A username and password protection method and system based on a private algorithm

Abstract

This invention discloses a username and password protection method and system based on a proprietary algorithm, belonging to the field of information security. The method includes: a client-side encryption stage, where a dynamic key is generated from the plaintext username and password through a proprietary computation process; the username and password are then encrypted using a symmetric encryption algorithm, and the ciphertext is sent to the server; the server decrypts the plaintext username and password using the proprietary algorithm to obtain the plaintext username and password; a server-side storage stage, where the decrypted plaintext username and password are subjected to secondary symmetric encryption using a random salt to obtain stored ciphertext and the encryption salt, which are then stored together; and a verification stage, where the plaintext is independently restored from both the client-side ciphertext and the stored data, and a double-restored comparison is performed to complete identity verification. This invention forms a two-layer isolation architecture through a client-side proprietary encryption algorithm and server-side secondary encryption, ensuring that the transmitted ciphertext and the stored ciphertext are independent of each other, effectively preventing the username and password from being illegally stolen, cracked, or misused during transmission and storage.

Description

Technical Field

[0001] This invention relates to the field of information security, and in particular to a username and password protection method and system based on a proprietary algorithm. Background Technology

[0002] With the rapid development of internet technology, logging in, transacting, socializing, and working through online platforms has become an important part of daily life. In most online service systems, user authentication generally relies on a "username + password" combination authentication mechanism. Due to its simplicity, ease of use, and strong compatibility, this mechanism remains one of the most mainstream user authentication methods.

[0003] However, since usernames and passwords are usually directly linked to sensitive information such as users' privacy data, financial assets, and personal identity, their security is particularly important. Once usernames and passwords are illegally obtained, guessed, stolen, or leaked, it can not only lead to the theft of user accounts, but also trigger a chain of information security incidents, such as property loss, privacy breaches, identity theft, and even affect other related online services (such as those accessed through "remember password" or "single sign-on" mechanisms).

[0004] Traditional username and password protection methods mainly include: forcing users to set complex passwords (such as those containing uppercase and lowercase letters, numbers, special characters, etc.); changing passwords regularly; using encrypted password storage (such as hashing and salting); providing multi-factor authentication as a supplement; and enhancing protection through methods such as CAPTCHA, device binding, and abnormal login detection.

[0005] While the above methods improve account security to some extent, they still have many shortcomings and security risks in practical applications: 1. The contradiction between setting user passwords and the difficulty of remembering them.

[0006] In existing technologies, to improve password security, systems often require users to set complex password rules (such as requiring the inclusion of uppercase letters, lowercase letters, numbers, and special symbols, and a length of at least 8 characters). However, such complex passwords are not only difficult to remember, but also easily lead users to reuse the same password or use similar passwords across multiple platforms, thereby increasing the possibility that if a password on one platform is compromised, accounts on other platforms will also be at risk.

[0007] In addition, users often use passwords associated with personal information (such as birthday, phone number, name abbreviation, etc.) for ease of remembering. These passwords are very easy for attackers to guess through social engineering or crack through data breach databases.

[0008] 2. Vulnerability of cryptography during transmission and storage.

[0009] In many systems, usernames and passwords entered by users are highly vulnerable to man-in-the-middle attacks when transmitted between the client and server without encrypted communication protocols (such as HTTPS). Even with HTTPS, passwords can still be stolen during the input stage if the client contains malware (such as keyloggers or phishing plugins).

[0010] On the server side, although mainstream systems currently use hashing and salting to store user passwords to prevent the direct risk of leakage from plaintext storage, once the database is compromised (such as by SQL injection, internal leaks, ransomware attacks, etc.), attackers may still be able to recover the original password through rainbow tables, brute force, hash collisions, or attacks targeting specific hash algorithms (such as the vulnerabilities of MD5 and SHA1). This is especially true for weak passwords, which pose a higher risk.

[0011] 3. Lack of effective protection and awareness of user input behavior.

[0012] In existing technologies, most systems lack real-time behavior monitoring and anomaly detection capabilities during the process of users entering usernames and passwords. For example, when users enter passwords on public computers, log in in insecure network environments, or are monitored by malicious programs during the input process (such as keylogging, screen capture, memory scanning, etc.), the system often fails to identify and prevent such risky behaviors in a timely manner.

[0013] Furthermore, for common phishing websites, users may be tricked into entering their real usernames and passwords on fake login interfaces. Existing password protection technologies often cannot distinguish whether the credentials entered by the user are on a legitimate platform or a malicious platform, leading to a high-risk situation of "inputting and then leaking".

[0014] 4. Limitations of multi-factor authentication and user experience issues.

[0015] While multi-factor authentication (such as SMS verification codes, dynamic tokens, biometrics, etc.) can improve account security to some extent, it has the following problems: This increases the complexity of user operations and negatively impacts the user experience. Some authentication methods (such as SMS verification codes) can be bypassed by SIM card hijacking, fake base station attacks, and other means. The deployment cost is high, making it unsuitable for all types of application scenarios, especially in resource-constrained devices or scenarios with high requirements for convenience.

[0016] Furthermore, multi-factor authentication is usually used as an "additional security layer" rather than a "basic protection mechanism." When the user does not enable it or the system does not force its activation, the username and password remain the only line of defense, and its inherent security flaws still exist.

[0017] Therefore, there is an urgent need for a username and password protection scheme that can provide strong protection in both transmission and storage stages, without relying on users to remember complex passwords or additional hardware devices. Summary of the Invention

[0018] This invention aims to address the vulnerability of usernames and passwords during transmission and storage, and provides a username and password protection method and system based on a private algorithm. By introducing a private and customized calculation process, it achieves a specific encryption and secure restoration mechanism for usernames and passwords, thereby effectively preventing usernames and passwords from being illegally stolen, cracked, or abused during transmission and storage.

[0019] In a first aspect of the present invention, a username password protection method based on a proprietary algorithm is provided. The method includes: Client-side encryption phase: After the user enters a plaintext username and password, the client generates a dynamic key based on the plaintext username and password through a private and customized calculation process. The client then performs initial symmetric encryption on the plaintext username and password using a symmetric encryption algorithm to obtain the ciphertext username and password. Finally, the client sends the ciphertext username and password to the server via the HTTPS protocol. Server-side secondary encryption and storage stage: After receiving the username ciphertext and password ciphertext, the server obtains the plaintext username and password through a symmetric decryption algorithm, generates a random salt, and performs secondary symmetric encryption on the plaintext username and password based on the random salt using a symmetric encryption algorithm to obtain the username storage ciphertext, password storage ciphertext, and encryption salt, and stores the username storage ciphertext, password storage ciphertext, and encryption salt. Server-side verification phase: Based on the ciphertext of the password and the ciphertext of the username sent by the client, the first plaintext username and the first plaintext password are obtained. At the same time, the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt are read from the storage and restored to obtain the second plaintext username and the second plaintext password. The identity verification is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.

[0020] Optionally, the initial symmetric encryption of the plaintext cipher includes: Calculate the hash digest of the plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment and the plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext password to obtain the ciphertext.

[0021] Optionally, the initial symmetric encryption of the plaintext username includes: Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username.

[0022] Optionally, the second-order symmetric encryption of the plaintext cipher specifically includes: Generate a random salt, and use the random salt as the salt to perform a salted hash calculation on the plaintext username to obtain the fifth key; The sixth key is obtained by XORing the fifth key with the random salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext password, resulting in the ciphertext for password storage.

[0023] Optionally, the quadratic symmetric encryption of the plaintext username specifically includes: The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password using a random salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the random salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username storage.

[0024] Optionally, the second-order symmetric encryption further includes: The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, a symmetric encryption algorithm is used to encrypt the random salt to obtain the encrypted salt.

[0025] Optionally, the restoration of the first plaintext username and password specifically includes: Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, the symmetric decryption algorithm is used to decrypt the ciphertext username to obtain the first plaintext username. Calculate the hash digest of the first plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment with the first plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric decryption algorithm is used to decrypt the ciphertext to obtain the first plaintext ciphertext.

[0026] Optionally, the restoration of the second plaintext username and password specifically includes: The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, the encrypted salt is decrypted using a symmetric decryption algorithm to obtain the plaintext salt. The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password, using the plaintext salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the plaintext salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext of the username storage to obtain the second plaintext username. The fifth key is obtained by performing a salted hash calculation on the second plaintext username using plaintext salt as the salt. The sixth key is obtained by performing an XOR obfuscation calculation between the fifth key and the plaintext salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext to obtain the second plaintext cipher.

[0027] Optional, also includes; During the secondary encryption storage stage on the server side, the username ciphertext and password ciphertext are concatenated and then hashed to obtain the index identifier; The username, password, and encryption salt are stored using an index identifier. During the verification phase, the username storage ciphertext, password storage ciphertext, and encryption salt are obtained through the index identifier, and subsequent operations are performed.

[0028] In a second aspect of the invention, a username password protection system based on a proprietary algorithm is provided. The system includes: The client encryption module is used to generate a dynamic key based on the plaintext username and password after the user inputs them through a private and customized calculation process. The plaintext username and password are then initially encrypted using a symmetric encryption algorithm to obtain the username ciphertext and password ciphertext. The network transmission module is used to send encrypted usernames and passwords to the server via the HTTPS protocol; The server-side restoration module is used to receive the encrypted username and password, and then use a symmetric decryption algorithm to obtain the plaintext username and password. The server-side secondary encryption module is used to generate a random salt. Based on the random salt, the plaintext username and password are subjected to secondary symmetric encryption using a symmetric encryption algorithm to obtain the username storage ciphertext, the password storage ciphertext, and the encryption salt. The storage module is used to associate and store the password ciphertext, username ciphertext, and encryption salt together. The verification module is used to obtain the first plaintext username and first plaintext password by restoring the ciphertext of the password and the ciphertext of the username sent by the client. At the same time, it reads the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt from the storage and restores them to obtain the second plaintext username and second plaintext password. The authentication is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.

[0029] In summary, the present invention has at least one of the following beneficial technical effects: 1. By using client-side private encryption, even if an attacker obtains the encrypted username and password data during transmission, the encryption key is dynamically derived from the username and password information itself and uses a private calculation process, making it impossible for the attacker to effectively restore it using conventional methods (such as rainbow table attacks, brute-force attacks, etc.).

[0030] 2. The server uses a completely different encryption mechanism and random factors for double symmetric encryption, which is completely different from the client. There is no direct correlation between the ciphertext generated by the client and the stored ciphertext. Even if the stored data is stolen, the real username and password data cannot be obtained without the specific private encryption and decryption algorithm.

[0031] 3. A two-layer isolation architecture is formed between "transmitted ciphertext" and "stored ciphertext". The leakage of ciphertext in the transmission process will not lead to the cracking of stored data, and the leakage of stored data will not restore the transmitted ciphertext. The two are independent of each other.

[0032] 4. A dual-reconstruction comparison mechanism is adopted during the verification process. Plaintext is independently reconstructed from the client-side ciphertext and the server-side ciphertext for comparison, ensuring the integrity and security of the verification logic.

[0033] 5. Employing symmetric encryption algorithms and hash operations, it achieves high-strength security protection with relatively low computing power, making it suitable for the actual deployment of large-scale online service systems. Detailed Implementation

[0034] This specific embodiment is merely an explanation of the present invention and is not intended to limit the invention. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of the present invention.

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] The following are explanations of the relevant technical terms involved in this invention: KEY: The key is the core parameter used for encryption and decryption in symmetric encryption. Encryption and decryption must use the same key, and it must not be leaked.

[0037] IV: Initialization Vector, used to generate different ciphertexts from the same plaintext and the same key, thereby improving security.

[0038] Salt: Generally used when generating keys to increase the randomness of the key, so that even if two users have the same password, different keys can be generated.

[0039] The overall concept of this invention is that usernames and passwords, as users' private data, should be protected from unauthorized acquisition. During authentication, usernames and passwords are often exposed to the public network environment during network transmission. Without effective protection, they are very susceptible to leakage during transmission. Username and password data are often high-value targets for hackers, and significant human and material resources are invested in ensuring their security. However, a leak of such data would be a disaster, triggering large-scale security incidents and commercial risks.

[0040] To ensure the security of usernames and passwords during network transmission, they should not be transmitted in plaintext. While HTTPS generally prevents leakage during transmission, it cannot prevent passwords from being cracked after a server-side database breach, nor can it prevent malicious servers or internal personnel from directly obtaining plaintext or weakly protected passwords. It also cannot address potential risks such as malicious eavesdropping or forged input on the client side. Therefore, we introduce a private, customized computation process to implement a specific encryption and secure restoration mechanism for the username and password entered by the user. This involves performing specific calculations and obfuscation on the username and password after they are entered before sending them via HTTPS. This ensures that even if an attacker obtains the encrypted username and password data while maintaining a secure transmission link, they cannot effectively restore or misuse it through conventional methods (such as database breaches, traffic analysis after man-in-the-middle attacks, rainbow table attacks, brute-force attacks, etc.). On the username and password storage side, we should recalculate the stored data so that even if the data is stolen in an extremely malicious manner, the thief will still be unable to obtain the real and valid plaintext username and password data. On the verification side, through a unique restoration algorithm, the encrypted data received from the client and the encrypted data read from the storage side are restored using two different restoration algorithms and then compared, thereby ensuring that even if the stored username and data are leaked, it will not cause catastrophic consequences.

[0041] Example 1: Client encryption stage.

[0042] After the user enters a plaintext username and password, the client generates a dynamic key based on the plaintext username and password through a private and customized calculation process. The client then performs initial symmetric encryption on the plaintext username and password using a symmetric encryption algorithm to obtain the ciphertext username and password. Finally, the client sends the ciphertext username and password to the server via the HTTPS protocol.

[0043] That is, when a user enters a plaintext username and password on the client, the client performs the following encryption steps: Step S11: Initial encryption of the plaintext password.

[0044] Calculate the hash digest of the plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment and the plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext password to obtain the ciphertext.

[0045] Step S12: Initial encryption of plaintext usernames.

[0046] Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username.

[0047] Step S13: Data transmission.

[0048] The encrypted username and password are sent to the server via the HTTPS protocol.

[0049] Example 2: Server-side secondary encryption storage stage.

[0050] After receiving the encrypted username and password, the server obtains the plaintext username and password using a symmetric decryption algorithm, generates a random salt, and performs a second symmetric encryption on the plaintext username and password using a symmetric encryption algorithm based on the random salt to obtain the encrypted username, encrypted password, and encrypted salt. The server then stores these encrypted username, encrypted password, and encrypted salt.

[0051] That is, after the server receives the encrypted password and username sent by the client, it performs the following steps: Step S21: Client-side ciphertext recovery.

[0052] Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, the symmetric decryption algorithm is used to decrypt the ciphertext username to obtain the plaintext username. Calculate the hash digest of the plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment and the plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric decryption algorithm is used to decrypt the plaintext cipher to obtain the plaintext cipher.

[0053] Step S22: Generate a random salt and encrypt the plaintext password a second time.

[0054] Generate a random salt, and use the random salt as the salt to perform a salted hash calculation on the plaintext username to obtain the fifth key; The sixth key is obtained by XORing the fifth key with the random salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric encryption algorithm is used to encrypt the ciphertext, resulting in the ciphertext for password storage.

[0055] Step S23: Encrypt the plaintext username a second time.

[0056] The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password using a random salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the random salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username storage.

[0057] Step S24: Encrypt the random salt.

[0058] The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, a symmetric encryption algorithm is used to encrypt the random salt to obtain the encrypted salt.

[0059] Step S25: Associate storage.

[0060] The username ciphertext and password ciphertext are concatenated and then hashed to obtain the index identifier; The username ciphertext, password ciphertext, and encryption salt are associated and stored using an index identifier.

[0061] Example 3: Verification Phase.

[0062] The first plaintext username and password are obtained by restoring the ciphertext of the password and the ciphertext of the username sent by the client. At the same time, the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt are read from the storage and restored to obtain the second plaintext username and the second plaintext password. The authentication is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.

[0063] That is, when a user logs in again, the client generates encrypted password and username according to the method in Example 1, and sends them to the server. The server performs the following verification steps: Step S31: Restore the client's encrypted text.

[0064] The server uses the same restoration algorithm as step S21 in Embodiment 2 to restore the first plaintext username and the first plaintext password from the password ciphertext and username ciphertext sent by the client.

[0065] Step S32: Retrieve stored data.

[0066] The username storage ciphertext, password storage ciphertext, and encryption salt are obtained through the index identifier.

[0067] Step S33: Restore the stored ciphertext.

[0068] The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, the encrypted salt is decrypted using a symmetric decryption algorithm to obtain the plaintext salt. The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password, using the plaintext salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the plaintext salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext of the username storage to obtain the second plaintext username. The fifth key is obtained by performing a salted hash calculation on the second plaintext username using plaintext salt as the salt. The sixth key is obtained by performing an XOR obfuscation calculation between the fifth key and the plaintext salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext to obtain the second plaintext cipher.

[0069] Step S34: Consistency comparison.

[0070] Verify that the first plaintext username and the second plaintext username match, and that the first plaintext password and the second plaintext password match. If both match, the verification passes, and the user is allowed to log in; otherwise, the verification fails, and the login request is rejected.

[0071] This invention also provides a username and password protection system based on a proprietary algorithm, comprising: The client encryption module is used to generate a dynamic key based on the plaintext username and password after the user inputs them through a private and customized calculation process. The plaintext username and password are then initially encrypted using a symmetric encryption algorithm to obtain the username ciphertext and password ciphertext. The network transmission module is used to send encrypted usernames and passwords to the server via the HTTPS protocol; The server-side restoration module is used to receive the encrypted username and password, and then use a symmetric decryption algorithm to obtain the plaintext username and password. The server-side secondary encryption module is used to generate a random salt. Based on the random salt, the plaintext username and password are subjected to secondary symmetric encryption using a symmetric encryption algorithm to obtain the username storage ciphertext, the password storage ciphertext, and the encryption salt. The storage module is used to associate and store the password ciphertext, username ciphertext, and encryption salt together. The verification module is used to obtain the first plaintext username and first plaintext password by restoring the ciphertext of the password and the ciphertext of the username sent by the client. At the same time, it reads the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt from the storage and restores them to obtain the second plaintext username and second plaintext password. The authentication is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.

[0072] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A username and password protection method based on a private algorithm, characterized in that, include: Client-side encryption phase: After the user enters a plaintext username and password, the client generates a dynamic key based on the plaintext username and password through a private and customized calculation process. The client then performs initial symmetric encryption on the plaintext username and password using a symmetric encryption algorithm to obtain the ciphertext username and password. Finally, the client sends the ciphertext username and password to the server via the HTTPS protocol. Server-side secondary encryption and storage stage: After receiving the username ciphertext and password ciphertext, the server obtains the plaintext username and password through a symmetric decryption algorithm, generates a random salt, and performs secondary symmetric encryption on the plaintext username and password based on the random salt using a symmetric encryption algorithm to obtain the username storage ciphertext, password storage ciphertext, and encryption salt, and stores the username storage ciphertext, password storage ciphertext, and encryption salt. Server-side verification phase: Based on the ciphertext of the password and the ciphertext of the username sent by the client, the first plaintext username and the first plaintext password are obtained. At the same time, the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt are read from the storage and restored to obtain the second plaintext username and the second plaintext password. The identity verification is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.

2. The username and password protection method based on a private algorithm according to claim 1, characterized in that, The initial symmetric encryption of plaintext ciphers specifically includes: Calculate the hash digest of the plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment and the plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext password to obtain the ciphertext.

3. The username and password protection method based on a private algorithm according to claim 2, characterized in that, The initial symmetric encryption of plaintext usernames specifically includes: Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username.

4. The username and password protection method based on a private algorithm according to claim 1, characterized in that, The plaintext cipher's quadratic symmetric encryption specifically includes: Generate a random salt, and use the random salt as the salt to perform a salted hash calculation on the plaintext username to obtain the fifth key; The sixth key is obtained by XORing the fifth key with the random salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext password, resulting in the ciphertext for password storage.

5. The username and password protection method based on a private algorithm according to claim 4, characterized in that, The quadratic symmetric encryption of the plaintext username specifically includes: The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password using a random salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the random salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric encryption algorithm is used to encrypt the plaintext username, resulting in the ciphertext username storage.

6. The username and password protection method based on a private algorithm according to claim 5, characterized in that, The second-order symmetric encryption also includes: The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, a symmetric encryption algorithm is used to encrypt the random salt to obtain the encrypted salt.

7. The username and password protection method based on a private algorithm according to claim 1, characterized in that, The recovery of the first plaintext username and password specifically includes: Extract the first 32 bits and the last 32 bits of the ciphertext, perform an XOR obfuscation calculation on the first 32 bits and the last 32 bits of the ciphertext to obtain the third key; pad with zeros if the length of the ciphertext is insufficient for extraction. Using the third key as salt, perform a salted hash calculation on the ciphertext to obtain the fourth key; Using the fourth key as the KEY and the third key as the IV, the symmetric decryption algorithm is used to decrypt the ciphertext username to obtain the first plaintext username. Calculate the hash digest of the first plaintext username to obtain the encrypted key fragment; The first key is obtained by concatenating the encrypted key fragment with the first plaintext username. Calculate the hash digest of the first key to obtain the second key; Using the first key as the KEY and the second key as the IV, a symmetric decryption algorithm is used to decrypt the ciphertext to obtain the first plaintext ciphertext.

8. A username and password protection method based on a private algorithm according to claim 6, characterized in that, The recovery of the second plaintext username and password specifically includes: The ninth key is obtained by performing an XOR obfuscation calculation on the ciphertext stored in the password and the ciphertext stored in the username. Use the hash value of the ninth key as the tenth key; Using the ninth key as the KEY and the tenth key as the IV, the encrypted salt is decrypted using a symmetric decryption algorithm to obtain the plaintext salt. The seventh key is obtained by performing a salted hash calculation on the ciphertext stored in the password, using the plaintext salt as the salt. The seventh key is used as salt to perform a salted hash calculation on the plaintext salt to obtain the eighth key; Using the seventh key as the KEY and the eighth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext of the username storage to obtain the second plaintext username. The fifth key is obtained by performing a salted hash calculation on the second plaintext username using plaintext salt as the salt. The sixth key is obtained by performing an XOR obfuscation calculation between the fifth key and the plaintext salt. Using the fifth key as the KEY and the sixth key as the IV, a symmetric decryption algorithm is used to symmetrically decrypt the ciphertext to obtain the second plaintext cipher.

9. The username and password protection method based on a private algorithm according to claim 1, characterized in that, Also includes; During the secondary encryption storage stage on the server side, the username ciphertext and password ciphertext are concatenated and then hashed to obtain the index identifier; The username, password, and encryption salt are stored using an index identifier. During the verification phase, the username storage ciphertext, password storage ciphertext, and encryption salt are obtained through the index identifier, and subsequent operations are performed.

10. A username and password protection system based on a proprietary algorithm, characterized in that, include: The client encryption module is used to generate a dynamic key based on the plaintext username and password after the user inputs them through a private and customized calculation process. The plaintext username and password are then initially encrypted using a symmetric encryption algorithm to obtain the username ciphertext and password ciphertext. The network transmission module is used to send encrypted usernames and passwords to the server via the HTTPS protocol; The server-side restoration module is used to receive the encrypted username and password, and then use a symmetric decryption algorithm to obtain the plaintext username and password. The server-side secondary encryption module is used to generate a random salt. Based on the random salt, the plaintext username and password are subjected to secondary symmetric encryption using a symmetric encryption algorithm to obtain the username storage ciphertext, the password storage ciphertext, and the encryption salt. The storage module is used to associate and store the password ciphertext, username ciphertext, and encryption salt together. The verification module is used to obtain the first plaintext username and first plaintext password by restoring the ciphertext of the password and the ciphertext of the username sent by the client. At the same time, it reads the associated ciphertext of the password storage, the ciphertext of the username storage, and the encryption salt from the storage and restores them to obtain the second plaintext username and second plaintext password. The authentication is completed by comparing the consistency between the first plaintext username and the second plaintext username, as well as between the first plaintext password and the second plaintext password.