Password management method and password management system

Abstract

The invention relates to a password management method and a password management system, and relates to the technical field of Internet password management. The system comprises computer equipment and external equipment, and the computer equipment is in communication connection with the external equipment through an external interface of the computer equipment. In the process of password-based identity verification, through signal interaction and function setting of the computer equipment and the external equipment, the problem of secret leakage possibly encountered during data migration of password data is solved, and the data confidentiality is greatly enhanced. And forced asymmetric verification of integrity and non-repudiation of identity information is added.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet password management, and in particular to a password management method and a password management system. Background Art

[0002] Password management technology is used to store website usernames and passwords. When a user visits the website, the client reads the information in the electronic key and automatically fills in the input box.

[0003] In the related art, the browser has a password storage and automatic filling function. After the password is entered for the first time, the password will be stored in the disk storage area of ​​the local machine, and the user name and password can be automatically filled in the next time the website is visited. At the same time, if the logged-in user can synchronize these password information remotely.

[0004] However, the synchronization method in the related art is based on the computer device itself, without considering the identity authentication process of the operator associated with the computer device. That is, the automatic password storage and calling method in the related art has security loopholes. Summary of the invention

[0005] The present invention relates to a password management method and a password management system, which can be combined with an external device to achieve secure management of passwords. The technical solution is as follows: On the one hand, a password management method is provided, which is applied to a password management system, and the password management system includes a computer device and an external device; The computer device and the external device are communicatively connected via the external interface of the computer device; The method includes: The computer device generates a password acquisition instruction, the password acquisition instruction includes a computer identifier corresponding to the computer device, the computer identifier includes a local feature identifier, a software information identifier, and a signature information identifier; and sends the password acquisition instruction to an external device; The external device receives the password acquisition instruction; verifies the password acquisition instruction to obtain a password verification result; in response to the password verification result indicating that the password verification is passed, obtains the instruction parsing result; obtains the password key corresponding to the password acquisition instruction based on the instruction parsing result; and feeds back the password key to the computer device; The computer device receives the password key; generates password backup information based on the password key combined with the computer identification, and the password backup information is associated with the password database pre-stored in the computer device. The computer identification includes the local feature identification, the software feature identification and the signature information identification.

[0006] In an optional embodiment, the password management system further includes a registration machine server; The registration machine server is respectively connected to the computer device and the external device for communication; The method also includes: The registration machine server obtains computer device information and external device information; generates a registration public key based on the computer device information and the external device information; sends the registration public key to the external device; the external device receives the registration public key and synchronizes the registration public key with the computer device.

[0007] In an optional embodiment, the method further comprises: The registration machine server generates a PIN code associated with the computer device based on the registration public key; and sends the PIN code to the computer device; The computer device is used to perform PIN code verification and generate a password acquisition instruction in response to passing the PIN code verification.

[0008] In an optional embodiment, the external device verifies the password acquisition instruction to obtain a password verification result, including: The password acquisition instruction is verified based on its own private key to obtain the password verification result.

[0009] In an optional embodiment, the computer device is further used to generate computer device binding information based on the PIN code; and store the computer device binding information.

[0010] In an optional embodiment, the computer device generates a password acquisition instruction, including: The computer device obtains a password input signal, which is a signal generated by operating an input window of a browser program; based on the password input signal, a password acquisition instruction is generated in a password management program through WSS (WebSocket Secure) communication.

[0011] In an optional embodiment, after the computer device obtains the password input signal, the following steps are included: Extract password input signals through browser plug-ins.

[0012] In an optional embodiment, the external device obtains the password key corresponding to the password acquisition instruction based on the instruction parsing result, including: The external device obtains password information from the password database of the external storage device based on the instruction parsing result; obtains key pair storage information from the key pair storage database based on the instruction parsing result and the password acquisition instruction; and verifies whether the key pair storage information and the password information correspond.

[0013] In an optional embodiment, the external device is implemented as a USB device.

[0014] In another aspect, a password management system is provided, the password management system comprising a computer device and an external device; The computer device and the external device are communicatively connected via the external interface of the computer device; The password management system is used to execute any of the above password management methods.

[0015] The beneficial effects brought about by the technical solution provided by the present invention include at least: In the process of password-based identity authentication, the signal interaction and function settings between the computer device and the external device solve the problem of password data leakage during data migration, greatly enhancing data confidentiality. Add mandatory asymmetric verification of the integrity and non-repudiation of identity information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A schematic diagram of the structure of a password management system provided by an exemplary embodiment of the present application is shown.

[0018] Figure 2 A schematic diagram of the structure of another password management system provided by an exemplary embodiment of the present application is shown.

[0019] Figure 3 A schematic diagram of the structure of another password management system provided by an exemplary embodiment of the present application is shown.

[0020] Figure 4 A flowchart of a password management method provided by an exemplary embodiment of the present application is shown.

[0021] Figure 5 A schematic diagram of a process for generating public and private keys by a registration machine server provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0023] Figure 1 A schematic diagram of a password management system provided by an exemplary embodiment of the present application is shown. Figure 1, the password management system includes a computer device 110 and an external device 120, the computer device and the external device are communicatively connected via an external interface of the computer device; In one example, the external device is implemented as a USB device, and the external device is connected to the computer device via a USB interface. Optionally, the computer device is implemented as a device such as a personal computer.

[0024] In this case, Figure 2 A schematic diagram of a password management system provided by an exemplary embodiment of the present application is shown. Figure 2 The system includes a computer device 210, an external device 220, and a registration machine server 230. The registration machine server 230 is a third-party server independent of the computer device and the external device, and has the function of registering the information of the computer device and the external device. In the embodiment of the present application, the registration machine server only has an interactive relationship with the external device.

[0025] Figure 3 A schematic diagram of the structure of another password management system provided by an exemplary embodiment of the present application is shown. In the password management system, a computer device 310 includes a browser application module 311, a browser plug-in module 312, a password management program module 313, and an information binding module 314; an external device 320 includes a password database 321, a key pair storage database 322, an interface 323, an encryption algorithm module 324, and a registered public key list storage module 325. A registration machine server 230 includes a public key management module 231, a private key management module 232, and a PIN code generation module 323.

[0026] Figure 4 A flowchart of a password management method provided by an exemplary embodiment of the present application is shown, in which the method is applied to Figures 1 to 3 Taking any system as an example, the method includes: Step 401: The computer device generates a password acquisition instruction.

[0027] In the embodiment of the present application, the computer device is a device that can log in to the browser, and the password acquisition instruction can be implemented as a login password for the web page.

[0028] Step 402: The computer device sends a password acquisition instruction to the external device.

[0029] This process is the process of sending the password acquisition instruction.

[0030] Step 403: the external device receives a password acquisition instruction.

[0031] Step 404: the external device verifies the password acquisition instruction and obtains a password verification result.

[0032] This process is a process of verifying the authenticity of the password acquisition instruction to determine the correctness of the connection between the external device and the computer device.

[0033] Step 405 : The external device obtains the instruction parsing result in response to the password verification result indicating that the password verification is successful.

[0034] In the embodiment of the present application, the instruction parsing result is used to indicate the specific content of the password acquisition instruction of the computer device. Optionally, the content corresponds to the browser identifier in the browser software of the computer device.

[0035] Step 406: The external device obtains the password key corresponding to the password acquisition instruction based on the instruction parsing result.

[0036] In an embodiment of the present application, the external device obtains password information from the password database based on the instruction parsing result; and obtains key pair storage information from the key pair storage database based on the instruction parsing result and the password acquisition instruction; finally, the password key is generated based on the key pair storage information and the password information. In one example, the key pair storage information is implemented in the form of an address identification of a storage space. After the key storage pair information and the password information are matched to a corresponding degree, the password key can be generated.

[0037] Step 407: The external device feeds back the password key to the computer device.

[0038] This process is the feedback process of the password key.

[0039] In step 408, the computer device receives the password key.

[0040] Step 409: The computer device generates password backup information based on the password key.

[0041] In the embodiment of the present application, the password backup information includes information related to the use of the password key this time. It should be noted that in the embodiment of the present application, the password backup information is associated with the password database pre-stored in the computer device, and the computer identification includes the local feature identification, software feature identification and signature information identification. In one example, the computer identification includes the network card MAC value, CPU serial number, hard disk serial number, motherboard serial number, and PUF information.

[0042] In the embodiment of the present application, the password backup information is associated with a password database pre-stored in the computer device.

[0043] In some embodiments of the present application, as shown above, the registration machine server is used to confirm and implement the association relationship between the computer device and the external device. Figure 5 A schematic diagram of a process for generating public and private keys by a registration machine server provided by the present application is shown. The process is described by taking the application of the method in the registration machine server as an example. The process includes: Step 501, obtaining computer device information and external device information.

[0044] In the embodiment of the present application, the computer device information is associated with the corresponding identifier of the computer, the external device information is associated with the identifier of the external device, and the computer device information is associated with the external device information. In the embodiment of the present application, the computer device information is the processor of the computer device and the non-clonable information in the memory.

[0045] Step 502: Generate a registration public key based on the computer device information and the external device information.

[0046] In the embodiment of the present application, the registration public key includes a public-private key pair of the identification algorithm and a registration code. It should be noted that the computer device information is the computer identification, and the asymmetric key can be generated by performing the identification algorithm operation through the computer identification. After the registration machine server signs with the asymmetric key, the registration public key is generated, and the registration public key can be configured with a private key.

[0047] Step 503: Send the registration public key to the external device.

[0048] That is, in the embodiment of the present application, in order to ensure the verification security during the communication process, the registration public key is only sent to the external device for storage through the registration machine server. Optionally, when the external device is connected to the computer device, after the communication connection relationship is established between the computer device and the external device, the external device is verified, and the public key is synchronously registered with the computer device, and a corresponding private key is generated for interaction. Optionally, the registration public key is synchronously sent to the computer device.

[0049] In one example, if the public key is in the device's registered public key list and the signature verification succeeds, the permission acquisition is returned successfully. After that, the password management program reads the registered public key from the encryption area, and then uses this public key to encrypt a random number R, and obtains the private key from the specific container of the external device to decrypt it. If the result is a random number R, it means that the match is correct. At this point, both parties recognize each other's identity.

[0050] In combination with the above description, in some embodiments of the present application, the registration machine server generates a PIN code associated with the computer device based on the registration public key; and sends the PIN code to the computer device. In this case, the computer device is used to perform PIN code verification, and generates a password acquisition instruction in response to passing the PIN code verification. At the same time, in some other embodiments of the present application, the computer device and the external device will perform synchronous PIN code verification to further ensure the security of the registration process. In the user side interface, the above-mentioned PIN code verification process can be implemented as an integrated process or as separate processes. It should be noted that when the computer device starts the management program, it is necessary to enter the PIN code, that is, the PIN code is an important basis information for the password to encrypt local data.

[0051] Correspondingly, the external device will verify the password acquisition instruction based on its own private key to obtain the password verification result. In the embodiment of the present application, the computer device has a local storage function, and the computer device generates computer device binding information based on the PIN code; and stores the computer device binding information.

[0052] In the embodiment of the present application, the process of the computer device generating a password acquisition instruction includes the computer device receiving a password input signal, where the password input signal is a signal generated by operating an input window of a browser program. In this case, the user will perform a pre-verification process of the password acquisition instruction by inputting a password, that is, the computer device generates a password acquisition instruction in the password management program through WSS communication based on the password input signal.

[0053] In this case, the computer device will use the browser plug-in to extract the location of the username and password input boxes through image-based AI recognition, and then obtain the password input signal.

[0054] In one example, a computer device first uses a traversal program to check whether there is an input box on the current page; then the system's built-in AI will crop the current web page to identify whether there is a user name input box and a login box; if so, an icon is added to the box as the user's active click location.

[0055] Optionally, after the computer device receives the password input signal, the computer device also extracts the password input signal through the browser plug-in program. That is, when the browser is configured with the browser plug-in program, the password input signal is obtained.

[0056] It should be noted that in various embodiments of the present application, the external device is implemented as a USB device.

[0057] The above are only optional embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A password management method, characterized in that: The method is applied to a password management system, which includes a computer device and an external device; Wherein, the external device is implemented as a USB device; The computer device is communicatively connected with the external device via an external interface of the computer device; The method comprises: The computer device generates a password acquisition instruction, wherein the password acquisition instruction includes password verification information; and sends the password acquisition instruction to the external device; The external device receives the password acquisition instruction; verifies the password acquisition instruction to obtain a password verification result; in response to the password verification result indicating that the password verification is passed, obtains an instruction parsing result; obtains a password key corresponding to the password acquisition instruction based on the instruction parsing result; and feeds back the password key to the computer device; The computer device receives the password key; based on the password key and in combination with the computer identification, password backup information is generated, the password backup information is associated with a password database pre-stored in the computer device, the computer identification includes a local feature identification, a software feature identification, and a signature information identification; The password management system also includes a registration machine server; The registration machine server is respectively connected to the computer device and the external device for communication; The method further comprises: The registration machine server obtains computer device information and external device information; generates a registration public key based on the computer device information and external device information; and sends the registration public key to the external device; The registration public key receives the registration public key; synchronizes the registration public key to the computer device; The method further comprises: The registration machine server generates a PIN code associated with the computer device based on the registration public key; and sends the PIN code to the computer device; The computer device is used to perform PIN code verification, and generate the password acquisition instruction in response to passing the PIN code verification.

2. The password management method according to claim 1, characterized in that: The external device verifies the password acquisition instruction to obtain a password verification result, including: The external device verifies the password acquisition instruction based on its own private key to obtain the password verification result.

3. The password management method according to claim 1, characterized in that: The method further comprises: The computer device generates computer device binding information based on the PIN code; and stores the computer device binding information.

4. The password management method according to claim 1, characterized in that: The computer device generates a password acquisition instruction, including: The computer device receives a password input signal, which is a signal generated by operating an input window of a browser program; based on the password input signal, the password acquisition instruction is generated in a password management program through WSS communication.

5. The password management method according to claim 4, characterized in that: After receiving the password input signal, the computer device includes: The password input signal is obtained through a browser plug-in program.

6. The password management method according to claim 1, characterized in that: The external device obtains a password key corresponding to the password acquisition instruction based on the instruction parsing result, including: The external device obtains password information from the password database stored in the external device based on the instruction parsing result; and obtains key pair storage information from the key pair storage database based on the instruction parsing result and the password acquisition instruction; and verifies whether they correspond based on the key pair storage information and the password information.

7. A password management system, characterized in that: The password management system includes computer equipment, external equipment and a registration machine server; The computer device is communicatively connected with the external device via an external interface of the computer device; The registration machine server is respectively connected to the computer device and the external device for communication; The password management system is used to execute the password management method according to any one of claims 1 to 6.

Images