Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

Secure password storage and verification method and device

A technology for password storage and verification methods, which is applied in secure communication devices, encryption devices with shift registers/memory, user identity/authority verification, etc., can solve problems such as inability to resist attacks by conventional password attacks, and achieve increased difficulty, Storage and verification security, the effect of increasing security

Active Publication Date: 2018-04-13
SHENZHEN INFINOVA
View PDF4 Cites 21 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0026] By using the rainbow table, it is easy to crack the above encryption method, and it is also easy to obtain the plaintext of the password through the attack method of network monitoring. The existing password storage and verification scheme cannot resist the attack of conventional password attack methods; therefore, it is necessary to A more secure and easy-to-implement encryption method

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Secure password storage and verification method and device
  • Secure password storage and verification method and device
  • Secure password storage and verification method and device

Examples

Experimental program
Comparison scheme
Effect test

Embodiment 1

[0111] Preferably, step S20 specifically includes:

[0112] S21), the client obtains the user name and password of the user;

[0113] S22), the client sends the user name of the user to the server;

[0114] S23), the server generates a unique token for this session;

[0115] S24), the server sends the token and the user's Salt corresponding to the user name stored in the server to the client together;

[0116] S25), the client calculates the hash value password after adding Salt to the user's password;

[0117] S26), the client splices the hash value password and the user name;

[0118] S27), the client uses the token as the key, and uses hmac_sha256_hex to calculate the secondary hash value password;

[0119] S28), the client sends the secondary hash value password to the server.

[0120] In this embodiment, the client sends the obtained user name and user password to the server, and the server generates a token and sends it to the client. After the password is concatenat...

Embodiment 2

[0122] Preferably, step S30 specifically includes:

[0123] S31), the server receives the user name and the secondary hash value password sent by the client;

[0124] S32), the server side queries the hash value password corresponding to the user name from the server side through the user name;

[0125] S33), the server side splices the hash value password and the user name;

[0126] S34), the server uses the unique token generated by this session with the client as the key, and uses hmac_sha256_hex to calculate the hash value password stored on the server side to obtain the secondary hash value password;

[0127] S35), the server side compares and verifies the client's secondary hash value password and the server side's secondary hash value password;

[0128] S36), the server sends the verification result to the client;

[0129] If the passwords are consistent, the verification is passed;

[0130] If the passwords do not match, the verification fails.

[0131] In this em...

Embodiment 3

[0133] Preferably, the secure password storage verification method also includes a password modification process, including:

[0134] S41), the client obtains the user name and new password of the user;

[0135] S42), the client acquires a new Salt from the server;

[0136] S43), the client adds Salt to the new password of the user;

[0137] S44), the client obtains a new hash value password through hash algorithm calculation;

[0138] S45), the client stores the user name, the new Salt and the hash value password to the server.

[0139] In this embodiment, when modifying the password, the client will obtain a new Salt. Since the Salt is randomly generated by the server, it is not easy to leak. After adding the Salt to the new password, it will be encrypted by a hash algorithm and then stored on the server to update the user. password, the old password stored on the server will be overwritten and invalidated.

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention provides a secure password storage and verification method and device. When a password is stored, Salt is added into the password and the password is encrypted by a hash algorithm; a hash value of the password is stored into a server side; when a user logs in the server to carry out password verification, the server side generates token, and secondary encryption is carried out on thepassword hash value stored by the server side and a password hash value for logging in of the user by using the token as a key; and then comparison and verification are carried out. Therefore, the security of the password of the user during the storage and verification processes is improved.

Description

technical field [0001] The invention relates to the field of network security, in particular to a secure password storage verification method and device. Background technique [0002] Currently common password attack methods in password storage and login verification scenarios mainly include: [0003] Dictionary and Brute Force Attacks: [0004] The most common way to crack Hash is to guess the password, and then hash each possible password, compare the Hash to be cracked with the guessed password Hash value, if the two values ​​are the same, then the previously guessed password is the correct password plaintext. Common ways to guess password attacks are dictionary attacks and brute force attacks. Dictionary attack is to put commonly used passwords, words, phrases and other strings that may be used as passwords into a file, then hash each word in the file, and compare these hashes with the password hashes that need to be cracked. The success rate of this method depends on...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Applications(China)
IPC IPC(8): H04L29/06H04L9/32H04L9/08H04L9/06
CPCH04L9/0643H04L9/0894H04L9/3213H04L9/3236H04L63/06
Inventor 高安存
Owner SHENZHEN INFINOVA
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic, Popular Technical Reports.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap|About US| Contact US: help@patsnap.com