A password verification method and system based on user login

Abstract

The application belongs to the technical field of security verification, and particularly relates to a password verification method and system based on user login. The method comprises the following steps: an encryption factor is generated by combining a device identification code with a system key, when a user logs in, the login password is encrypted by using the encryption factor, so as to bind the encryption factor with the device identification code, so that the validity of the password depends on the password itself and the user device end at the same time; and the encryption type is determined by acquiring user device end information and input environment information to select a corresponding encryption mode; the time behavior mode of the user is introduced into the authentication link to construct a dynamic security defense line based on user habits. The application binds the encryption factor with the device identification code, so that the validity of the password depends on the password itself and the user device end at the same time, prevents collision library attacks, and improves the security of the account; a single fixed encryption mode is avoided, the complexity of password cracking is increased, and the anti-attack ability of password verification is enhanced.

Description

Technical Field

[0001] This invention belongs to the field of security verification technology, specifically relating to a password verification method and system based on user login. Background Technology

[0002] With the development of network technology, online services and digital asset management all require user authentication. User authentication is an important line of defense for protecting digital assets and personal privacy. Among the current authentication technologies, the credential verification mechanism based on username and password is still the most widely used network security measure because it is easy to manage, universal and scalable, and its deployment is simple and users have mature habits.

[0003] Current password authentication technologies largely rely on server-side storage and comparison of user credentials. Server-side credential databases are high-value, centralized targets for attacks. Leaks in these databases can easily lead to mass leaks of user account information, causing serious operational security incidents and damaging platform reputation and user trust. While credential databases are currently encrypted using hashing or salting, these encryption methods can still be cracked through rainbow tables, dictionary attacks, or brute-force attacks, easily leading to password leaks. Furthermore, the widespread habit of reusing passwords among users can trigger credential stuffing attacks against other platforms, potentially causing a chain reaction of security risks. Summary of the Invention

[0004] The purpose of this invention is to provide a password verification method and system based on user login, which can determine the validity of the password entered by the user without directly verifying the user's input password and the database password, thereby reducing the risk of account password leakage.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A password verification method based on user login includes the following steps: Pre-store associated information linked to user accounts; Receive a login request containing the user's account and password; When a login request containing a user account and login password is received, the following steps are performed: Based on the user account, query the pre-stored association information associated with the user account; encrypt the login password using the queried encryption factor to generate encrypted password data to be verified; and generate an authentication command based on the comparison result between the encrypted password data to be verified and the encrypted password data. The pre-stored association information associated with the user account includes: receiving the user account and the corresponding registration password; encrypting the registration password to generate association information; and storing the user account, encryption factor, and encrypted password data as association information. The association information includes encrypted password data and encryption factor; the encryption factor includes the system key and device identifier code.

[0006] Preferably, the step of encrypting the registration password to generate associated information includes: When the registration password is received, a device identification code is generated on the user's device; the device identification code and the system key are used together to generate an encryption factor.

[0007] Preferably, the step of encrypting the registration password to generate associated information further includes: Based on the user device information and input environment information, determine the encryption type; based on the encryption type, select the encryption method, which includes mapping encryption method and function encryption method; and perform encryption processing using the selected encryption method.

[0008] Preferably, determining the encryption type based on user equipment information and input environment information includes: The system type and browser type of the user's device are obtained as user device information and input environment information; the obtained system type and browser type are matched with preset encryption conditions; when the match is successful, the type that matches the preset encryption conditions is determined as the encryption type; when the match is unsuccessful, the preset default type is determined as the encryption type.

[0009] Preferably, generating the authentication command based on the comparison result between the encrypted password data to be verified and the encrypted password data includes: By analyzing multiple historical login times associated with user accounts, a stable time period is determined as a verification item; based on the judgment result of whether the current login time falls within the verification item, an authentication command is generated.

[0010] Preferably, the step of determining the stable time period as a verification item by analyzing multiple historical login time points associated with the user account includes: Multiple historical login time points are sorted out to remove preset extreme values ​​to obtain the remaining time points; the time intervals between adjacent time points in the remaining time points are calculated to obtain a set of time interval values; each time interval value in the set of time interval values ​​is compared with a preset time fluctuation standard value to determine the time intervals with time interval values ​​less than the time fluctuation standard value as stable time intervals, and all time intervals determined as stable time intervals are collectively determined as verification items.

[0011] Preferably, the generation of authentication instructions, based on the determination result of whether the current login time falls within the verification items, includes: If the current login time falls within the verification period, the encrypted password data to be verified will be compared with the encrypted password data. If the current login time does not fall within the verification period, the comparison will be delayed until the time reaches the preset time point within the verification period.

[0012] A password verification system based on user login includes the following modules: The login request processing module is used to receive login requests containing user accounts and login passwords; The login time analysis module is used to determine a stable time period as a verification item by analyzing multiple historical login time points associated with user accounts. The password verification module is used to respond to login requests and perform the following actions: query the pre-stored association information associated with the user account based on the user account; encrypt the login password using the queried encryption factor to generate encrypted password data to be verified. The authentication command generation module is used to generate authentication commands based on the comparison results between the encrypted password data to be verified and the encrypted password data.

[0013] Preferably, generating the authentication command based on the comparison result between the encrypted password data to be verified and the encrypted password data includes: By analyzing multiple historical login times associated with user accounts, a stable time period is determined as a verification item; based on the judgment result of whether the current login time falls within the verification item, an authentication command is generated.

[0014] Preferably, the step of determining the stable time period as a verification item by analyzing multiple historical login time points associated with the user account includes: Multiple historical login time points are sorted out to remove preset extreme values ​​to obtain the remaining time points; the time intervals between adjacent time points in the remaining time points are calculated to obtain a set of time interval values; each time interval value in the set of time interval values ​​is compared with a preset time fluctuation standard value to determine the time intervals with time interval values ​​less than the time fluctuation standard value as stable time intervals, and all time intervals determined as stable time intervals are collectively determined as verification items.

[0015] Beneficial effects

[0016] This invention obtains the device identification code generated by the user's device during user registration and combines it with the system key to generate an encryption factor. When the user logs in, the encryption factor is used to encrypt the login password, thus binding the encryption factor with the device identification code. This makes the validity of the password depend on both the password itself and the user's device. Even if the database storing the encrypted password data is leaked, it will be impossible to generate the correct encrypted password data to be verified for authentication without obtaining the user's specific device information, thereby preventing credential stuffing attacks and improving account security.

[0017] Before encrypting the registration password, this invention obtains user device information and input environment information to determine the encryption type and select the corresponding encryption method. It adopts a strategy of dynamically selecting the encryption method based on the user environment, so that the encryption method may differ for different users or for the same user in different environments. This avoids using a single fixed encryption method, which increases the complexity of password cracking and enhances the overall anti-attack capability of password verification.

[0018] Before comparison, this invention analyzes the user's historical login times to determine stable time periods as verification items, and uses whether the current login time falls within these verification items as a prerequisite for password verification. By introducing the user's time behavior pattern into the authentication process, a dynamic security defense based on user habits is constructed, thereby effectively identifying abnormal logins that do not conform to the user's normal usage habits. Furthermore, by delaying the authentication process, potential account theft risks are prevented, thus improving the security of the authentication process. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a system module diagram of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments. It should be understood that the specific embodiments described herein are merely for explaining the invention and are not intended to limit the scope of protection of the invention.

[0021] Example 1 Please refer to Figure 1 This embodiment provides a password verification method based on user login, which includes the following steps: S1. Receive the user account and the corresponding registration password submitted by the user through an encrypted channel; the user account can be a username, email address or mobile phone number. Before encrypting the registration password, obtain the current user device type and input environment information to determine the encryption type that should be followed; collect the user device type and version number (Windows 11, iOS 16, etc.) and browser type and version number (Chrome 108, Safari 16, etc.), and match the collected type and version number and browser type and version number combination information with the preset encryption condition list; The preset encryption condition list stores multiple combinations of types and browser types that are considered highly trustworthy. Specifically, the preset encryption condition can be set to a combination of iOS 15 and above and Safari 15 and above. If the currently collected combined information successfully matches any condition in the list, the high-security type will be determined as the encryption type for this operation; if the match fails, the standard type will be determined as the encryption type for this operation.

[0022] S2. Based on the determined encryption type, select one from the mapping encryption method and the function encryption method, thereby adaptively adjusting the password protection strength according to the trustworthiness of the user environment; Among them, the function encryption method is an encryption method that generates a fixed-length and irreversible digest. Its characteristic is that the calculation result cannot be reversed to derive the original password. The function encryption method can specifically execute the SHA-256 hash processing procedure. If the determined encryption type is a high-security type, then the function encryption method is selected. The mapping encryption method is an encryption method based on preset character replacement rules. Specifically, the mapping encryption method can perform character-by-character conversion according to the predefined character replacement table. If the determined encryption type is the default type, then the mapping encryption method is selected.

[0023] S3. Encrypt the registration password to generate an encryption factor specifically for the user account; The encryption factor generation process includes: inputting a key uniformly managed by the server, and inputting a device identification code obtained from the user's device when receiving the registration password. The device identification code can be generated by reading the device's universally unique identifier (UUID); inputting the device identification code as a salt or additional data along with the key into a preset key generation procedure to generate the encryption factor. The preset key generation procedure includes: alternatingly concatenating the key managed by the server with the device identifier code, then performing a circular left shift operation on the ASCII code sequence of the concatenated string, with the shift number equal to the length of the device identifier code, and converting the processed ASCII code sequence into a hexadecimal string as the encryption factor; This ensures that even if a user uses the same registration password on different user devices, the resulting encrypted password data will be different, thus enhancing the defense against pre-computed password table attacks such as rainbow tables.

[0024] S4. Using the selected encryption method and the generated encryption factor, the registration password is encrypted to generate the final encrypted password data; the user account, the generated encryption factor, and the encrypted password data are stored in the database as associated information to complete the registration process.

[0025] S5. When a user requests to log in, obtain the user's username and password; based on the user's username, retrieve the corresponding associated information from the database, which includes the encrypted password data and encryption factor stored during registration; using the encryption factor retrieved from the database, and employing the same encryption method and processing procedure as during registration, encrypt the login password entered by the user, and generate encrypted password data to be verified.

[0026] S6. Perform time-based verification based on user login behavior; obtain the user's historical login information, which includes a series of historical login time points; analyze the historical login time points to determine one or more stable time periods as verification items; The analysis of historical login time points includes: organizing multiple historical login time points, removing preset extreme values ​​to obtain a series of remaining time points; sorting the remaining time points in chronological order, and determining all adjacent time point pairs in the sorted sequence; calculating the time interval between each adjacent time point pair to obtain a set of time interval values. Each time interval value in the set of time interval values ​​is compared with the time fluctuation standard value. If a time interval value is less than the time fluctuation standard value, the time period represented by that time interval value is determined to be a stable time period; if any time interval value is not less than the time fluctuation standard value, it is determined to be an unstable time period. All time periods identified as stable time periods are merged and summarized to form one or more regular time ranges, which together constitute the verification item. Specifically, if the analysis shows that multiple stable time periods are concentrated between 9:00 AM and 6:00 PM from Monday to Friday, then this time range can be identified as the verification item. The preset extreme value can be the first login time of the account, or the login time when the time interval between the first login and the previous login exceeds the preset duration; the preset duration can be 30 days; and the standard value for time fluctuation is set to 48 hours.

[0027] S7. Compare the encrypted password data to be verified with the encrypted password data stored in the database to perform password verification; Password verification includes: obtaining the current login time and determining whether the current login time falls within the time range of the verification item; if the current login time is within the verification item, a comparison is immediately performed, and the encrypted password data to be verified is precisely compared with the encrypted password data stored in the database. If the two match completely, an authentication pass instruction is generated; if they do not match, an authentication failure instruction is generated. If the current login time is not within the verification items, the comparison will be delayed until the time reaches the next preset time point within the verification items. The delayed execution mechanism effectively curbs malicious behaviors such as brute-force attacks by significantly increasing the time cost of automated attack attempts. The next preset time point can be 9:00 AM on the next working day.

[0028] Example 2 Please refer to Figure 2 This embodiment provides a password verification system based on user login. By binding encryption factors to user accounts and user devices, and combining this with time-based behavioral pattern analysis, the security of the password verification process is improved. In its specific implementation, this system can be deployed on one or more servers and communicate with user devices via a network. The system includes the following modules: The login request processing module is used to receive login requests from user devices. The login request contains the user account and the corresponding login password. After receiving the login request, the module parses the user account and login password, as well as the recorded current login time, and passes the user account and login password to the password verification module. At the same time, the module passes the user account and current login time to the login time analysis module.

[0029] The login time analysis module is used to build a reliable time model based on the user's historical login information. It is used to help determine whether the current login behavior conforms to its existing and stable time pattern. By analyzing multiple historical login time points associated with a specific user account, it determines one or more stable time periods as verification items. Once a user account is received, the database is queried to retrieve all historical login times associated with that user account. To improve the accuracy of the analysis, the historical login times are sorted out, and preset extreme values ​​such as first login and late-night login are removed, thus obtaining a series of remaining times. Calculate the time intervals between adjacent time points in the remaining time points in chronological order to form a set of time interval values; compare each time interval value in the set of time interval values ​​with a preset time fluctuation standard value; if a time interval value is less than the standard value, the time period represented by the time interval value is determined to be a stable time period; merge and summarize all the time periods determined to be stable time periods to form one or more regular time ranges, which together constitute the verification items.

[0030] The password verification module is used to generate and store associated information during user registration, and to perform comparison during user login; during the registration process, it performs pre-storage of associated information and receives user account and registration password; Before encrypting the registration password, the encryption type is determined based on device information such as the user's operating system type and input environment information such as the browser type, so as to implement a differentiated encryption strategy and increase the difficulty of cracking. Specifically, encryption conditions can be preset, such as selecting a high-security type when the system type is iOS and the browser type is Safari. If the current environment matches the preset encryption conditions, select the high-security type; if it does not match any preset encryption conditions, select the preset standard type; based on the determined encryption type, select a specific encryption method from the mapping encryption method or the function encryption method. A unique device identifier is generated on the user device and combined with the key stored on the server to generate an encryption factor. The selected encryption method and the generated encryption factor are used to encrypt the registration password, generate encrypted password data, and store the user account, encryption factor, and encrypted password data as associated information in the database. In the user login scenario, the system receives the user account and login password from the login request processing module, and receives a stable time period as a verification item from the login time analysis module, and compares the current login time with the verification item. If the current login time is not within the verification items, the comparison will be delayed until the time reaches the preset time point, such as the start time of the next stable time period within the verification items; if the current login time is within the verification items, the comparison will be performed immediately. The comparison process includes: querying the database for associated information pre-stored with the user account in the login request, and extracting the encrypted password data and encryption factor; using the retrieved encryption factor, encrypting the login password entered by the user in this instance using the same encryption method and processing as during registration, to generate encrypted password data to be verified; accurately comparing the generated encrypted password data to be verified with the encrypted password data stored in the database, and passing the matching or non-matching comparison results to the authentication instruction generation module.

[0031] The authentication command generation module is used to generate the final authentication command based on the comparison result; it receives the comparison result from the password verification module. If the comparison result is a match, it generates an authentication pass command, which can be used to trigger subsequent operations such as creating a session and granting access permissions; if the comparison result is a mismatch, it generates an authentication failure command, which can be used to return an error message to the user.

[0032] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention. These improvements and modifications should also be considered within the scope of protection of the present invention, which is defined by the appended claims and their equivalents.

Claims

1. A password verification method based on user login, characterized in that, Includes the following steps: Pre-store associated information linked to user accounts; Receive a login request containing the user's account and password; When a login request containing a user account and login password is received, the following steps are performed: Based on the user account, query the pre-stored association information associated with the user account; use the queried encryption factor to encrypt the login password to generate encrypted password data to be verified. Based on the comparison results between the encrypted password data to be verified and the encrypted password data, an authentication command is generated. The pre-stored association information associated with the user account includes: receiving the user account and the corresponding registration password; encrypting the registration password to generate association information; and storing the user account, encryption factor, and encrypted password data as association information. The association information includes encrypted password data and encryption factor; the encryption factor includes the system key and device identifier code.

2. The password verification method based on user login according to claim 1, characterized in that, The encryption of the registration password to generate associated information includes: When the registration password is received, a device identification code is generated on the user's device; the device identification code and the system key are used together to generate an encryption factor.

3. The password verification method based on user login according to claim 2, characterized in that, The encryption of the registration password to generate associated information also includes: Based on the user device information and input environment information, determine the encryption type; based on the encryption type, select the encryption method, which includes mapping encryption method and function encryption method; and perform encryption processing using the selected encryption method.

4. The password verification method based on user login according to claim 3, characterized in that, The step of determining the encryption type based on user device information and input environment information includes: The system type and browser type of the user's device are obtained as user device information and input environment information; the obtained system type and browser type are matched with preset encryption conditions; when the match is successful, the type that matches the preset encryption conditions is determined as the encryption type; when the match is unsuccessful, the preset default type is determined as the encryption type.

5. The password verification method based on user login according to claim 1, characterized in that, The generation of authentication instructions based on the comparison result between the encrypted password data to be verified and the encrypted password data includes: By analyzing multiple historical login times associated with user accounts, a stable time period is determined as a verification item; based on the judgment result of whether the current login time falls within the verification item, an authentication command is generated.

6. The password verification method based on user login according to claim 5, characterized in that, The stable time period determined as a verification item by analyzing multiple historical login times associated with user accounts includes: Multiple historical login time points are sorted out to remove preset extreme values ​​to obtain the remaining time points; the time intervals between adjacent time points in the remaining time points are calculated to obtain a set of time interval values; each time interval value in the set of time interval values ​​is compared with a preset time fluctuation standard value to determine the time intervals with time interval values ​​less than the time fluctuation standard value as stable time intervals, and all time intervals determined as stable time intervals are collectively determined as verification items.

7. The password verification method based on user login according to claim 5, characterized in that, The authentication command generated, based on the determination result of whether the current login time falls within the verification items, includes: If the current login time falls within the verification period, the encrypted password data to be verified will be compared with the encrypted password data. If the current login time does not fall within the verification period, the comparison will be delayed until the time reaches the preset time point within the verification period.

8. A password verification system based on user login, characterized in that, Includes the following modules: The login request processing module is used to receive login requests containing user accounts and login passwords; The login time analysis module is used to determine a stable time period as a verification item by analyzing multiple historical login time points associated with user accounts. The password verification module is used to respond to login requests and perform the following: query the pre-stored association information associated with the user account based on the user account; The login password is encrypted using the queried encryption factor to generate encrypted password data to be verified. The authentication command generation module is used to generate authentication commands based on the comparison results between the encrypted password data to be verified and the encrypted password data.

9. A password verification system based on user login according to claim 8, characterized in that, The generation of authentication instructions based on the comparison result between the encrypted password data to be verified and the encrypted password data includes: By analyzing multiple historical login times associated with user accounts, a stable time period is determined as a verification item; based on the judgment result of whether the current login time falls within the verification item, an authentication command is generated.

10. A password verification system based on user login according to claim 9, characterized in that, The stable time period determined as a verification item by analyzing multiple historical login times associated with user accounts includes: Multiple historical login time points are sorted out to remove preset extreme values ​​to obtain the remaining time points; the time intervals between adjacent time points in the remaining time points are calculated to obtain a set of time interval values; each time interval value in the set of time interval values ​​is compared with a preset time fluctuation standard value to determine the time intervals with time interval values ​​less than the time fluctuation standard value as stable time intervals, and all time intervals determined as stable time intervals are collectively determined as verification items.

Images