computer program. When the computer program is executed by a processor, the computer program implements the embodiments of the first aspect and / or the second aspect.

[0027] The weak password checking method, device, equipment, storage medium and program product provided by the present application encrypt the user password by using the terminal salt value of the terminal equipment to obtain password ciphertext, and send the password ciphertext and the terminal salt value to the business application server, so that the business application server verifies the password ciphertext by using the filtering model corresponding to the terminal salt value, and sends a modification prompt information to the user terminal when the password is verified as a weak password. The filtering model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using the server salt value. The present application realizes whole process without clear text processing to protect password security, reduces the probability of data leakage, and improves user experience. BRIEF DESCRIPTION OF DRAWINGS

[0028] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the present application.

[0029] Figure 1 The existing technical scenario provided by the present application is shown in the figure;

[0030] Figure 2 The flowchart of the weak password checking method provided by the present application is shown in the figure; Figure One ;

[0031] Figure 3 The flowchart of the weak password checking method provided by the present application is shown in the figure; Figure Two ;

[0032] Figure 4 The structure of the weak password checking device provided by the present application is shown in the figure; Figure One ;

[0033] Figure 5 The structure of the weak password checking device provided by the present application is shown in the figure; Figure Two;

[0034] Figure 6 The structural schematic diagram of the electronic device provided in the present application is shown.

[0035] The specific embodiments of the present application have been shown by the above-mentioned drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to limit the scope of the present application concept in any way, but to illustrate the present application concept to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0036] The exemplary embodiments will be described in detail herein with reference to the accompanying drawings. In the following description, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments are not representative of all embodiments consistent with the present application. Rather, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards of relevant countries and regions, necessary security measures are taken, public order and good customs are not violated, and appropriate operation portals are provided for users to choose authorization or refusal.

[0038] And the present application involves big data analysis of user information (including but not limited to personal biological characteristics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and uses artificial intelligence technology for automatic decision-making, and makes technical solutions based on automatic decision-making results that have a significant impact on personal rights and interests, provides appropriate operation portals for users to choose to agree or refuse automatic decision-making results; if the user chooses to refuse, the expert decision-making process is entered.

[0039] It should be noted that the weak password checking method, device, equipment, storage medium and program product provided by the present application can be used in the field of big data, and can also be used in any field other than the field of big data. The application field of the weak password checking method, device, equipment, storage medium and program product in the present application is not limited.

[0040] When the customer sets or modifies the login password in the terminal device (such as mobile bank APP, online bank client), the weak password checking is performed on the password input by the customer to avoid the customer setting weak password which is easy to be cracked, and to protect the account security.

[0041] As shown in the prior art, Figure 1 After the client sets the password on the front-end device, the front-end device encrypts the password, transmits the encrypted password to the back-end device after encryption is completed, decrypts the encrypted password through the back-end device, obtains the password plaintext, and compares the password plaintext with the weak password list. If the password plaintext exists in the weak password list, it is determined that the password is a weak password.

[0042] However, the method of the prior art can cause the password plaintext to be exposed during decryption by the back-end device, further causing the password to be leaked, and it is difficult to meet the security requirements of the financial field. Furthermore, as the weak password library scale expands, the efficiency of the plaintext comparison by the back-end device after decryption is low, and a large amount of system resources are occupied, which can further cause business response delay, affecting user experience and system stability.

[0043] In addition, the prior art also embeds weak password judgment rules in hardware security devices, and assists in developing detection logic by the manufacturer of the hardware security devices. However, this method needs to expose the weak password rules to the manufacturer, and when the rules are updated, all security hardware devices need to be upgraded, which is complex and time-consuming, and is difficult to adapt to the dynamic update requirements of the weak password library, and the storage and computing capacity of the hardware devices are limited, and the detection efficiency is low.

[0044] The weak password checking method provided in the present application aims to solve the above technical problems of the prior art.

[0045] The weak password checking method provided in the present application processes the weak password library according to the server salt value of the business application server to construct a filtering model corresponding to the server salt value, and initiates a salt value reading request to the business application server every second preset period through the user terminal, so that the business application server synchronizes the stored server salt value to the user terminal in time, so that the terminal salt value stored and used by the user terminal is consistent with the server salt value stored by the business application server. After the salt value is synchronized, the user terminal uses the consistent terminal salt value to encrypt the user password input by the user to obtain the encrypted password ciphertext, and sends the terminal salt value and the password ciphertext to the business application server, so that the business application server calls the filtering model corresponding to the terminal salt value to determine whether the password ciphertext is a weak password. When it is determined that it is a weak password, a message of re-entering the password is sent to the user terminal. The present application realizes weak password checking in the ciphertext state, supports flexible rule updating, guarantees password security while improving checking efficiency, and enhances the defense against rainbow table attacks.

[0046] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes can not be described again in some examples. The embodiments of the present application will be described below with reference to the drawings.

[0047] Figure 2 Flowchart of the weak password checking method provided by the present application Figure One As shown in Figure 2 , the method comprises:

[0048] S201, obtaining the terminal salt value and the password ciphertext uploaded by the user terminal, the password ciphertext being obtained by encrypting the user password based on the terminal salt value by the user terminal, and the terminal salt value being consistent with the server salt value.

[0049] Optionally, when obtaining the terminal salt value and the password ciphertext uploaded by the user terminal, the terminal salt value needs to be controlled to be consistent with the server salt value of the business application server. Wherein, the control of the consistency of the terminal salt value and the server salt value of the business application server comprises: receiving the salt value reading instruction sent by the user terminal every second preset period; based on the salt value reading instruction, comparing the terminal salt value of the user terminal with the server salt value generated by the business application server, if the comparison is consistent, it is determined that the terminal salt value of the user terminal does not need to be updated; otherwise, the server salt value generated by the business application server is sent to the user terminal to update the terminal salt value according to the server salt value.

[0050] Optionally, the control of the consistency of the terminal salt value and the server salt value of the business application server comprises: sending the salt value reading instruction to the business application server every second preset period, so that the business application server compares the terminal salt value of the user terminal with the server salt value generated by the business application server based on the salt value reading instruction, if the comparison is consistent, it is determined that the terminal salt value of the user terminal does not need to be updated, otherwise, the server salt value generated by the business application server is sent to the user terminal to update the terminal salt value according to the server salt value.

[0051] For example, the business application server receives the salt value reading instruction sent by the user terminal every second preset period, compares the terminal salt value of the user terminal with the server salt value generated by the business application server based on the salt value reading instruction, if they are consistent, it is determined that the terminal salt value of the user terminal does not need to be updated; if they are not consistent, the server salt value generated by the business application server is sent to the user terminal. This embodiment realizes the dynamic synchronization of the terminal salt value and the server salt value, ensures that they are always consistent, avoids errors in the verification process due to the mismatch of the salt values, and improves the reliability and stability of the weak password checking process.

[0052] S202, verifying the password ciphertext by the filtering model corresponding to the terminal salt value, and sending a modification prompt to the user terminal when the password is verified as a weak password.

[0053] More specifically, the filtering model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library using the server salt value.

[0054] Optionally, the user password input by the user is received, and the user password is encrypted based on the terminal salt value to obtain a password ciphertext, the terminal salt value being consistent with the server salt value of the service application server; the password ciphertext and the terminal salt value are sent to the service application server, so that the service application server verifies the password ciphertext by the filtering model corresponding to the terminal salt value, and sends a modification prompt to the user terminal when the password is verified as a weak password; wherein the filtering model corresponding to the terminal salt value is constructed by the service application server according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by the service application server by encrypting at least one weak password in the weak password library using the server salt value.

[0055] In the embodiment of the application, the service application server uses the latest server salt value generated in the process of constructing the filtering model to encrypt the weak password in the weak password library, which is the same as the method of encrypting the user password input by the user terminal using the latest terminal salt value. Both methods use the HMAC algorithm (such as high-strength hash algorithm) to perform irreversible operation on the terminal salt value (or server salt value) and the user password (or weak password) as input, to generate irreversible password ciphertext and / or weak password ciphertext.

[0056] Optionally, after constructing the filtering model, the salt value is updated every first preset period to obtain an updated server salt value; the weak password in the weak password library is encrypted based on the updated server salt value to reconstruct the filtering model, and a preset number of old version filtering models are stored, the old version filtering model being constructed by encrypting the weak password in the weak password library using the historical salt value before the updated server salt value.

[0057] For example, the service application server encrypts a plurality of weak passwords in the weak password library using the latest server salt value generated at present.

[0058] In a possible embodiment, the business application server performs salt value updating every first preset period to obtain an updated server salt value; then, the business application server encrypts the weak passwords in the weak password library based on the updated server salt value, reconstructs the filter model, and retains a preset number (for example, 2) of historical salt values to construct an old version of the filter model for the weak passwords in the weak password library. The embodiment of the present application enhances the security of encryption, reduces the probability of salt value cracking, and retains the old version of the filter model to adapt to the user terminal that does not update the salt value in time, thereby ensuring the continuity and compatibility of the verification process, avoiding the situation that some users cannot normally use the service due to the non-updated salt value, further improving the service continuity and stability, and enhancing the user experience.

[0059] Optionally, when the weak password library is updated, the newly added weak password is encrypted by the server salt value of the business application server to obtain newly added weak password ciphertext, and the newly added weak password ciphertext is supplemented to the filter model corresponding to the server salt value. In the embodiment of the present application, when the weak password library is updated, the newly added weak password is encrypted by the server salt value of the business application server to be supplemented to the filter model corresponding to the server salt value, so that the filter model can timely contain the newly added weak password information, the checking and identification of the newly added weak password are improved, the weak password identification accuracy and reliability are improved, and the data security is enhanced.

[0060] Optionally, the password ciphertext is verified by the filter model corresponding to the terminal salt value, specifically including: determining the filter model corresponding to the terminal salt value, determining whether there is at least one weak password ciphertext consistent with the password ciphertext through the filter model; if there is, determining that the user password corresponding to the password ciphertext is any one of the weak passwords in the weak password library; otherwise, determining that the user password is not any one of the weak passwords in the weak password library. The embodiment of the present application quickly judges whether the user password is a weak password based on the efficient existence detection capability of the filter model, and does not need to decrypt the ciphertext, thereby enhancing the password security while improving the accuracy and efficiency of the weak password checking.

[0061] The weak password checking method provided by the embodiment of the present application acquires the terminal salt value and the password ciphertext uploaded by the user terminal, verifies the password ciphertext based on the filter model corresponding to the terminal salt value, and sends a modification prompt information to the user terminal if the password is a weak password. The above process does not need to process the password plaintext, thereby avoiding the probability of password plaintext leakage.

[0062] Figure 3 The flowchart of the weak password checking method provided by the present application Figure Two As shown in the figure, Figure 3 the embodiment of the present application updates the server salt value every first preset period to obtain an updated server salt value, encrypts the weak passwords in the weak password library based on the updated server salt value, reconstructs the filter model, and retains a preset number (for example, 2) of historical salt values to construct an old version of the filter model for the weak passwords in the weak password library. Figure 2On the basis of the embodiment, the weak password checking method is described in detail, and the method comprises the following steps:

[0063] S301, the service application server updates the server salt value every first preset period.

[0064] More specifically, the service application server sets the first preset period (for example, 24 hours) according to the security control policy, generates a new server salt value through a random algorithm, stores the new server salt value in a secure storage area, and records a salt value generation timestamp. The timestamp is used for subsequent version management.

[0065] S302, the service application server reads the weak password from the weak password library.

[0066] More specifically, the service application server accesses the weak password library through an encrypted channel, reads the latest weak password set (for example, birthday, continuous number sequence, etc.), and performs deduplication and format standardization processing (for example, uniform character encoding) on the read weak password.

[0067] S303, the service application server encrypts the read weak password according to the updated server salt value to construct a filter model.

[0068] More specifically, the service application server uses the HMAC algorithm to perform irreversible encryption processing on each weak password in combination with the updated server salt value to generate weak password ciphertext, constructs a filter model based on the generated weak password ciphertext, and retains the last two historical versions of the filter model.

[0069] The filter model in the embodiment of the application can be a Bloom filter.

[0070] S304, the user terminal sends a salt value reading instruction to the service application server.

[0071] More specifically, the user terminal (for example, a mobile banking APP) generates a salt value reading instruction at startup or every second preset period (for example, 12 hours), and the instruction contains the terminal salt value currently stored by the terminal and the terminal identifier. The instruction is sent to the service application server through an HTTPS encrypted channel.

[0072] S305, the service application server determines whether the terminal salt value is consistent with the new server salt value based on the salt value reading instruction.

[0073] More specifically, the service application server parses the salt value reading instruction and compares the terminal salt value with the latest server salt value stored by itself.

[0074] S306, when the terminal salt value is inconsistent with the new server salt value, the service application server sends the new server salt value to the user terminal.

[0075] More specifically, when inconsistency is determined, the business application server sends the latest server salt value to the user terminal through an encrypted response message containing the salt value validity period (e.g., 48 hours) and version number to ensure that the user terminal receives a valid salt value.

[0076] S307, the user terminal updates the current terminal salt value according to the new server salt value.

[0077] More specifically, the user terminal updates the locally stored old terminal salt value based on the received server salt value, and records the reception time and version number of the new terminal salt value obtained after the update.

[0078] S308, the user terminal encrypts the user password input by the user based on the updated terminal salt value to obtain password ciphertext.

[0079] More specifically, after the user inputs the password into the user terminal, the updated terminal salt value and the user password are used as inputs to generate irreversible password ciphertext using the consistent HMAC algorithm of the business application server, so that the encryption process is completed locally on the terminal without storing or transmitting the password plaintext.

[0080] S309, the user terminal sends the password ciphertext and the terminal salt value to the business application server.

[0081] More specifically, the user terminal encapsulates the password ciphertext, the terminal salt value, and the current terminal timestamp into a request and sends it to the business application server through an encrypted channel, and the request does not contain information related to the password plaintext.

[0082] S310, the business application server calls the filter model corresponding to the terminal salt value to verify the password ciphertext.

[0083] More specifically, the business application server matches the corresponding filter model version according to the terminal salt value, and inputs the password ciphertext into the filter model for detection.

[0084] S311, when the business application server verifies that the password is weak, it sends a modification prompt to the user terminal.

[0085] More specifically, when the business application server verifies that the password is weak, it generates a modification prompt containing a weak password prompt (e.g., "The password is too simple, please include letters and numbers") and security recommendations, and sends it to the user terminal through an encrypted channel.

[0086] S312, the user terminal instructs the user to re-enter the password based on the modification prompt.

[0087] More specifically, the user terminal parses the modification prompt information and displays the prompt information on the interface after parsing to guide the user to re-enter the password and show the password complexity (e.g., low, medium, and high) in real time until the user inputs a non-weak password and passes the verification.

[0088] The weak password checking method provided by the embodiments of the present application periodically updates the salt value by the service application server and constructs a corresponding filter model, the user terminal encrypts the user password after synchronizing the salt value to obtain password ciphertext, and then the service application server verifies the password ciphertext by calling the corresponding Bloom filter, realizes whole-process non-plain-text processing to protect the password security, the filter model can efficiently process a large amount of data, reduces the weak password rule storage space, improves the weak password identification efficiency, and supports flexible updating of the rules.

[0089] Figure 4 The structure diagram of the weak password checking device provided by the present application is applied to a service application server, as shown in the figure, the weak password checking device 40 provided by the embodiments includes: Figure 4

[0090] The acquisition module 401 is configured to acquire the terminal salt value and the password ciphertext uploaded by the user terminal, the password ciphertext is obtained by encrypting the user password based on the terminal salt value by the user terminal, and the terminal salt value is consistent with the server salt value;

[0091] The first processing module 402 is configured to verify the password ciphertext by the filter model corresponding to the terminal salt value, and send a modification prompt information to the user terminal when the password is a weak password;

[0092] The filter model corresponding to the terminal salt value is constructed according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using the server salt value.

[0093] Optionally, the first processing module 402 is further configured to perform salt value updating every first preset period after constructing the filter model to obtain an updated server salt value.

[0094] The weak password in the weak password library is encrypted based on the updated server salt value to reconstruct the filter model, and a preset number of old version filter models are retained, the old version filter model is constructed by encrypting the weak password in the weak password library by using the historical salt value before the updated server salt value.

[0095] Optionally, the first processing module 402 is further configured to control the terminal salt value to be consistent with the server salt value of the service application server, including:

[0096] ​receiving a salt value reading instruction sent by the user terminal every second preset period;

[0097] comparing the terminal salt value of the user terminal with the server salt value generated by the service application server based on the salt value reading instruction, and determining that the terminal salt value of the user terminal does not need to be updated if the comparison is consistent;

[0098] Otherwise, sending the server salt value generated by the service application server to the user terminal, so that the user terminal updates the terminal salt value according to the server salt value.

[0099] Optionally, the first processing module 402 is further configured to determine a filtering model corresponding to the terminal salt value, and determine whether there is at least one weak password ciphertext consistent with the password ciphertext through the filtering model.

[0100] If there is, it is determined that the user password corresponding to the password ciphertext is any one of the weak password library.

[0101] Otherwise, it is determined that the user password is not any one of the weak password library.

[0102] Optionally, the first processing module 402 is further configured to, when the weak password library is updated, encrypt the newly added weak password through the server salt value of the service application server to obtain a newly added weak password ciphertext, and supplement the newly added weak password ciphertext to the filtering model corresponding to the server salt value.

[0103] The weak password checking device provided in the embodiment can execute the method provided in the method embodiment, and has similar implementation principles and technical effects. Therefore, the weak password checking device will not be described here.

[0104] Figure 5 The weak password checking device provided in the embodiment is a structure diagram of the weak password checking device provided in the application, and is applied to a user terminal. Figure 5 As shown in the figure, the weak password checking device 50 provided in the embodiment includes:

[0105] The receiving module 501 is configured to receive a user password input by a user, encrypt the user password based on a terminal salt value to obtain a password ciphertext, and the terminal salt value is consistent with a server salt value of a service application server.

[0106] The second processing module 502 is configured to send the password ciphertext and the terminal salt value to the service application server, so that the service application server verifies the password ciphertext through a filtering model corresponding to the terminal salt value, and sends a modification prompt information to the user terminal when the password ciphertext is verified as a weak password.

[0107] The filtering model corresponding to the terminal salt value is constructed by the service application server according to at least one weak password ciphertext corresponding to the weak password library, and the at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password library by using the server salt value by the service application server.

[0108] Optionally, the second processing module 502 is further configured to control the terminal salt value to be consistent with a server salt value of the service application server, including:

[0109] The salt value reading instruction is sent to the service application server every second preset period, so that the service application server compares the terminal salt value of the user terminal with the server salt value generated by the service application server based on the salt value reading instruction, and if the comparison is consistent, it is determined that the terminal salt value of the user terminal does not need to be updated, otherwise, the server salt value generated by the service application server is sent to the user terminal, so that the user terminal updates the terminal salt value according to the server salt value.

[0110] The weak password checking device provided in this embodiment can execute the method provided in the method embodiment, and has similar implementation principles and technical effects, which will not be described here.

[0111] Figure 6 The structure of the electronic device provided in this application is shown in the figure. Figure 6 As shown in the figure, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected through a bus 604.

[0112] In the specific implementation process, the at least one processor 601 executes the computer execution instructions stored in the memory 602, so that the at least one processor 601 executes the above-mentioned method.

[0113] The specific implementation process of the processor 601 can refer to the above-mentioned method embodiment, which has similar implementation principles and technical effects, and will not be described here.

[0114] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0115] The memory can include a random access memory (RAM), and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0116] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0117] The present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the above method.

[0118] The present application also provides a computer readable storage medium, which stores computer execution instructions, and when a processor executes the computer execution instructions, the above method is implemented.

[0119] The above readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0120] An example readable storage medium is coupled to the processor such that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can be a part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0121] It should be noted that, for the above-mentioned method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0122] Further, it should be noted that although the steps in the flowchart are shown in order according to the arrows, these steps are not necessarily executed in order according to the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be alternately executed with other steps or sub-steps or stages of other steps.

[0123] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be realized by other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical functional division, and another division mode can be used in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0124] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application can be integrated in one unit / module, or each unit / module can exist physically, or two or more units / modules can be integrated together. The integrated unit / module can be realized in the form of hardware or in the form of a software program module.

[0125] If the integrated units / modules are implemented in the form of hardware, the hardware can be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. Unless otherwise specified, the storage unit can be any appropriate magnetic storage medium or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc.

[0126] If the integrated units / modules are implemented in the form of software program modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the essential part or all or part of the technical solutions that make contributions to the prior art can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The aforementioned storage medium includes a U disk, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0127] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0128] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0129] It is to be understood that the application is not limited to the precise construction herein disclosed and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is limited only by the claims that follow.

Claims

1. A method for checking weak passwords, characterized in that, Applied to business application servers, including: The terminal salt value and password ciphertext uploaded by the user terminal are obtained. The password ciphertext is obtained by the user terminal encrypting the user password based on the terminal salt value. The terminal salt value is consistent with the server salt value. The password ciphertext is verified by the filtering model corresponding to the terminal salt value, and a modification prompt message is sent to the user terminal when the password is verified as weak. The filtering model corresponding to the terminal salt value is constructed based on at least one weak password ciphertext corresponding to the weak password database. The at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password database using the server salt value.

2. The method according to claim 1, characterized in that, Also includes: After constructing the filtering model, the salt value is updated once every first preset period to obtain the updated server salt value. The weak passwords in the weak password database are encrypted based on the updated server salt value to rebuild the filtering model, while retaining and storing a preset number of old version filtering models. The old version filtering models are constructed by encrypting the weak passwords in the weak password database using historical salt values ​​prior to the updated server salt value.

3. The method according to claim 2, characterized in that, Controlling the terminal salt value to be consistent with the server salt value of the business application server includes: Receive salt value read instructions sent by the user terminal every second preset period; Based on the salt value reading instruction, the terminal salt value of the user terminal is compared with the server salt value generated by the business application server. If the comparison is consistent, it is determined that the terminal salt value of the user terminal does not need to be updated. Otherwise, the server salt value generated by the business application server is sent to the user terminal so that the user terminal can update its terminal salt value based on the server salt value.

4. The method according to claim 1, characterized in that, The password ciphertext is verified using a filtering model corresponding to the terminal salt value, specifically including: Determine the filtering model corresponding to the terminal salt value, and use the filtering model to determine whether there is at least one weak password ciphertext that is consistent with the password ciphertext. If it exists, then the user password corresponding to the password ciphertext is determined to be any weak password in the weak password database. Otherwise, it is determined that the user password is not any weak password in the weak password database.

5. The method according to claim 1, characterized in that, Also includes: When the weak password database is updated, the newly added weak password is encrypted using the server salt value of the business application server to obtain the ciphertext of the newly added weak password, and the ciphertext of the newly added weak password is added to the filtering model corresponding to the server salt value.

6. A method for checking weak passwords, characterized in that, Applied to user terminals, including: The system receives a user password input by the user and encrypts the user password based on the terminal salt value to obtain the password ciphertext. The terminal salt value is consistent with the server salt value of the business application server. The encrypted password and the terminal salt value are sent to the business application server, so that the business application server can verify the encrypted password through the filtering model corresponding to the terminal salt value, and send a modification prompt message to the user terminal when the verification is a weak password. The filtering model corresponding to the terminal salt value is constructed by the business application server based on at least one weak password ciphertext corresponding to the weak password database. The at least one weak password ciphertext is obtained by the business application server encrypting at least one weak password in the weak password database using the server salt value.

7. The method according to claim 6, characterized in that, Controlling the terminal salt value to be consistent with the server salt value of the business application server includes: Every second preset period, a salt value read instruction is sent to the business application server, so that the business application server compares the terminal salt value of the user terminal with the server salt value generated by the business application server based on the salt value read instruction. If the comparison is consistent, it is determined that the terminal salt value of the user terminal does not need to be updated; otherwise, the server salt value generated by the business application server is sent to the user terminal, so that the user terminal updates the terminal salt value according to the server salt value.

8. A weak password detection device, characterized in that, Applied to business application servers, including: The acquisition module is used to acquire the terminal salt value and password ciphertext uploaded by the user terminal. The password ciphertext is obtained by the user terminal encrypting the user password based on the terminal salt value. The terminal salt value is consistent with the server salt value. The first processing module is used to verify the password ciphertext through the filtering model corresponding to the terminal salt value, and send a modification prompt message to the user terminal when the password is verified as weak. The filtering model corresponding to the terminal salt value is constructed based on at least one weak password ciphertext corresponding to the weak password database. The at least one weak password ciphertext is obtained by encrypting at least one weak password in the weak password database using the server salt value.

9. A weak password detection device, characterized in that, Applied to user terminals, including: The receiving module is used to receive the user password input by the user, encrypt the user password based on the terminal salt value to obtain the password ciphertext, wherein the terminal salt value is consistent with the server salt value of the business application server. The second processing module is used to send the password ciphertext and the terminal salt value to the business application server, so that the business application server can verify the password ciphertext through the filtering model corresponding to the terminal salt value, and send a modification prompt message to the user terminal when the verification is a weak password. The filtering model corresponding to the terminal salt value is constructed by the business application server based on at least one weak password ciphertext corresponding to the weak password database. The at least one weak password ciphertext is obtained by the business application server encrypting at least one weak password in the weak password database using the server salt value.

10. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5, or 6 to 7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 5, or 6 to 7.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 5, or 6 to 7.

Images