WO2017054444A1 - 一种登录***的方法、服务器、***及网络附属存储设备 - Google Patents

一种登录***的方法、服务器、***及网络附属存储设备 Download PDF

Info

Publication number
WO2017054444A1
WO2017054444A1 PCT/CN2016/080665 CN2016080665W WO2017054444A1 WO 2017054444 A1 WO2017054444 A1 WO 2017054444A1 CN 2016080665 W CN2016080665 W CN 2016080665W WO 2017054444 A1 WO2017054444 A1 WO 2017054444A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
algorithm
server
irreversible
account
Prior art date
Application number
PCT/CN2016/080665
Other languages
English (en)
French (fr)
Inventor
张日和
成文俊
Original Assignee
深圳市先河***技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市先河***技术有限公司 filed Critical 深圳市先河***技术有限公司
Publication of WO2017054444A1 publication Critical patent/WO2017054444A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords

Definitions

  • the present invention relates to network technologies, and in particular, to a method, a server, a system, and a network attached storage device for logging in to a system.
  • a server that provides shared resource services such as cloud data storage, data processing, and data management in a public network is called a public cloud server.
  • a server running a shared resource service that provides data storage, data processing, and data management in a local area network is called a private cloud server.
  • the public account and the private cloud When the same user has both an account with a public cloud and a private cloud, the public account and the private cloud often use the same account and password for the convenience of the user.
  • the account passwords of the public cloud and the private cloud are saved in a unified and complete account and corresponding passwords, and can be directly saved in a clear text manner or in an encrypted manner.
  • the public cloud server has a data leak, or the public cloud server is compromised, and the encryption method of the storage account password (if encryption is used) is also cracked, the user's public cloud account password is leaked. Once the public cloud account password is cracked, you can use this password to log in directly to the private cloud service system to obtain private information and private files in the private cloud service system.
  • the present invention proposes a method of logging in to a system.
  • the method for logging in to the system includes: the first system receives a login request of the first account that carries the first password; the first system obtains the access mode of the second system according to the first account; the first system requests the second system according to the access mode, Obtaining a second password obtained by using a first irreversible algorithm for the third password required to log in to the second system; matching the second password and the fourth password, wherein the fourth password is the first system uses the first password
  • An irreversible algorithm obtains; according to the matching result, in response to the login request, if the second password and the fourth password match, the first account is successfully logged into the first system, otherwise the login fails.
  • using the first irreversible algorithm refers to using the first hash algorithm; or, using the first irreversible algorithm means using the first hash algorithm after adding the first random string in the processed data, and the second system will be the first The random string is sent to the first system together with the second password; wherein the first hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, PBKDF2.
  • the first system is a public cloud server
  • the second system is a private cloud server.
  • the present invention proposes a method of logging in to a system.
  • the method for logging in to the system includes: the first system receives a login request of the first account that carries the first password; the first system obtains the access mode of the second system according to the first account; the first system requests the second system according to the access mode, Obtaining a second password obtained by using a first irreversible algorithm for the third password required to log in to the second system; matching the fifth password and the sixth password, wherein the fifth password is the first system to the second password and the first password Seven passwords are obtained, the seventh password is a password obtained by using the second irreversible algorithm for the third password pre-stored by the first system, and the sixth password is obtained by combining the fourth password and the eighth password, wherein the fourth password is The first system obtains the first password by using a first irreversible algorithm, and the eighth password is obtained by the first system using the second irreversible algorithm for the first password; and responding to the login request according to the matching result
  • using the first irreversible algorithm refers to using the first hash algorithm; or, using the first irreversible algorithm means using the first hash algorithm after adding the first random string in the processed data, and the second system will be the first The random string is sent to the first system together with the second password; wherein the first hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, PBKDF2.
  • using the second irreversible algorithm means that the second hash algorithm is used after extracting the partial digits of the processed data, and the first system saves the extracted digits; or the second irreversible encryption algorithm refers to extracting the partial bits of the processed data. After the number is added to the second random string, and then the second hash algorithm is used, the first system saves the extracted digits and the second random string; wherein the second hash algorithm is MD5, SHA1, SHA2, SHA256, SHA512, PBKDF2 Any one of them.
  • combining refers to splicing two processed data; or combining means splicing two processed data and using a third hashing algorithm; or combining means splicing and joining two processed data
  • the first system obtains the fifth password and the sixth password and then deletes the third random string; wherein the third hash algorithm is MD5, SHA1, SHA2, SHA256, SHA512 , PBKDF2 any one of them.
  • the first system is a public cloud server
  • the second system is a private cloud server.
  • the server includes: a receiving module, configured to receive a login request of the first account that carries the first password; an addressing module, configured to obtain an access mode of the second system according to the first account; and an obtaining module, configured to request the access mode according to the access method a second system, the second password is obtained by using a first irreversible algorithm for the third password required to log in to the second system; the matching module is configured to match the second password and the fourth password, wherein the fourth password is The first password is obtained by using the first irreversible algorithm; the response module is configured to respond to the login request according to the matching result, and if the second password and the fourth password match, the first account is successfully logged in, otherwise the login fails.
  • the matching module includes a first operation unit, configured to use a first irreversible algorithm for the first password to obtain a fourth password; wherein using the first irreversible algorithm refers to using the first hash algorithm; or, using the first irreversible algorithm is
  • the first hash algorithm is used after adding the first random string to the processed data, and the second system sends the first random string together with the second password to the server; the first hash algorithm is MD5, SHA1, SHA2 Any of SHA256, SHA512, and PBKDF2.
  • the server is a public cloud server, and the second system is a private cloud server.
  • the server includes: a receiving module, configured to receive a login request of the first account that carries the first password; an addressing module, configured to obtain an access mode of the second system according to the first account; and an obtaining module, configured to request the access mode according to the access method a second system, the second password is obtained by using a first irreversible algorithm for the third password required to log in to the second system; the matching module is configured to match the fifth password and the sixth password, wherein the fifth password is Obtaining a combination of the second password and the seventh password, the seventh password is a pre-stored password obtained by using a second irreversible algorithm for the third password, and the sixth password is obtained by combining the fourth password and the eighth password, wherein The fourth password is obtained by using the first irreversible algorithm for the first password, the eighth password is obtained by using the second irreversible algorithm for the first password, and the response module is configured to respond to the login request according to the matching result, if the
  • the matching module includes a first operation unit, configured to use a first irreversible algorithm for the first password to obtain a fourth password; wherein using the first irreversible algorithm refers to using the first hash algorithm; or, using the first irreversible algorithm is
  • the first hash algorithm is used after adding the first random string to the processed data, and the second system sends the first random string together with the second password to the server; wherein the first hash algorithm is MD5, SHA1, SHA2 , SHA256, SHA512, PBKDF2 any one of them.
  • the matching module includes a second operation unit, configured to use a second irreversible algorithm for the first password to obtain the eighth password, and a second irreversible algorithm for the third password to obtain the seventh password; using the second irreversible algorithm means
  • the second hash algorithm is used to extract the partial digits of the processed data, and the server saves the number of extracted digits; or the second irreversible encryption algorithm is to extract the partial digits of the processed data and then add the second random string, and then use
  • the second hash algorithm the server saves the extracted digits and the second random string; wherein the second hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, PBKDF2.
  • the matching module includes a combining unit, configured to combine the second password and the seventh password to obtain a fifth password, and combine the fourth password and the eighth password to obtain a sixth password; wherein the combination means that the two are processed The data is spliced; or the combination means that the two processed data are spliced and then processed by using a third hash algorithm; or the combination refers to splicing the two processed data and adding the third random string to use the third haring
  • the algorithm performs processing, and the server deletes the third random string after obtaining the fifth password and the sixth password; wherein the third hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the server is a public cloud server, and the second system is a private cloud server.
  • the present invention proposes a server.
  • the server comprises: a processor, a memory and a network communication circuit, wherein the memory and the network communication circuit are respectively connected to the processor; the processor is configured to run the service program to receive the login request of the first account carrying the first password through the network communication circuit; Obtaining an access mode of the second system; requesting, by the network communication circuit, the second system according to the access mode to obtain a second password, where the second password is obtained by using a first irreversible algorithm for the third password required to log in to the second system; a second password and a fourth password, wherein the fourth password is obtained by using the first irreversible algorithm for the first password; and responding to the login request according to the matching result, if the second password and the fourth password match, the first account is successfully logged in, otherwise the login fails.
  • the present invention proposes a server.
  • the server comprises: a processor, a memory and a network communication circuit, wherein the memory and the network communication circuit are respectively connected to the processor; the processor is configured to run the service program to receive the login request of the first account carrying the first password through the network communication circuit; Obtaining an access mode of the second system; requesting, by the network communication circuit, the second system according to the access mode to obtain a second password, where the second password is obtained by using a first irreversible algorithm for the third password required to log in to the second system; a fifth password and a sixth password, wherein the fifth password is obtained by combining the second password with the seventh password, and the seventh password is a password pre-stored on the memory and obtained by using a second irreversible algorithm for the third password, the sixth password It is obtained by combining the fourth password and the eighth password, wherein the fourth password is obtained by using the first irreversible algorithm for the first password, and the eighth password is obtained by using the second irreversible algorithm
  • the present invention proposes a system.
  • the system comprises: a server and a second system;
  • the server comprises: a processor, a memory and a network communication circuit, wherein the memory and the network communication circuit are respectively connected to the processor;
  • the processor is configured to run the service program to receive the first account by the network communication circuit
  • the second system access mode is obtained according to the account;
  • the second system is requested by the network communication circuit according to the access mode to obtain the second password
  • the second password is the third password required for logging in to the second system.
  • the present invention proposes a system.
  • the system comprises: a server and a second system;
  • the server comprises: a processor, a memory and a network communication circuit, wherein the memory and the network communication circuit are respectively connected to the processor;
  • the processor is configured to run the service program to receive the first account by the network communication circuit
  • the second system access mode is obtained according to the account;
  • the second system is requested by the network communication circuit according to the access mode to obtain the second password
  • the second password is the third password required for logging in to the second system.
  • the password obtained by the irreversible algorithm is obtained by combining the fourth password with the eighth password, wherein the fourth password is obtained by using the first irreversible algorithm for the first password, and the eighth password is for using the second irreversible for the first password.
  • the algorithm obtains; responds to the login request according to the matching result, if the fifth password and the sixth password match, The first account is successfully logged in, otherwise the login fails; the second system accepts the request for obtaining the second password sent by the server and sends the second password to the server in response to the request, and the second password is the third password required to log in to the second system. Obtained using the first irreversible algorithm.
  • the present invention proposes a network attached storage device.
  • the network attached storage device comprises: a processor, a hard disk and a routing circuit, wherein the hard disk and the routing circuit are respectively connected to the processor; the routing circuit is connected to the server through the Internet, and the processor is configured to run the service program to receive the obtained by the server through the routing circuit.
  • a second password request and in response to the request, the second password is sent to the server through the routing circuit for verifying the first password input by the user login server, or combining the first password pre-saved with the server with the first password.
  • the second password is obtained by using the first irreversible algorithm for the third password required by the service program running on the login processor, and the second password or the third password is saved on the hard disk; the seventh password is used for the third password.
  • the password obtained by the second irreversible algorithm is obtained by using the first irreversible algorithm for the third password required by the service program running on the login processor, and the second password or the third password is saved on the hard disk; the seventh password is used for the third password.
  • the beneficial effects of the present invention are that the first system and the second system use the same password, and the complete password is saved on the second system.
  • the password is not saved on the first system.
  • the first system requests the second system to obtain the complete password, and then verifies the password input by the user; or the first system only saves the password processed by the irreversible algorithm.
  • the complete password cannot be obtained.
  • the second system is requested to obtain the complete password, and the password input by the user is verified in combination with the saved password and the complete password. Since the complete user password is not saved on the first system, even if the first system is compromised, the complete user password cannot be obtained for accessing the second system, thereby ensuring the security of the second system.
  • FIG. 1 is a flow chart of a first embodiment of a method for logging in to the system of the present invention
  • FIG. 2 is a flow chart of a third embodiment of a method for logging in to the system of the present invention.
  • Figure 3 is a schematic illustration of a first embodiment of a server of the present invention.
  • Figure 4 is a schematic illustration of a second embodiment of the server of the present invention.
  • Figure 5 is a schematic illustration of a third embodiment of the server of the present invention.
  • Figure 6 is a schematic view showing a fourth embodiment of the server of the present invention.
  • Figure 7 is a schematic view showing a fifth embodiment of the server of the present invention.
  • Figure 8 is a schematic view of a sixth embodiment of the server of the present invention.
  • Figure 9 is a schematic illustration of an embodiment of the system of the present invention.
  • FIG. 10 is a schematic diagram of an embodiment of a network attached storage device of the present invention.
  • the first embodiment of the method for logging in to the system of the present invention includes:
  • the first system receives the login request of the first account that carries the first password.
  • the user enters the first account and the first password on the client (such as a browser or an application) to attempt to log in to the first system, the first system is a server, the service program is run, and the database can be further run.
  • client such as a browser or an application
  • S120 The first system obtains the access mode of the second system according to the first account.
  • the first account uses the same password in both the first system and the second system.
  • the database of the first system records the information of another system corresponding to the account and the account for obtaining the password for verification.
  • the first system searches for the first account in the database, and obtains the address and port information of the second system corresponding to the account.
  • S130 The first system requests the second system according to the access mode to obtain the second password.
  • the first system establishes a connection with the second system according to the address and port information of the corresponding second system, and sends a request for acquiring the second password to the second system, where the second password is the third password used for logging in to the second system.
  • the user password confirmed by the user when completing the setting of the first account is the third password, and the password used for logging in to the first system and the second system is the third password.
  • the second system may save the third password, and after receiving the request of the first system, use the first irreversible algorithm to obtain the second password for the third password, and then send the second password to the first system; or use the first irreversible algorithm to obtain the third password.
  • the second password is saved and the second password is saved, and the second password is directly sent after receiving the request of the first system. According to the second password, the third password cannot be deduced, and the user password is prevented from being intercepted during the data transmission process.
  • the first system uses the first irreversible algorithm to obtain the fourth password for the first password input by the user, and matches the second password and the fourth password, and determines whether the second password and the fourth password are completely the same or the relationship between the two meets the predetermined condition. .
  • the first system passes The login request of the first account, otherwise the first system rejects the login request of the first account and returns an error prompt.
  • an account has a master password and at least one sub-password. There is a correspondence between the sub-password and the master password.
  • the sub-password is part of the main password.
  • the first system and the second system use the same password, and the complete password is saved on the second system.
  • the password is not saved on the first system.
  • the first system requests the second system to obtain a password, and then verifies the password input by the user.
  • the user password cannot be obtained for accessing the second system, and the security of the second system data is ensured.
  • a hash algorithm may be used as the first irreversible algorithm, that is, the first system requests the second system to obtain the HASH value (second password) of the complete password (third password), and calculates the user input password (first password).
  • the HASH value (fourth password) then the two HASH values are matched, and the user's login request is responded according to the matching result.
  • the use of the first irreversible algorithm refers to using a first hash algorithm after adding the first random string to the processed data, that is, using the salted HASH algorithm to process the first password and the third password, the first random The string is the first salt value, which can be added before or after the password, or inserted in the number of digits specified in the password.
  • the salt-adding HASH algorithm is used to combat the traditional HASH algorithm, such as dictionary method, table lookup method or rainbow table. Adding a sufficient length of salt value (random string) to the password, and then using HASH algorithm encryption, can make the traditional The method of the HASH algorithm is difficult to implement.
  • the second system saves the third password, after receiving the request of the first system, adding the first random string to the third password, using the first hash algorithm to obtain the second password, and the second password and the first random
  • the string is sent to the first system, and the first random string is deleted after the sending is completed; if the second system saves the second password and the first random string, the second password is directly sent after receiving the request of the first system.
  • a random string
  • the first hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the password is encrypted by using the tested hash algorithm to ensure the security of the password.
  • a third embodiment of the method for logging in to the system of the present invention includes:
  • S210 The first system receives the login request of the first account that carries the first password.
  • the user enters the first account and the first password on the client (such as a browser or an application) to attempt to log in to the first system, the first system being a server, running the service program and the database.
  • client such as a browser or an application
  • S220 The first system obtains the access mode of the second system according to the first account.
  • the first account uses the same password in both the first system and the second system.
  • the database of the first system records the information of another system corresponding to the account and the account for obtaining the password for verification.
  • the first system searches for the first account in the database, and obtains the address and port information of the second system corresponding to the account.
  • S230 The first system requests the second system according to the access mode to obtain the second password.
  • the first system establishes a connection with the second system according to the address and port information of the corresponding second system, and sends a request for acquiring the second password to the second system, where the second password is the third password used for logging in to the second system.
  • the user password confirmed by the user when completing the setting of the first account is the third password, and the passwords used to log in to the first system and the second system are the third passwords.
  • the second system may save the third password, and after receiving the request of the first system, use the first irreversible algorithm to obtain the second password for the third password, and then send the second password to the first system; or use the first irreversible algorithm to obtain the third password.
  • the second password is saved and the second password is saved, and the second password is directly sent after receiving the request of the first system. According to the second password, the third password cannot be deduced, and the user password is prevented from being intercepted during the data transmission process.
  • the seventh password is pre-stored on the first system. After the user confirms to modify the user password, the first system uses the second irreversible algorithm to obtain the seventh password and saves the modified third password.
  • the first system combines the second password and the seventh password to obtain a fifth password; the first system further obtains a fourth password by using a first irreversible algorithm for the first password input by the user, and obtains a fourth password by using a second irreversible algorithm for the first password. a password, and then combining the fourth password and the eighth password to obtain a sixth password; then the first system matches the fifth password and the sixth password to determine whether the fifth password and the sixth password are identical or the relationship satisfies a predetermined condition .
  • the first system passes the first A login request for an account, otherwise returning to the first system to reject the login request of the first account, and returning an error message.
  • an account has a master password and at least one sub-password. There is a correspondence between the sub-password and the master password.
  • the sub-password is part of the main password.
  • the first system and the second system use the same password, and the second system saves the complete password.
  • the first system only stores the password processed by the irreversible algorithm, and the password saved according to the first system cannot be obtained.
  • the complete user password when the user logs in to the first system, requests the second system to obtain the complete password, and combines the saved password and the complete password to verify the password entered by the user. In this way, even if the first system is broken, the complete user password cannot be obtained to access the second system, and the security of the second system data is guaranteed.
  • the first system uses the second irreversible algorithm to obtain the eighth password for the first password, and matches the pre-saved seventh password, and if the matching succeeds, the user logs in through the request, otherwise Login failed.
  • the seventh password cannot completely contain the information in the third password, that is, the first password input may not be identical to the third password, and the login may be successful, but the seventh password cannot be connected as the second system.
  • Auxiliary verification tools that enhance the system's immunity to interference.
  • the fourth embodiment of the method for logging in to the system of the present invention is based on the third embodiment of the method for logging in to the system, using the first hash algorithm as the first irreversible algorithm, that is, the first system requests the second system to obtain The HASH value (second password) of the complete password (third password), and the HASH value (fourth password) of the user input password (first password) is calculated for verification.
  • using the first irreversible algorithm means that the first hash algorithm is added after the first random string is added to the processed data, that is, the salted HASH algorithm is used, and the first random string is the first salt value, which can be added to Insert the first random string before or after the password, or the number of digits specified in the password.
  • the second system saves the third password, after receiving the request of the first system, adding the first random string to the third password, using the first hash algorithm to obtain the second password, and the second password and the first random
  • the string is sent to the first system, and the first random string is deleted after the sending is completed; if the second system saves the second password and the first random string, the second password is directly sent after receiving the request of the first system.
  • the first hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the fourth embodiment of the method for logging in to the system of the present invention is based on the third embodiment of the method for logging in to the system, and the second hash algorithm is used as the second irreversible algorithm after extracting the partial digits.
  • the first system extracts a partial digit from the user password set by the user (ie, the third password), and then uses the second hash algorithm to process the seventh password, and then saves the seventh password and the extracted digits.
  • This operation is performed after the user completes setting the user password, such as when completing the registration account and setting the password, or when the password is changed.
  • the second hash algorithm is also cracked, and the obtained user password is not directly used to log in to the second system.
  • the same operation is performed on the first password to obtain the eighth password for verification.
  • the salted HASH algorithm may also be used to process the extracted password, for example, after extracting a partial digit for the third password, adding a second random string and then using a second hash algorithm to obtain the seventh password.
  • the second random string is the second salt value, and the second random string may be added before or after the third password after the extraction, or may be inserted into the digit specified by the third password after the extraction.
  • the first system saves the seventh password, the extracted number of bits, and the second salt value, and performs the same operation on the first password when the user logs in to obtain the eighth password for verification.
  • the second hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the fourth embodiment of the method for logging in to the system of the present invention is based on the third embodiment of the method for logging in to the system, using a splicing manner to combine two processed data, for example, the second password is in the first seventh password. After the stitching constitutes the fifth password, or vice versa.
  • the above combination may also mean that the two passwords are spliced and then processed using a third hash algorithm.
  • the above combination may also be performed by splicing two passwords and adding a third random string, and then processing the third hash algorithm.
  • the third random string may be placed in front of the string composed of two passwords, or may be placed. After the string, you can also insert it into the string. After the first system obtains the fifth password and the sixth password, the third random string is deleted. Regardless of the manner in which the second password and the seventh password are combined to obtain a fifth password, the same combination operation is performed on the fourth password and the eighth password to obtain a sixth password.
  • the third hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the fourth, fifth, and sixth embodiments of the method for logging in to the system of the present invention may be combined with each other.
  • the first hash algorithm, the second hash algorithm, and the third hash algorithm may be the same or different.
  • the first system is a public cloud server and the second system is a private cloud server.
  • the public cloud is mainly used to manage user information, private cloud device information, and the mapping relationship of the user's private cloud.
  • the private cloud is mainly used to store user private information and private files. This embodiment can be combined with an embodiment of any of the above methods of logging into the system.
  • the first embodiment of the server of the present invention includes:
  • the receiving module 11 is configured to receive a login request of the first account that carries the first password; and run a service program on the server to accept the login request of the user.
  • the addressing module 12 is configured to obtain the access mode of the second system according to the first account.
  • the server further runs a database for recording the information of the account and the other system corresponding to the account for obtaining the password for verification. Find the first account in the database, and obtain the address and port of the corresponding second system. If the corresponding account information is not found, the login request is rejected and an error message is returned.
  • the obtaining module 13 is configured to request the second system according to the access mode to obtain the second password, where the second password is obtained by using the first irreversible algorithm for the third password required to log in to the second system; and the user completes the setting of the first account.
  • the user password confirmed at the time is the third password, and the password used by the login server and the second system is the third password. According to the second password, the third password cannot be deduced, and the user password is prevented from being intercepted during the data transmission process.
  • the matching module 14 is configured to match the second password and the fourth password, wherein the fourth password is obtained by using the first irreversible algorithm for the first password; obtaining the first password from the receiving module 11 and calculating the fourth password, and the obtaining module 13 Get the second password and compare the two.
  • the response module 15 is configured to respond to the login request according to the matching result. If the second password and the fourth password match, the first account is successfully logged in, otherwise the login fails; if the second password and the fourth password are identical or the relationship is satisfied.
  • the condition determines that the first password and the third password are identical or the relationship between the two meets the predetermined condition, the server passes the login request of the first account, otherwise rejects the login request of the first account, and returns an error prompt.
  • an account has a master password and at least one sub-password. There is a correspondence between the sub-password and the master password. For example, the sub-password is part of the main password. When the first password entered by the user is any sub-password, the login can be successfully performed. At this time, the relationship between the second password and the fourth password, the relationship between the first password and the third password satisfies a predetermined condition.
  • the user password is not saved on the server.
  • the server requests the second system using the same password to obtain the password, and then verifies the password input by the user.
  • the user password cannot be obtained for accessing the second system to ensure the security of the second system data.
  • the matching module 14 further includes a first operation unit 141, configured to use the first irreversible algorithm for the first password. Get the fourth password.
  • the use of the first irreversible algorithm refers to using the first hash algorithm; that is, calculating the HASH value (fourth password) of the first password input by the user for matching with the acquired second password (the HASH value of the user password).
  • the use of the first irreversible algorithm refers to using the first hash algorithm after adding the first random string to the processed data, that is, using the salt-adding HASH algorithm, the first random string is the first salt value, which may be added.
  • the server acquires the first random string simultaneously when acquiring the second password from the second system.
  • the first hash algorithm is any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2.
  • the password is encrypted by using the tested hash algorithm to ensure the security of the password.
  • a third embodiment of the server of the present invention includes:
  • the receiving module 21 is configured to receive a login request of the first account that carries the first password; run a service program on the server to accept the login request of the user, and store the user information in the database.
  • the addressing module 22 is configured to obtain the access mode of the second system according to the first account.
  • the server further runs a database for recording the information of the account and the other system corresponding to the account for obtaining the password for verification. Find the first account in the database, and obtain the address and port of the corresponding second system. If the corresponding account information is not found, the login request is rejected and an error message is returned.
  • the obtaining module 23 is configured to request the second system according to the access mode to obtain the second password, where the second password is obtained by using the first irreversible algorithm for the third password required to log in to the second system; and the user completes the setting of the first account.
  • the user password confirmed at the time is the third password, and the password used by the login server and the second system is the third password. According to the second password, the third password cannot be deduced, and the user password is prevented from being intercepted during the data transmission process.
  • the matching module 24 is configured to match the fifth password and the sixth password, wherein the fifth password is obtained by combining the second password and the seventh password acquired from the obtaining module 13, and the seventh password is pre-saved for the third password.
  • a password obtained by the second irreversible algorithm the sixth password is obtained by combining the fourth password and the eighth password, wherein the fourth password is obtained by using the first irreversible algorithm for the first password acquired from the receiving module 11, and the eighth password is
  • the second password obtained from the receiving module 11 is obtained by using a second irreversible algorithm; the second irreversible algorithm is different from the first irreversible algorithm, and even if the second irreversible algorithm is cracked, the obtained result is different from the third password, and cannot be cracked according to the third password.
  • the result is a complete third password.
  • the response module 25 is configured to respond to the login request according to the matching result. If the fifth password and the sixth password match, the first account is successfully logged in, otherwise the login fails; if the fifth password and the sixth password are identical or the relationship is satisfied.
  • the condition determines that the first password and the third password are identical or the relationship between the two meets the predetermined condition, the server passes the login request of the first account, otherwise rejects the login request of the first account, and returns an error prompt.
  • an account has a master password and at least one sub-password. There is a correspondence between the sub-password and the master password. For example, the sub-password is part of the main password. When the first password entered by the user is any sub-password, the login can be successfully performed. At this time, the relationship between the fifth password and the sixth password, the relationship between the first password and the third password satisfies a predetermined condition.
  • the server requests the second system using the same password to obtain the complete password, and authenticates the password entered by the user in combination with the saved password and the complete password. In this way, even if the server is compromised, the complete user password cannot be obtained to access the second system to ensure the security of the second system data.
  • the obtaining module 23 is configured to notify the matching module 24 that the second system cannot be connected; the matching module 24 is configured to use the second irreversible algorithm to obtain the eighth password for the first password, and the pre-saved The seven passwords are matched; the response module 25 is configured to respond to the login request according to the matching result, and if the matching succeeds, the user's login request is passed, otherwise the login fails.
  • the seventh password cannot completely contain the information in the third password, that is, the first password input may not be identical to the third password, and the login may be successful, but the seventh password cannot be connected as the second system.
  • a secondary verification tool that enhances the server's immunity to interference.
  • the matching module further includes a first operation unit 241, a second operation unit 242, and a combination unit 243.
  • the first operation unit 241 is configured to use the first irreversible algorithm for the first password to obtain the fourth password.
  • the use of the first irreversible algorithm refers to using the first hash algorithm; that is, calculating the HASH value (fourth password) of the first password input by the user for matching with the acquired second password (the HASH value of the user password).
  • the use of the first irreversible algorithm refers to using the first hash algorithm after adding the first random string to the processed data, that is, using the salt-adding HASH algorithm, the first random string is the first salt value, which may be added. Insert before or after the password, or the number of digits specified in the password.
  • the server acquires the first random string simultaneously when acquiring the second password from the second system.
  • the second operation unit 242 is configured to use a second irreversible algorithm for the first password to obtain the eighth password, and a second irreversible algorithm for the third password to obtain the seventh password.
  • the second operation unit 242 After the user completes the setting of the user password, for example, after completing the registration of the account and setting the password, or completing the modification of the password, the second operation unit 242 is configured to obtain the seventh password by using the second irreversible algorithm for the third password, and the seventh password is saved. On the server.
  • the second operation unit 242 is configured to perform the same operation on the first password to obtain an eighth password for verification.
  • the second irreversible algorithm is used to extract the partial digits of the processed data and then use the second hash algorithm, and the server saves the extracted digits.
  • the use of the second irreversible encryption algorithm refers to adding a second random string to the processed data, and then using the second hash algorithm, that is, using the salted HASH algorithm.
  • the second random string may be added before or after the extracted password, or may be inserted into the number of bits specified by the extracted password.
  • the server saves the extracted digits and the second random string.
  • the combining unit 243 is configured to combine the second password and the seventh password to obtain a fifth password, and combine the fourth password and the eighth password to obtain a sixth password, obtain a combination manner of the fifth password, and obtain a sixth password.
  • the combination used is the same.
  • the combination may refer to splicing two processed data, for example, the second password is spliced to form a fifth password after the first seventh password, or vice versa.
  • the combination may also refer to processing the two processed data and then using the third hash algorithm.
  • the combination may also be that the two processed data are spliced and the third random string is added, and then the third hash algorithm is used for processing.
  • the third random string may be placed in front of the string composed of two passwords, or After the string is placed, it can also be inserted into the string, and the server deletes the third random string after obtaining the fifth password and the sixth password.
  • the first hash algorithm, the second hash algorithm, and the third hash algorithm are any one of MD5, SHA1, SHA2, SHA256, SHA512, and PBKDF2, and the password is encrypted by using the tested hash algorithm.
  • the security of the password may be the same or different.
  • a fifth embodiment of the server of the present invention includes:
  • a processor, a memory and a network communication circuit, the memory and the network communication circuit are respectively connected to the processor; the processor is configured to run the service program to receive the login request of the first account carrying the first password; and obtain the access mode of the second system according to the account; Receiving, by the network communication circuit, the second system according to the access mode to obtain a second password obtained by using a first irreversible algorithm for the third password required to log in to the second system; matching the second password and the fourth password, wherein The fourth password is obtained by using the first irreversible algorithm for the first password; and responding to the login request according to the matching result, if the second password and the fourth password match, the first account is successfully logged in, otherwise the login fails.
  • a sixth embodiment of the server of the present invention includes:
  • a processor, a memory and a network communication circuit, the memory and the network communication circuit are respectively connected to the processor; the processor is configured to run the service program to receive the login request of the first account carrying the first password; and obtain the access mode of the second system according to the account; Receiving, by the network communication circuit, the second system according to the access mode to obtain a second password obtained by using a first irreversible algorithm for the third password required to log in to the second system; matching the fifth password and the sixth password, wherein The fifth password is obtained by combining the second password with the seventh password, and the seventh password is a password obtained by using a second irreversible algorithm for the third password pre-stored on the memory, and the sixth password is for the fourth password and the eighth password.
  • the combination of the passwords is obtained, wherein the fourth password is obtained by using the first irreversible algorithm for the first password, and the eighth password is obtained by using the second irreversible algorithm for the first password; responding to the login request according to the matching result, if the fifth password and the sixth password If the password matches, the first account is successfully logged in, otherwise the login fails.
  • the server is a public cloud server and the second system is a private cloud server.
  • the public cloud is mainly used to manage user information, private cloud device information, and the mapping relationship of the user's private cloud.
  • the private cloud is mainly used to store user private information and private files. This embodiment can be combined with an embodiment of any of the above servers.
  • a server and a second system are included; wherein the server is the server described in any one of the embodiments of the server of the present invention, and the second system accepts the second password obtained by the server.
  • the second password is sent to the server in response to the request, and the second password is obtained using the first irreversible algorithm for the third password required to log in to the second system.
  • the second system may save the third password, and after receiving the request of the server, use the first irreversible algorithm to obtain the second password, and then send the second password to the server; or use the first irreversible algorithm to obtain the second password for the third password. And save the second password, and send the second password directly after receiving the request from the server.
  • the method includes: a processor, a hard disk, and a routing circuit, wherein the hard disk and the routing circuit are respectively connected to the processor; the WAN interface of the routing circuit is connected to the server through the Internet, and the LAN The interfaces are respectively connected to the intranet devices, and the routing circuit is used to complete the transmission of the data packets between the processor and the corresponding interface.
  • the processor is used to exchange routing information, look up the routing table and forward the data packet, and cooperate with the routing circuit to realize the routing functions such as interconnection of the local area network and the wide area network, data processing and distribution, and flow control.
  • the processor is further configured to run a service program to receive a request for obtaining the second password sent by the server through the routing circuit, and send the second password to the server through the routing circuit in response to the request, for the first input to the user login server
  • the password is verified or combined with the pre-saved seventh password on the server to verify the first password.
  • the second password is obtained by using a first irreversible algorithm for the third password required by the service program running on the login processor, and the second password or the third password is saved on the hard disk; the seventh password is the second irreversible for the third password.
  • the password obtained by the algorithm is further configured to run a service program to receive a request for obtaining the second password sent by the server through the routing circuit, and send the second password to the server through the routing circuit in response to the request, for the first input to the user login server
  • the password is verified or combined with the pre-saved seventh password on the server to verify the first password.
  • the second password is obtained by using a first irreversible algorithm for the
  • the first password is used to obtain the second password for the third password, and then sent to the server. If the second password is saved on the hard disk, the second password is directly sent after receiving the request from the server.
  • the service program can also accept the user's login request, use the saved password to verify the password entered by the user, and respond to the login request according to the verification result. This operation does not require data exchange with the server.
  • the network attached storage device is generally used as a private cloud server and stores a complete user password.
  • the public cloud server requests a password, it responds to the request and sends the HASH value of the user password to the public cloud server for the public cloud server to verify the password.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种登录***的方法，第一***和第二***使用同样的密码，第二***上保存完整的密码。第一***上不保存密码，用户登录第一***时第一***向第二***请求获得完整密码，并据此对用户输入的密码进行验证；或者第一***只保存经过不可逆算法处理的密码，根据第一***保存的密码不能得到完整密码，用户登录第一***时向第二***请求获得完整密码，并结合保存的密码和完整密码对用户输入的密码进行验证。本发明还公开了一种服务器、一种***和一种网络附属存储设备。

Description

一种登录***的方法、服务器、***及网络附属存储设备
【技术领域】
本发明涉及网络技术，特别是涉及一种登录***的方法、服务器、***及网络附属存储设备。
【背景技术】
在当前的互联网应用中，在公共网络中提供云数据存储、数据处理以及数据管理等共享资源服务的服务器被称为公有云服务器。运行在本地局域网中提供数据存储、数据处理以及数据管理等共享资源服务的服务器被称为私有云服务器。
同一个用户同时拥有公有云与私有云的账户时，为了用户的方便，公有云和私有云经常统一使用同样的账户和密码。在现有技术中，公有云与私有云的账户密码的保存方式，均是统一完整的保存账户和对应的密码，可以直接以明文方式保存，也可以以加密的方式保存密码。但是，当公有云服务器出现了数据泄漏，或者公有云服务器被攻破，并且存储账户密码的加密方式（若使用了加密的情况下）也被破解之后，用户的公有云账户密码被泄露。一旦破解了公有云账户密码，也就可以使用这个密码直接登录到私有云的服务***中，获取私有云服务***中的私密信息以及私有文件。
【发明内容】
为了至少部分解决以上问题，本发明提出了一种登录***的方法。该登录***的方法包括：第一***接收第一账号的携带第一密码的登录请求；第一***根据第一账号获得第二***的访问方式；第一***根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第二密码和第四密码，其中第四密码是第一***对第一密码使用第一不可逆算法得到；根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录第一***成功，否则登录失败。
其中，使用第一不可逆算法是指使用第一哈希算法；或者，使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，第二***将第一随机字符串和第二密码一起发送给第一***；其中第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，第一***是公有云服务器，第二***是私有云服务器。
为了至少部分解决以上问题，本发明提出了一种登录***的方法。该登录***的方法包括：第一***接收第一账号的携带第一密码的登录请求；第一***根据第一账号获得第二***的访问方式；第一***根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中第五密码是第一***对第二密码与第七密码组合而得到，第七密码是第一***预保存的对第三密码使用第二不可逆算法得到的密码，第六密码是对第四密码和第八密码组合而得到，其中第四密码是第一***对第一密码使用第一不可逆算法得到，第八密码是第一***对第一密码使用第二不可逆算法得到；根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录第一***成功，否则登录失败。
其中，使用第一不可逆算法是指使用第一哈希算法；或者，使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，第二***将第一随机字符串和第二密码一起发送给第一***；其中第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，使用第二不可逆算法是指对被处理数据抽取部分位数后使用第二哈希算法，第一***保存抽取的位数；或者使用第二不可逆加密算法是指对被处理数据抽取部分位数后加入第二随机字符串，然后使用第二哈希算法，第一***保存抽取的位数和第二随机字符串；其中第二哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，组合是指对两个被处理数据进行拼接；或者组合是指对两个被处理数据进行拼接后使用第三哈希算法进行处理；或者组合是指对两个被处理数据进行拼接并加入第三随机字符串后使用第三哈希算法进行处理，第一***获得第五密码和第六密码之后删除第三随机字符串；其中第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，第一***是公有云服务器，第二***是私有云服务器。
为了至少部分解决以上问题，本发明提出了一种服务器。该服务器包括：接收模块，用于接收第一账号的携带第一密码的登录请求；寻址模块，用于根据第一账号获得第二***的访问方式；获取模块，用于根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配模块，用于匹配第二密码和第四密码，其中第四密码是对第一密码使用第一不可逆算法得到；响应模块，用于根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录成功，否则登录失败。
其中，匹配模块包括第一运算单元，用于对第一密码使用第一不可逆算法以得到第四密码；其中使用第一不可逆算法是指使用第一哈希算法；或者，使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，第二***将第一随机字符串和第二密码一起发送给服务器；第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，服务器为公有云服务器，第二***为私有云服务器。
为了至少部分解决以上问题，本发明提出了一种服务器。该服务器包括：接收模块，用于接收第一账号的携带第一密码的登录请求；寻址模块，用于根据第一账号获得第二***的访问方式；获取模块，用于根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配模块，用于匹配第五密码和第六密码，其中第五密码是对第二密码与第七密码组合而得到，第七密码是预保存的对第三密码使用第二不可逆算法得到的密码，第六密码是对第四密码和第八密码组合而得到，其中第四密码是对第一密码使用第一不可逆算法得到，第八密码是对第一密码使用第二不可逆算法得到；响应模块，用于根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录成功，否则登录失败。
其中，匹配模块包括第一运算单元，用于对第一密码使用第一不可逆算法以得到第四密码；其中使用第一不可逆算法是指使用第一哈希算法；或者，使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，第二***将第一随机字符串和第二密码一起发送给服务器；其中第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，匹配模块包括第二运算单元，用于对第一密码使用第二不可逆算法以得到第八密码，以及对第三密码使用第二不可逆算法以得到第七密码；使用第二不可逆算法是指对被处理数据抽取部分位数后使用第二哈希算法，服务器保存抽取的位数；或者使用第二不可逆加密算法是指对被处理数据抽取部分位数后加入第二随机字符串，然后使用第二哈希算法，服务器保存抽取的位数和第二随机字符串；其中第二哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，匹配模块包括组合单元，用于对第二密码和第七密码组合以得到第五密码，以及对第四密码和第八密码组合以得到第六密码；其中组合是指对两个被处理数据进行拼接；或者组合是指对两个被处理数据进行拼接后使用第三哈希算法进行处理；或者组合是指对两个被处理数据进行拼接并加入第三随机字符串后使用第三哈希算法进行处理，服务器获得第五密码和第六密码之后删除第三随机字符串；其中第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
其中，服务器为公有云服务器，第二***为私有云服务器。
为了至少部分解决以上问题，本发明提出了一种服务器。该服务器包括：处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以通过网络通信电路接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第二密码和第四密码，其中第四密码是对第一密码使用第一不可逆算法得到；根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录成功，否则登录失败。
为了至少部分解决以上问题，本发明提出了一种服务器。该服务器包括：处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以通过网络通信电路接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中第五密码是对第二密码与第七密码组合而得到，第七密码是预保存在存储器上的对第三密码使用第二不可逆算法得到的密码，第六密码是对第四密码和第八密码组合而得到，其中第四密码是对第一密码使用第一不可逆算法得到，第八密码是对第一密码使用第二不可逆算法得到；根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录成功，否则登录失败。
为了至少部分解决以上问题，本发明提出了一种***。该***包括：服务器和第二***；服务器包括：处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以通过网络通信电路接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第二密码和第四密码，其中第四密码是对第一密码使用第一不可逆算法得到；根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录成功，否则登录失败；第二***接受服务器发来的获取第二密码的请求并响应请求将第二密码发送给服务器，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到。
为了至少部分解决以上问题，本发明提出了一种***。该***包括：服务器和第二***；服务器包括：处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以通过网络通信电路接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中第五密码是对第二密码与第七密码组合而得到，第七密码是预保存在存储器上的对第三密码使用第二不可逆算法得到的密码，第六密码是对第四密码和第八密码组合而得到，其中第四密码是对第一密码使用第一不可逆算法得到，第八密码是对第一密码使用第二不可逆算法得到；根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录成功，否则登录失败；第二***接受服务器发来的获取第二密码的请求并响应请求将第二密码发送给服务器，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到。
为了至少部分解决以上问题，本发明提出了一种网络附属存储设备。该网络附属存储设备包括：处理器、硬盘和路由电路，硬盘和路由电路分别连接处理器；路由电路通过互联网连接到服务器，处理器用于运行服务程序，以接收服务器通过路由电路发来的获得第二密码的请求，并响应请求通过路由电路将第二密码发送给服务器，以用于对用户登录服务器输入的第一密码进行验证，或者与服务器上预保存的第七密码结合起来对第一密码进行验证；其中第二密码是对登录处理器运行的服务程序所需的第三密码使用第一不可逆算法得到，硬盘上保存有第二密码或第三密码；第七密码是对第三密码使用第二不可逆算法得到的密码。
本发明的有益效果是：第一***和第二***使用同样的密码，第二***上保存完整的密码。第一***上不保存密码，用户登录第一***时第一***向第二***请求获得完整密码，并据此对用户输入的密码进行验证；或者第一***只保存经过不可逆算法处理的密码，根据第一***保存的密码不能得到完整密码，用户登录第一***时向第二***请求获得完整密码，并结合保存的密码和完整密码对用户输入的密码进行验证。由于第一***上没有保存完整的用户密码，即使第一***被攻破，也无法获得完整的用户密码用来访问第二***，保证了第二***的安全性。
【附图说明】
图1是本发明登录***的方法第一实施例的流程图；
图2是本发明登录***的方法第三实施例的流程图；
图3是本发明服务器的第一实施例的示意图；
图4是本发明服务器的第二实施例的示意图；
图5是本发明服务器的第三实施例的示意图；
图6是本发明服务器的第四实施例的示意图；
图7是本发明服务器的第五实施例的示意图；
图8是本发明服务器的第六实施例的示意图
图9是本发明***一实施例的示意图；
图10是本发明网络附属存储设备一实施例的示意图。
【具体实施方式】
下面结合附图和实施例对本发明进行详细说明。
如图1所示，本发明登录***的方法的第一实施例包括：
S110：第一***接收第一账号的携带第一密码的登录请求；
用户在客户端上（如浏览器或者应用程序）输入第一账号和第一密码来试图登录第一***，第一***为服务器，运行服务程序，进一步还可以运行数据库。
S120：第一***根据第一账号获得第二***的访问方式；
第一账号在第一***和第二***中使用同样的密码。第一***的数据库中记录了账号和账号对应的另一***的信息，以用于获取密码进行校验。第一***在数据库中查找第一账号，并获取该账号对应的第二***的地址和端口信息。
S130：第一***根据访问方式请求第二***，以获得第二密码；
第一***根据对应的第二***的地址和端口信息与第二***建立连接，向第二***发送获取第二密码的请求，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到的密码。用户在完成第一账号的设置时确认的用户密码为第三密码，登录第一***和第二***使用的密码均为第三密码。
第二***可以保存第三密码，接收到第一***的请求后对第三密码使用第一不可逆算法得到第二密码后发送给第一***；也可以对第三密码使用第一不可逆算法得到第二密码并保存第二密码，接收到第一***的请求后直接发送第二密码。根据第二密码不能反向推算得出第三密码，防止数据传输过程中被截获而造成用户密码的泄露。
S140：匹配第二密码和第四密码；
第一***对用户输入的第一密码使用第一不可逆算法得到第四密码，并对第二密码和第四密码进行匹配，判断第二密码和第四密码是否完全相同或两者关系满足预定条件。
S150：根据匹配结果响应登录请求；
如果第四密码与第二密码匹配成功，判定第一密码与第三密码完全相同或两者关系满足预定条件，即用户输入的密码与用户密码相同或两者关系满足预定条件，第一***通过第一账号的登录请求，否则第一***拒绝第一账号的登录请求，并返回错误提示。例如一个账号设有一个主密码和至少一个子密码，子密码与主密码之间存在对应关系，比如子密码为主密码的一部分，用户输入的第一密码为任意一个子密码时也可以成功登录，此时第二密码和第四密码的关系、第一密码和第三密码的关系满足预定的条件。
由以上实施例可以看出，第一***和第二***使用同样的密码，第二***上保存完整的密码。第一***上不保存密码，用户登录第一***时第一***向第二***请求获得密码，并据此对用户输入的密码进行验证。这样即使第一***被攻破，也无法获得用户密码用来访问第二***，保证了第二***数据的安全性。
本发明登录***的方法的第二实施例是以登录***的方法的第一实施例为基础，第一不可逆算法，以b=f(a)的形式来表示，a为被处理数据，b为处理结果。对于第一不可逆算法的要求包括：不能根据输出值反推出输入值，即不能根据b计算出a；很难找到碰撞值，即很难找到a1和a2， f(a1)= f(a2)且a1≠a2。可以使用哈希（Hash）算法作为第一不可逆算法，即第一***向第二***请求获得完整密码（第三密码）的HASH值（第二密码），并计算用户输入密码（第一密码）的HASH值（第四密码），然后将两个HASH值进行匹配，根据匹配结果响应用户的登录请求。
或者，上述的使用第一不可逆算法，是指在被处理数据中加入第一随机字符串后使用第一哈希算法，即使用加盐HASH算法来处理第一密码和第三密码，第一随机字符串即为第一盐值，可以加在密码的前面或者后面，或者在密码中指定的位数***。加盐HASH算法是为了对抗破解传统HASH算法的方法，例如字典法、查表法或者彩虹表，在密码中加入足够长度的盐值（随机字符串），再使用HASH算法加密，能够使得破解传统HASH算法的方法难以实施。如果第二***保存第三密码，那么接收到第一***的请求后，对第三密码加入第一随机字符串后使用第一哈希算法得到第二密码，并将第二密码和第一随机字符串发送给第一***，完成发送后将第一随机字符串删除；如果第二***保存第二密码和第一随机字符串，接收到第一***的请求后直接发送第二密码和第一随机字符串。
其中第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种，使用经过测试的哈希算法对密码进行加密可以有效的保证密码的安全。
如图2所示，本发明登录***的方法的第三实施例包括：
S210：第一***接收第一账号的携带第一密码的登录请求；
用户在客户端上（如浏览器或者应用程序）输入第一账号和第一密码来试图登录第一***，第一***为服务器，运行服务程序和数据库。
S220：第一***根据第一账号获得第二***的访问方式；
第一账号在第一***和第二***中使用同样的密码。第一***的数据库中记录了账号和账号对应的另一***的信息，以用于获取密码进行校验。第一***在数据库中查找第一账号，并获取该账号对应的第二***的地址和端口信息。
S230：第一***根据访问方式请求第二***，以获得第二密码；
第一***根据对应的第二***的地址和端口信息与第二***建立连接，向第二***发送获取第二密码的请求，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到的密码。用户在完成第一账号的设置时确认的用户密码为第三密码，登录第一***和第二***使用的口令均为第三密码。
第二***可以保存第三密码，接收到第一***的请求后对第三密码使用第一不可逆算法得到第二密码后发送给第一***；也可以对第三密码使用第一不可逆算法得到第二密码并保存第二密码，接收到第一***的请求后直接发送第二密码。根据第二密码不能反向推算得出第三密码，防止数据传输过程中被截获而造成用户密码的泄露。
S240：匹配第五密码和第六密码；
第一***上预保存有第七密码，每次用户确认修改用户密码之后第一***就对修改之后的第三密码使用第二不可逆算法得到第七密码并保存。
第一***对第二密码与第七密码组合得到第五密码；第一***还对用户输入的第一密码使用第一不可逆算法得到第四密码，对第一密码使用第二不可逆算法得到第八密码，再对第四密码和第八密码组合得到第六密码；然后第一***对第五密码和第六密码进行匹配，判断第五密码和第六密码是否完全相同或两者关系满足预定条件。
S250：根据匹配结果响应登录请求；
如果第五密码与第六密码匹配成功，判定第一密码与第三密码完全相同或两者关系满足预定条件，即输入的密码与用户密码相同或两者关系满足预定条件，第一***通过第一账号的登录请求，否则返回第一***拒绝第一账号的登录请求，并返回错误提示。例如一个账号设有一个主密码和至少一个子密码，子密码与主密码之间存在对应关系，比如子密码为主密码的一部分，用户输入的第一密码为任意一个子密码时也可以成功登录，此时第五密码和第六密码的关系、第一密码和第三密码的关系满足预定的条件。
由以上实施例可以看出，第一***和第二***使用同样的密码，第二***上保存完整的密码，第一***只保存经过不可逆算法处理的密码，根据第一***保存的密码不能得到完整的用户密码，用户登录第一***时向第二***请求获得完整密码，并结合保存的密码和完整密码对用户输入的密码进行验证。这样即使第一***被攻破，也无法获得完整的用户密码来访问第二***，保证了第二***数据的安全性。
此外，如果第二***无法连接，此时第一***对第一密码使用第二不可逆算法得到第八密码，并与预保存的第七密码进行匹配，如果匹配成功则通过用户的登录请求，否则登录失败。虽然第七密码不能完整的包含第三密码中的信息，即可能出现输入的第一密码并不与第三密码完全相同，也能成功登录的情况，但是第七密码作为第二***无法连接时的辅助验证工具，可以增强***的抗干扰性。
本发明登录***的方法的第四实施例，是在登录***的方法的第三实施例的基础上，采用第一哈希算法来作为第一不可逆算法，即第一***向第二***请求获得完整密码（第三密码）的HASH值（第二密码），并计算用户输入密码（第一密码）的HASH值（第四密码）来进行验证。
或者，使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，即使用加盐HASH算法，第一随机字符串即为第一盐值，可以加在密码的前面或者后面，或者在密码中指定的位数***第一随机字符串。如果第二***保存第三密码，那么接收到第一***的请求后，对第三密码加入第一随机字符串后使用第一哈希算法得到第二密码，并将第二密码和第一随机字符串发送给第一***，完成发送后将第一随机字符串删除；如果第二***保存第二密码和第一随机字符串，接收到第一***的请求后直接发送第二密码和第一随机字符串。其中第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种
本发明登录***的方法的第四实施例，是在登录***的方法的第三实施例的基础上，采用抽取部分位数后再用第二哈希算法处理作为第二不可逆算法。第一***对用户设定的用户密码（即第三密码）抽取部分位数后使用第二哈希算法进行处理得到第七密码，然后保存第七密码和抽取的位数。该操作是在用户完成设定用户密码后进行的，例如完成注册账号和设定密码时、或完成修改密码时。这样即使第一***被攻破，第二哈希算法也被破解，得到的也是抽取之后的用户密码，不能直接用来登录第二***。用户登录时对第一密码进行同样的操作得到第八密码来进行验证。
为了进一步加强密码的安全性，还可以使用加盐HASH算法来处理抽取之后的密码，例如对第三密码抽取部分位数后加入第二随机字符串再使用第二哈希算法得到第七密码，第二随机字符串即为第二盐值，第二随机字符串可以加在抽取之后的第三密码的前面或者后面，也可以***抽取之后的第三密码指定的位数中。第一***保存第七密码、抽取的位数和第二盐值，并在用户登录时对第一密码进行同样的操作得到第八密码以用于验证。其中第二哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
本发明登录***的方法的第四实施例，是在登录***的方法的第三实施例的基础上，采用拼接的方式来对两个被处理数据进行组合，例如第二密码在前第七密码在后拼接组成第五密码，或者反过来。
上述组合也可以是指将两个密码拼接之后使用第三哈希算法进行处理。上述组合还可以是指对两个密码进行拼接并加入第三随机字符串后使用第三哈希算法进行处理，第三随机字符串可以放在两个密码拼接组成的字符串前面，也可以放在字符串后面，还可以***字符串中。第一***获得第五密码和第六密码之后删除第三随机字符串。无论使用怎样的方式将第二密码和第七密码组合得到第五密码，对第四密码和第八密码进行同样的组合操作得到第六密码。其中第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
本发明登录***的方法的第四、第五和第六实施例可以相互组合，第一哈希算法、第二哈希算法、第三哈希算法可以相同，也可以不同。
在本发明登录***的方法的一个实施例中，第一***是公有云服务器，第二***是私有云服务器。公有云主要用于管理用户信息、私有云设备信息以及对应用户私有云的入口映射关系等，私有云主要是用于保存用户的私密信息以及私有文件等。本实施例可以与以上任意一个登录***的方法的实施例结合。
如图3所示，本发明服务器的第一实施例包括：
接收模块11，用于接收第一账号的携带第一密码的登录请求；服务器上运行服务程序来接受用户的登录请求。
寻址模块12，用于根据第一账号获得第二***的访问方式；服务器上进一步运行数据库，用于记录账号和账号对应的另一***的信息，以用于获取密码进行校验。在数据库中查找第一账号，并获取对应的第二***的地址和端口，如果找不到对应的账号信息则拒绝登录请求并返回错误提示。
获取模块13，用于根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；用户在完成第一账号的设置时确认的用户密码为第三密码，登录服务器和第二***使用的密码均为第三密码。根据第二密码不能反向推算得出第三密码，防止数据传输过程中被截获而造成用户口令的泄露。
匹配模块14，用于匹配第二密码和第四密码，其中第四密码是对第一密码使用第一不可逆算法得到；从接收模块11获取第一密码并计算得到第四密码，从获取模块13获取第二密码，并将两者进行比较。
响应模块15，用于根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录成功，否则登录失败；如果第二密码和第四密码完全相同或两者关系满足预定条件，判定第一密码与第三密码完全相同或两者关系满足预定条件，服务器通过第一账号的登录请求，否则拒绝第一账号的登录请求，并返回错误提示。例如一个账号设有一个主密码和至少一个子密码，子密码与主密码之间存在对应关系，比如子密码为主密码的一部分，用户输入的第一密码为任意一个子密码时也可以成功登录，此时第二密码和第四密码的关系、第一密码和第三密码的关系满足预定的条件。
由以上实施例可以看出，服务器上不保存用户密码，用户登录时服务器向使用同样密码的第二***请求获得密码，并据此对用户输入的密码进行验证。这样即使服务器被攻破，也无法获得用户密码用来访问第二***，以保证第二***数据的安全性。
如图4所示，本发明服务器的第二实施例，是在服务器的第一实施例的基础上，匹配模块14进一步包括第一运算单元141，用于对第一密码使用第一不可逆算法以得到第四密码。其中使用第一不可逆算法是指使用第一哈希算法；即计算用户输入的第一密码的HASH值（第四密码），以用于与获取的第二密码（用户密码的HASH值）进行匹配。或者，上述使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，即使用加盐HASH算法，第一随机字符串即为第一盐值，可以加在密码的前面或者后面，或者在密码中指定的位数***。服务器从第二***获取第二密码时同时获取第一随机字符串。第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种，使用经过测试的哈希算法对密码进行加密可以有效的保证密码的安全。
如图5所示，本发明服务器的第三实施例包括：
接收模块21，用于接收第一账号的携带第一密码的登录请求；服务器上运行服务程序来接受用户的登录请求，数据库中存储用户信息。
寻址模块22，用于根据第一账号获得第二***的访问方式；服务器上进一步运行数据库，用于记录账号和账号对应的另一***的信息，以用于获取密码进行校验。在数据库中查找第一账号，并获取对应的第二***的地址和端口，如果找不到对应的账号信息则拒绝登录请求并返回错误提示。
获取模块23，用于根据访问方式请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；用户在完成第一账号的设置时确认的用户密码为第三密码，登录服务器和第二***使用的密码均为第三密码。根据第二密码不能反向推算得出第三密码，防止数据传输过程中被截获而造成用户口令的泄露。
匹配模块24，用于匹配第五密码和第六密码，其中第五密码是对从获取模块13获取的第二密码与第七密码组合而得到，第七密码是预保存的对第三密码使用第二不可逆算法得到的密码；第六密码是对第四密码和第八密码组合而得到，其中第四密码是对从接收模块11获取的第一密码使用第一不可逆算法得到，第八密码是对从接收模块11获取的第一密码使用第二不可逆算法得到；第二不可逆算法与第一不可逆算法不同，即使第二不可逆算法被破解，得到的结果也与第三密码不同，并且不能根据破解结果推算出完整的第三密码。
响应模块25，用于根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录成功，否则登录失败；如果第五密码和第六密码完全相同或两者关系满足预定条件，判定第一密码与第三密码完全相同或两者关系满足预定条件，服务器通过第一账号的登录请求，否则拒绝第一账号的登录请求，并返回错误提示。例如一个账号设有一个主密码和至少一个子密码，子密码与主密码之间存在对应关系，比如子密码为主密码的一部分，用户输入的第一密码为任意一个子密码时也可以成功登录，此时第五密码和第六密码的关系、第一密码和第三密码的关系满足预定的条件。
由以上实施例可以看出，服务器上只保存经过不可逆算法处理的密码，根据保存的密码不能得到完整的用户密码。用户登录时服务器向使用同样密码的第二***请求获得完整密码，并结合保存的密码和完整密码对用户输入的密码进行验证。这样即使服务器被攻破，也无法获得完整的用户密码来访问第二***，以保证第二***数据的安全性。
此外，如果第二***无法连接，获取模块23用于通知匹配模块24无法连接到第二***；匹配模块24用于对第一密码使用第二不可逆算法得到第八密码，并与预保存的第七密码进行匹配；响应模块25用于根据匹配结果响应登录请求，如果匹配成功则通过用户的登录请求，否则登录失败。虽然第七密码不能完整的包含第三密码中的信息，即可能出现输入的第一密码并不与第三密码完全相同，也能成功登录的情况，但是第七密码作为第二***无法连接时的辅助验证工具，可以增强服务器的抗干扰性。
如图6所示，本发明服务器的第四实施例，是在服务器的第三实施例的基础上，匹配模块进一步包括第一运算单元241、第二运算单元242和组合单元243。
第一运算单元241用于对第一密码使用第一不可逆算法以得到第四密码。其中使用第一不可逆算法是指使用第一哈希算法；即计算用户输入的第一密码的HASH值（第四密码），以用于与获取的第二密码（用户密码的HASH值）进行匹配。或者，上述使用第一不可逆算法是指在被处理数据中加入第一随机字符串后使用第一哈希算法，即使用加盐HASH算法，第一随机字符串即为第一盐值，可以加在密码的前面或者后面，或者在密码中指定的位数***。服务器从第二***获取第二密码时同时获取第一随机字符串。
第二运算单元242用于对第一密码使用第二不可逆算法以得到第八密码，以及对第三密码使用第二不可逆算法以得到第七密码。在用户完成设定用户密码后，例如完成注册账号和设定密码、或完成修改密码后，第二运算单元242用于对第三密码使用第二不可逆算法得到第七密码，第七密码被保存在服务器上。用户登录时第二运算单元242用于对第一密码进行同样的操作得到第八密码以用于验证。其中使用第二不可逆算法是指对被处理数据抽取部分位数后使用第二哈希算法，服务器保存抽取的位数。或者，上述使用第二不可逆加密算法是指对被处理数据抽取部分位数后加入第二随机字符串，然后使用第二哈希算法，即使用加盐HASH算法。第二随机字符串可以加在抽取之后的密码的前面或者后面，也可以***抽取之后的密码指定的位数中。服务器保存抽取的位数和第二随机字符串。
组合单元243，用于对第二密码和第七密码组合以得到第五密码，以及对第四密码和第八密码组合以得到第六密码，得到第五密码使用的组合方式和得到第六密码使用的组合方式是一样的。其中组合可以是指对两个被处理数据进行拼接，例如第二密码在前第七密码在后拼接组成第五密码，或者反过来。组合也可以是指对两个被处理数据进行拼接后使用第三哈希算法进行处理。组合还可以是指对两个被处理数据进行拼接并加入第三随机字符串后使用第三哈希算法进行处理，第三随机字符串可以放在两个密码拼接组成的字符串前面，也可以放在字符串后面，还可以***字符串中，服务器获得第五密码和第六密码之后删除第三随机字符串。
其中第一哈希算法、第二哈希算法、第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种，使用经过测试的哈希算法对密码进行加密可以有效的保证密码的安全。第一哈希算法、第二哈希算法和第三哈希算法可以相同，也可以不同。
如图7所示，本发明服务器的第五实施例包括：
处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第二密码和第四密码，其中第四密码是对第一密码使用第一不可逆算法得到；根据匹配结果响应登录请求，如果第二密码和第四密码匹配，则第一账号登录成功，否则登录失败。
如图8所示，本发明服务器的第六实施例包括：
处理器、存储器和网络通信电路，存储器和网络通信电路分别连接处理器；处理器用于运行服务程序，以接收第一账号的携带第一密码的登录请求；根据账号获得第二***的访问方式；根据访问方式通过网络通信电路请求第二***，以获得第二密码，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中第五密码是对第二密码与第七密码组合而得到，第七密码是预保存在存储器上的对第三密码使用第二不可逆算法得到的密码，第六密码是对第四密码和第八密码组合而得到，其中第四密码是对第一密码使用第一不可逆算法得到，第八密码是对第一密码使用第二不可逆算法得到；根据匹配结果响应登录请求，如果第五密码和第六密码匹配，则第一账号登录成功，否则登录失败。
在本发明服务器的一个实施例中，服务器是公有云服务器，第二***是私有云服务器。公有云主要用于管理用户信息、私有云设备信息以及对应用户私有云的入口映射关系等，私有云主要是用于保存用户的私密信息以及私有文件等。本实施例可以与以上任意一个服务器的实施例结合。
如图9所示，在本发明***的一个实施例中，包括服务器和第二***；其中服务器为本发明服务器任意一个实施例描述的服务器，第二***接受服务器发来的获取第二密码的请求并响应请求将第二密码发送给服务器，第二密码是对登录第二***所需的第三密码使用第一不可逆算法得到。第二***可以保存第三密码，接收到服务器的请求后对第三密码使用第一不可逆算法得到第二密码后将其发送给服务器；也可以对第三密码使用第一不可逆算法得到第二密码并保存第二密码，接收到服务器的请求后直接发送第二密码。
如图10所示，在本发明网络附属存储设备的一个实施例中，包括：处理器、硬盘和路由电路，硬盘和路由电路分别连接处理器；路由电路的WAN接口通过互联网连接到服务器，LAN接口分别连接内网设备，路由电路用于完成数据包在处理器和对应接口之间的传输。处理器用于交换路由信息、查找路由表和转发数据包，配合路由电路实现局域网和广域网的互连、数据的处理和分发、流量控制等路由功能。
处理器还用于运行服务程序，以通过路由电路接收服务器发来的获得第二密码的请求，并响应请求通过路由电路将第二密码发送给服务器，以用于对用户登录服务器输入的第一密码进行验证，或者与服务器上预保存的第七密码结合起来对第一密码进行验证。其中第二密码是对登录处理器运行的服务程序所需的第三密码使用第一不可逆算法得到，硬盘上保存有第二密码或第三密码；第七密码是对第三密码使用第二不可逆算法得到的密码。
如果硬盘上保存的是第三密码，那么接收到服务器的请求后对第三密码使用第一不可逆算法得到第二密码，再将其发送给服务器。如果硬盘上保存的是第二密码，那么接收到服务器的请求后直接发送第二密码。服务程序还可以接受用户的登录请求，利用保存的密码来对用户输入的密码进行验证，根据验证结果来响应登录请求，这一操作无需与服务器之间发生数据交换。
网络附属存储设备一般作为私有云服务器，保存有完整的用户密码，在公有云服务器提出获取密码的请求时响应请求，将用户密码的HASH值发送给公有云服务器，以供公有云服务器验证密码。
以上所述仅为本发明的实施方式，并非因此限制本发明的专利范围，凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本发明的专利保护范围内。

Claims (20)

  1. 一种登录***的方法，其中，包括：
    第一***接收第一账号的携带第一密码的登录请求；
    所述第一***根据所述第一账号获得第二***的访问方式；
    所述第一***根据所述访问方式请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；
    匹配所述第二密码和第四密码，其中所述第四密码是所述第一***对所述第一密码使用所述第一不可逆算法得到；
    根据匹配结果响应所述登录请求，如果所述第二密码和所述第四密码匹配，则所述第一账号登录所述第一***成功，否则登录失败。
  2. 根据权利要求1所述的方法，其中，
    所述使用所述第一不可逆算法是指使用第一哈希算法；
    或者，所述使用所述第一不可逆算法是指在被处理数据中加入第一随机字符串后使用所述第一哈希算法，所述第二***将所述第一随机字符串和所述第二密码一起发送给所述第一***；
    其中所述第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  3. 根据权利要求1所述的方法，其中，
    所述第一***是公有云服务器，所述第二***是私有云服务器。
  4. 一种登录***的方法，其中，包括：
    第一***接收第一账号的携带第一密码的登录请求；
    所述第一***根据所述第一账号获得第二***的访问方式；
    所述第一***根据所述访问方式请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；
    匹配第五密码和第六密码，其中所述第五密码是所述第一***对所述第二密码与第七密码组合而得到，所述第七密码是所述第一***预保存的对所述第三密码使用第二不可逆算法得到的密码，所述第六密码是对第四密码和第八密码组合而得到，其中所述第四密码是所述第一***对所述第一密码使用所述第一不可逆算法得到，所述第八密码是所述第一***对所述第一密码使用所述第二不可逆算法得到；
    根据匹配结果响应所述登录请求，如果所述第五密码和所述第六密码匹配，则所述第一账号登录所述第一***成功，否则登录失败。
  5. 根据权利要求4所述的方法，其中，
    所述使用所述第一不可逆算法是指使用第一哈希算法；
    或者，所述使用所述第一不可逆算法是指在被处理数据中加入第一随机字符串后使用所述第一哈希算法，所述第二***将所述第一随机字符串和所述第二密码一起发送给所述第一***；
    其中所述第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  6. 根据权利要求4所述的方法，其中，
    所述使用所述第二不可逆算法是指对被处理数据抽取部分位数后使用第二哈希算法，所述第一***保存所述抽取的位数；
    或者所述使用所述第二不可逆加密算法是指对被处理数据抽取部分位数后加入第二随机字符串，然后使用所述第二哈希算法，所述第一***保存所述抽取的位数和所述第二随机字符串；
    其中所述第二哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  7. 根据权利要求4所述的方法，其中，
    所述组合是指对两个被处理数据进行拼接；
    或者所述组合是指对两个被处理数据进行拼接后使用第三哈希算法进行处理；
    或者所述组合是指对两个被处理数据进行拼接并加入第三随机字符串后使用所述第三哈希算法进行处理，所述第一***获得所述第五密码和所述第六密码之后删除所述第三随机字符串；
    其中所述第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  8. 根据权利要求4所述的方法，其中，
    所述第一***是公有云服务器，所述第二***是私有云服务器。
  9. 一种服务器，其中，包括：
    接收模块，用于接收第一账号的携带第一密码的登录请求；
    寻址模块，用于根据所述第一账号获得第二***的访问方式；
    获取模块，用于根据所述访问方式请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；
    匹配模块，用于匹配所述第二密码和第四密码，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到；
    响应模块，用于根据匹配结果响应所述登录请求，如果所述第二密码和第四密码匹配，则所述第一账号登录成功，否则登录失败。
  10. 根据权利要求9所述的服务器，其中，
    所述匹配模块包括第一运算单元，用于对所述第一密码使用所述第一不可逆算法以得到所述第四密码；
    其中所述使用所述第一不可逆算法是指使用第一哈希算法；
    或者，所述使用所述第一不可逆算法是指在被处理数据中加入第一随机字符串后使用所述第一哈希算法，所述第二***将所述第一随机字符串和所述第二密码一起发送给所述服务器；
    所述第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  11. 根据权利要求9所述的服务器，其中，
    所述服务器为公有云服务器，所述第二***为私有云服务器。
  12. 一种服务器，其中，包括：
    接收模块，用于接收第一账号的携带第一密码的登录请求；
    寻址模块，用于根据所述第一账号获得第二***的访问方式；
    获取模块，用于根据所述访问方式请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；
    匹配模块，用于匹配第五密码和第六密码，其中所述第五密码是对所述第二密码与第七密码组合而得到，所述第七密码是预保存的对所述第三密码使用第二不可逆算法得到的密码，所述第六密码是对第四密码和第八密码组合而得到，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到，所述第八密码是对所述第一密码使用所述第二不可逆算法得到；
    响应模块，用于根据匹配结果响应所述登录请求，如果所述第五密码和所述第六密码匹配，则所述第一账号登录成功，否则登录失败。
  13. 根据权利要求12所述的服务器，其中，
    所述匹配模块包括第一运算单元，用于对所述第一密码使用所述第一不可逆算法以得到所述第四密码；
    其中所述使用所述第一不可逆算法是指使用第一哈希算法；
    或者，所述使用所述第一不可逆算法是指在被处理数据中加入第一随机字符串后使用所述第一哈希算法，所述第二***将所述第一随机字符串和所述第二密码一起发送给所述服务器；
    其中所述第一哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  14. 根据权利要求12所述的服务器，其中，
    其中所述匹配模块包括第二运算单元，用于对所述第一密码使用所述第二不可逆算法以得到所述第八密码，以及对所述第三密码使用所述第二不可逆算法以得到所述第七密码；
    所述使用所述第二不可逆算法是指对被处理数据抽取部分位数后使用第二哈希算法，所述服务器保存所述抽取的位数；
    或者所述使用所述第二不可逆加密算法是指对被处理数据抽取部分位数后加入第二随机字符串，然后使用所述第二哈希算法，所述服务器保存所述抽取的位数和所述第二随机字符串；
    其中所述第二哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  15. 根据权利要求12所述的服务器，其中，
    其中所述匹配模块包括组合单元，用于对所述第二密码和所述第七密码组合以得到所述第五密码，以及对所述第四密码和所述第八密码组合以得到所述第六密码；
    其中所述组合是指对两个被处理数据进行拼接；
    或者所述组合是指对两个被处理数据进行拼接后使用第三哈希算法进行处理；
    或者所述组合是指对两个被处理数据进行拼接并加入第三随机字符串后使用所述第三哈希算法进行处理，所述服务器获得所述第五密码和所述第六密码之后删除所述第三随机字符串；
    其中所述第三哈希算法为MD5、SHA1、SHA2、SHA256、SHA512、PBKDF2其中任意一种。
  16. 一种服务器，其中，包括：
    处理器、存储器和网络通信电路，所述存储器和网络通信电路分别连接所述处理器；
    所述处理器用于运行服务程序，以通过所述网络通信电路接收第一账号的携带第一密码的登录请求；根据所述账号获得第二***的访问方式；根据所述访问方式通过所述网络通信电路请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；匹配所述第二密码和第四密码，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到；根据匹配结果响应所述登录请求，如果所述第二密码和所述第四密码匹配，则所述第一账号登录成功，否则登录失败。
  17. 一种服务器，其中，包括：
    处理器、存储器和网络通信电路，所述存储器和网络通信电路分别连接所述处理器；
    所述处理器用于运行服务程序，以通过所述网络通信电路接收第一账号的携带第一密码的登录请求；根据所述账号获得第二***的访问方式；根据所述访问方式通过所述网络通信电路请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中所述第五密码是对所述第二密码与第七密码组合而得到，所述第七密码是预保存在所述存储器上的对所述第三密码使用第二不可逆算法得到的密码，所述第六密码是对第四密码和第八密码组合而得到，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到，所述第八密码是对所述第一密码使用所述第二不可逆算法得到；根据匹配结果响应所述登录请求，如果所述第五密码和所述第六密码匹配，则所述第一账号登录成功，否则登录失败。
  18. 一种***，其中，包括：
    服务器和第二***；
    所述服务器包括：处理器、存储器和网络通信电路，所述存储器和网络通信电路分别连接所述处理器；
    所述处理器用于运行服务程序，以通过所述网络通信电路接收第一账号的携带第一密码的登录请求；根据所述账号获得第二***的访问方式；根据所述访问方式通过所述网络通信电路请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；匹配所述第二密码和第四密码，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到；根据匹配结果响应所述登录请求，如果所述第二密码和所述第四密码匹配，则所述第一账号登录成功，否则登录失败；
    所述第二***接受所述服务器发来的获取第二密码的请求并响应所述请求将所述第二密码发送给所述服务器，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到。
  19. 一种***，其中，包括：
    服务器和第二***；
    所述服务器包括：处理器、存储器和网络通信电路，所述存储器和网络通信电路分别连接所述处理器；
    所述处理器用于运行服务程序，以通过所述网络通信电路接收第一账号的携带第一密码的登录请求；根据所述账号获得第二***的访问方式；根据所述访问方式通过所述网络通信电路请求所述第二***，以获得第二密码，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到；匹配第五密码和第六密码，其中所述第五密码是对所述第二密码与第七密码组合而得到，所述第七密码是预保存在所述存储器上的对所述第三密码使用第二不可逆算法得到的密码，所述第六密码是对第四密码和第八密码组合而得到，其中所述第四密码是对所述第一密码使用所述第一不可逆算法得到，所述第八密码是对所述第一密码使用所述第二不可逆算法得到；根据匹配结果响应所述登录请求，如果所述第五密码和所述第六密码匹配，则所述第一账号登录成功，否则登录失败；
    所述第二***接受所述服务器发来的获取第二密码的请求并响应所述请求将所述第二密码发送给所述服务器，所述第二密码是对登录所述第二***所需的第三密码使用第一不可逆算法得到。
  20. 一种网络附属存储设备，其中，包括：
    处理器、硬盘和路由电路，所述硬盘和路由电路分别连接所述处理器；
    所述路由电路通过互联网连接到服务器，所述处理器用于运行服务程序，以接收所述服务器通过所述路由电路发来的获得第二密码的请求，并响应所述请求通过所述路由电路将所述第二密码发送给所述服务器，以用于对用户登录所述服务器输入的第一密码进行验证，或者与所述服务器上预保存的第七密码结合起来对所述第一密码进行验证；
    其中所述第二密码是对登录所述处理器运行的服务程序所需的第三密码使用第一不可逆算法得到，所述硬盘上保存有所述第二密码或所述第三密码；所述第七密码是对所述第三密码使用第二不可逆算法得到的密码。
PCT/CN2016/080665 2015-09-30 2016-04-29 一种登录***的方法、服务器、***及网络附属存储设备 WO2017054444A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510642607.4A CN105306456B (zh) 2015-09-30 2015-09-30 一种登录***的方法、服务器、***及网络附属存储设备
CN201510642607.4 2015-09-30

Publications (1)

Publication Number Publication Date
WO2017054444A1 true WO2017054444A1 (zh) 2017-04-06

Family

ID=55203208

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/080665 WO2017054444A1 (zh) 2015-09-30 2016-04-29 一种登录***的方法、服务器、***及网络附属存储设备

Country Status (2)

Country Link
CN (1) CN105306456B (zh)
WO (1) WO2017054444A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112559991A (zh) * 2020-12-21 2021-03-26 深圳市科力锐科技有限公司 ***安全登录方法、装置、设备及存储介质
CN113139200A (zh) * 2021-05-11 2021-07-20 中国电子科技集团公司第三十研究所 一种密码快速破解方法、***、计算机程序及存储介质

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105306456B (zh) * 2015-09-30 2019-02-22 深圳市先河***技术有限公司 一种登录***的方法、服务器、***及网络附属存储设备
CN106453238B (zh) * 2016-08-22 2020-02-21 深圳市先河***技术有限公司 登录方法和***、电子终端、公网服务器及私有云设备
CN106453347A (zh) * 2016-10-31 2017-02-22 努比亚技术有限公司 一种用于云服务的用户登录装置及方法
CN106657110B (zh) * 2016-12-30 2020-12-04 北京奇虎科技有限公司 一种流数据的加密传输方法和装置
CN107317804B (zh) * 2017-06-19 2020-12-29 努比亚技术有限公司 私有云加密数据访问方法、终端及存储介质
CN107395344A (zh) * 2017-07-18 2017-11-24 北京深思数盾科技股份有限公司 用户信息保护方法及装置
CN107920081B (zh) * 2017-12-01 2020-08-14 华为技术有限公司 登录认证方法及装置
CN109753787B (zh) * 2019-01-21 2021-04-27 山西晟视汇智科技有限公司 一种具有唯一性的设备登录密码生成及管理方法、装置、***、存储设备和终端
CN112671841B (zh) * 2020-12-10 2022-02-15 清研灵智信息咨询(北京)有限公司 基于微服务技术架构的数据安全管理方法及***

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469080A (zh) * 2010-11-11 2012-05-23 中国电信股份有限公司 实现通行证用户安全登录应用客户端的方法和***
CN103067406A (zh) * 2013-01-14 2013-04-24 暨南大学 一种公有云与私有云之间的访问控制***及方法
CN103259663A (zh) * 2013-05-07 2013-08-21 南京邮电大学 一种云计算环境下的用户统一认证方法
CN103975333A (zh) * 2011-12-01 2014-08-06 国际商业机器公司 跨***安全登录
US8813174B1 (en) * 2011-05-03 2014-08-19 Symantec Corporation Embedded security blades for cloud service providers
CN105306456A (zh) * 2015-09-30 2016-02-03 深圳市先河***技术有限公司 一种登录***的方法、服务器、***及网络附属存储设备

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739708B (zh) * 2011-04-07 2015-02-04 腾讯科技（深圳）有限公司 一种基于云平台访问第三方应用的***及方法
CN104917748B (zh) * 2015-04-14 2019-09-20 百度在线网络技术（北京）有限公司 一种用于对密码信息进行换算和处理的方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102469080A (zh) * 2010-11-11 2012-05-23 中国电信股份有限公司 实现通行证用户安全登录应用客户端的方法和***
US8813174B1 (en) * 2011-05-03 2014-08-19 Symantec Corporation Embedded security blades for cloud service providers
CN103975333A (zh) * 2011-12-01 2014-08-06 国际商业机器公司 跨***安全登录
CN103067406A (zh) * 2013-01-14 2013-04-24 暨南大学 一种公有云与私有云之间的访问控制***及方法
CN103259663A (zh) * 2013-05-07 2013-08-21 南京邮电大学 一种云计算环境下的用户统一认证方法
CN105306456A (zh) * 2015-09-30 2016-02-03 深圳市先河***技术有限公司 一种登录***的方法、服务器、***及网络附属存储设备

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112559991A (zh) * 2020-12-21 2021-03-26 深圳市科力锐科技有限公司 ***安全登录方法、装置、设备及存储介质
CN113139200A (zh) * 2021-05-11 2021-07-20 中国电子科技集团公司第三十研究所 一种密码快速破解方法、***、计算机程序及存储介质
CN113139200B (zh) * 2021-05-11 2023-01-31 中国电子科技集团公司第三十研究所 一种密码快速破解方法、***、计算机程序及存储介质

Also Published As

Publication number Publication date
CN105306456B (zh) 2019-02-22
CN105306456A (zh) 2016-02-03

Similar Documents

Publication Publication Date Title
WO2017054444A1 (zh) 一种登录***的方法、服务器、***及网络附属存储设备
CN107682331B (zh) 基于区块链的物联网身份认证方法
US8627417B2 (en) Login administration method and server
WO2016169410A1 (zh) 登录方法、服务器和登录***
JP3466025B2 (ja) コンピュータ・ネットワークにおけるマスカレード・アタック保護方法及びその装置
WO2020220413A1 (zh) 个人信息的零知识证明方法、***及存储介质
US8220032B2 (en) Methods, devices, and computer program products for discovering authentication servers and establishing trust relationships therewith
US9237021B2 (en) Certificate grant list at network device
US20150341324A1 (en) Transferring encrypted and unencrypted data between processing devices
WO2021003975A1 (zh) 网关接口测试方法、终端设备、存储介质及装置
CN111416807A (zh) 数据获取方法、装置及存储介质
WO2021150032A1 (en) Method for providing authentication service by using decentralized identity and server using the same
US8515996B2 (en) Secure configuration of authentication servers
WO2021072881A1 (zh) 基于对象存储的请求处理方法、装置、设备及存储介质
US20180053009A1 (en) Method for secure data management in a computer network
WO2019182377A1 (ko) 블록체인 기반 암호화폐의 트랜잭션에 이용되는 주소 정보 생성 방법, 전자 장치 및 컴퓨터 판독 가능한 기록 매체
WO2019125041A1 (ko) 블록체인을 이용한 개인정보 분리 후 분산저장을 통한 인증 시스템
WO2019205288A1 (zh) 连接建立方法、***、设备及计算机可读存储介质
WO2015178597A1 (ko) Puf를 이용한 비밀키 업데이트 시스템 및 방법
WO2020211348A1 (zh) 用户信息加解密方法、***和计算机设备
CN112733129B (zh) 一种服务器带外管理的可信接入方法
WO2018004114A2 (ko) 프록시 서비스 제공을 위한 프록시 인증시스템 및 인증방법
JP4065850B2 (ja) 移動ネットワーク環境におけるデータトラフィックの保護方法
WO2022055301A1 (ko) 단체용 인증모듈의 온보딩 방법, 장치 및 프로그램
CN113347157B (zh) 一种基于SM系列加密算法的Web应用加密***及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16850069

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16850069

Country of ref document: EP

Kind code of ref document: A1