Method and system for key recovery based on password strength assignment and threshold combination

Abstract

The application discloses a key recovery method and system based on password strength distribution and threshold combination, relates to the password management and cryptography field, and comprises four stages of initialization, recovery password registration, recovery password revocation and key recovery. The initialization stage constructs secret sharing public parameters and a recovery bucket storage structure. In the registration stage, a candidate recovery password is assigned with a corresponding number of real shares according to the strength of the candidate recovery password, random data is filled to form fixed-length recovery data, and the recovery data is stored in a corresponding recovery bucket in an encrypted manner. In the revocation stage, the recovery permission of a specified recovery password can be cleared, and the storage state is synchronously updated. When a user forgets a master password, an effective share is extracted by inputting a registered recovery password, and the password library key is reconstructed after the cumulative threshold is reached, so that the password library access permission is recovered. The application does not require the user to additionally remember a special recovery password, considers the recovery availability and the cryptographic security, and has good cloud observation resistance.

Description

Technical Field

[0001] This invention relates to the field of password management and cryptography, specifically to a key recovery method and system based on password strength allocation and threshold combination. Background Technology

[0002] With the widespread adoption of internet services, users need to manage a large number of account login credentials. Password managers are widely used for password generation, storage, and cross-device synchronization. Mainstream password managers use a master password to encrypt the password database end-to-end to prevent the server from obtaining users' plaintext passwords. However, the master password also serves as the core credential for access authentication and decryption. Once forgotten by the user, even if the server completes user authentication, it cannot directly recover the encrypted password database data. This has become a common technical problem restricting the user experience and widespread adoption of password managers.

[0003] Currently, password recovery mainly falls into three technical categories: First, account recovery based on email and SMS, which can only reset account access permissions and cannot decrypt password databases protected by the master password; second, schemes based on recovery codes and auxiliary keys, requiring users to separately safeguard high-entropy recovery secrets, which fail to recover if lost; and third, schemes based on trusted devices and local security environments, which rely on specific terminal hardware and are ineffective when devices are lost or used across platforms. For example, invention patent CN107359998A discloses a method for establishing and operating a portable intelligent password management system, but its recovery process relies on mobile terminal devices, and the recovery capability immediately fails after the device is damaged or lost. Another example is invention patent CN113810184B, which discloses a device password hosting method and system based on dynamic threshold multi-secret sharing, but it is geared towards device password hosting scenarios, does not utilize user-saved passwords as recovery resources, and does not differentiate recovery weights based on password strength, making it unsuitable for scenarios where the master password of the password manager is forgotten.

[0004] The technical problem with existing technologies is that they cannot achieve threshold-based key recovery by combining the strength differences of user-stored passwords without relying on additional physical media, dedicated recovery secrets, or specific terminals. Users have to bear additional secret storage burdens, or are limited by the device usage scenarios, and cannot improve the recoverability of the password database while ensuring anti-guessing security.

[0005] Therefore, there is an urgent need to propose a key recovery technology solution that is adapted to the password manager scenario. This solution should utilize the user's existing password resources to achieve secure and reliable password database key recovery without increasing the user's additional management burden, thereby improving the practicality of the password manager. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a key recovery method and system based on password strength allocation and threshold combination. By allocating secret shares according to password strength differentiation and combining a threshold-type secret sharing algorithm with an equal-length recovery bucket storage mechanism, users can reuse existing passwords in the password database as recovery credentials. When the master password is forgotten, the password database key can be reconstructed by combining multiple passwords. At the same time, the cloud-based unobservability of the recovery configuration is guaranteed, taking into account both ease of recovery and cryptographic security.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: On one hand, a key recovery method based on password strength allocation and threshold combination, the method comprising the following steps: S1. Initialization phase: Obtain the password database key, split the password database key into n recovery fragments according to the preset recovery threshold t, construct the recovery storage structure, form the basic architecture of threshold-based secret splitting, and support multi-password combination recovery; S2, Password Recovery Registration Stage: Receive candidate recovery passwords selected by the user from the saved password database. Evaluate the password strength of each candidate recovery password to obtain a corresponding strength value, quantify the anti-guessing ability of the candidate recovery passwords, and provide a basis for differentiated allocation. Determine the number of recovery segments that can be allocated to each candidate recovery password based on the strength value. Allocate the corresponding number of recovery segments to each candidate recovery password and generate corresponding recovery data, so that the recovery contribution matches the password security strength, balancing security and usability. After associating the recovery data with user identity information and candidate recovery passwords, store it in encryption to achieve binding encryption of recovery data and prevent unauthorized access and location. S3, Recovery Password Revocation Phase: Receive the registered recovery password selected by the user, clear the recovery data stored corresponding to the recovery password, revoke the recovery permission, realize dynamic management of recovery permissions, and adapt to password change scenarios; S4. Key recovery stage: Receive the user's input recovery password to be verified, locate and decrypt the corresponding recovery data in combination with the user's identity information, extract and accumulate valid recovery fragments, aggregate multiple recovery resources, complete the collection of valid shares, and when the number of accumulated valid recovery fragments reaches the preset recovery threshold t, reconstruct the password library key, and then recover the password library key. The key reconstruction is completed through the threshold combination mechanism, without relying on a single recovery credential.

[0008] Furthermore, S1 specifically includes: Initialize security parameters and cryptographic algorithms, including the Shamir secret sharing algorithm, hash function, password-based key derivation function, bucket encryption algorithm and authentication encryption algorithm, to build standardized cryptographic basic components and ensure the cryptographic security of the scheme; The Shamir secret sharing algorithm is used to split the password base key into n secret shares as recovery fragments. A recovery threshold t is set so that no less than t valid shares can reconstruct the password base key. Threshold fault tolerance is achieved based on a mature secret sharing mechanism to ensure the correctness of the share combination. Initialize several recovery buckets of equal length, each recovery bucket is initialized as a random bit string, and the distribution state of the valid recovery data is hidden through storage units of uniform format; An internal protection key is generated to perform authentication encryption on all secret shares to obtain share ciphertext. The password library key is used to perform authentication encryption on the internal state to obtain metadata ciphertext. A recovery state containing the recovery bucket, share ciphertext, and metadata ciphertext is generated and stored. Multi-level security protection is achieved through a layered encryption mechanism, while also supporting seamless storage on the server side.

[0009] Furthermore, in S2, the password strength assessment outputs the number of candidate recovery passwords that resist guessing as a strength value, and uses a quantifiable anti-guessing index as a strength evaluation standard to improve the scientific nature of the allocation. Based on a preset anti-guessing score, candidate recovery passwords with an anti-guessing score lower than the score are not assigned recovery fragments, thus filtering out weak passwords and preventing low-security passwords from reducing the overall recovery mechanism's resistance to attacks. Candidate recovery passwords with a higher resistance to guessing than the benchmark are assigned different numbers of recovery fragments according to the resistance to guessing level, so as to achieve a positive correspondence between strength and recovery weight, with strong passwords bearing more recovery capabilities; When constructing the recovery data, for allocating Candidate recovery password supplement for each recovery segment A number of random padding points are used to form a fixed-length recovery data, and the random padding points and the real recovery fragments use the same data format. The real share quantity is hidden by equal-length padding to prevent side-channel analysis from inferring password strength.

[0010] Furthermore, in S2, the corresponding bucket location index is obtained by derivation calculation of the candidate recovery password and user identity information through key. Before registration, it is detected whether the bucket location is occupied by other recovery passwords. If it is occupied, the registration is rejected to avoid multiple password storage conflicts. At the same time, the correspondence between recovery passwords and storage locations is hidden through derivation mapping. After the registration and revocation of the recovery password are completed, a re-randomization process is performed on the recovery buckets corresponding to all registered recovery passwords. The metadata ciphertext is regenerated and the recovery status is updated to eliminate the observable features of storage status changes and prevent the operation behavior of inferring the recovery password through status changes.

[0011] Furthermore, S4 specifically includes: Process each input recovery password to be verified one by one, decrypt the corresponding recovery bucket, and then extract the previous password. We collect valid recovered fragments and add them to the share set for accumulation, accurately extract valid shares, filter and fill data to ensure the accuracy of share aggregation; After accumulation, the secret reconstruction algorithm is called to generate candidate password database keys. The correctness of the candidate password database keys is verified by authentication and decryption of the metadata ciphertext. The correctness verification is completed through authentication and decryption to avoid subsequent decryption anomalies caused by incorrect keys. If the verification is successful, the password library key is output to complete the recovery; if the verification fails, a recovery failure result is returned, forming a closed-loop recovery verification mechanism to ensure the reliability of the recovery result.

[0012] On the other hand, the key recovery system based on password strength allocation and threshold combination is applicable to key recovery methods based on password strength allocation and threshold combination. The system includes a password recovery management module, a password strength evaluation module, and a recovery execution module deployed on the client, as well as a recovery state storage module deployed on the server. It adopts an end-to-cloud separation architecture, with core cryptographic operations executed on the client, reducing the risk of sensitive information leakage. The password recovery management module is used to execute the initialization process, split the password library key into n recovery fragments according to the preset recovery threshold t, construct the recovery storage structure, and initiate the registration and revocation operations of the recovery password. It undertakes the core control function of the recovery mechanism and coordinates the status flow of the entire process. The password strength assessment module is used to assess the strength of candidate recovery passwords to obtain strength values, and output the number of recovery segments that can be allocated corresponding to the candidate recovery password, providing quantitative strength assessment capabilities and providing data support for differentiated allocation. The recovery password management module is also used to allocate a corresponding number of recovery fragments to each candidate recovery password according to the number of recovery fragments, generate recovery data and encrypt it before synchronizing it to the recovery status storage module, complete the share allocation and encrypted storage, and realize the secure landing of recovery resources; The recovery execution module is used to receive the recovery password to be verified input by the user, obtain the corresponding recovery data from the recovery status storage module and extract the valid recovery fragments. When the number of valid recovery fragments reaches the threshold t, the password library key is reconstructed, the share aggregation and key reconstruction of the recovery stage are performed, and the final recovery process is completed.

[0013] Furthermore, the client also includes a password database access module and a local decryption module; The password database access module is used to unlock, view, edit and synchronize the password database after the user enters the master password, supporting the normal daily use of the password database and compatible with the existing password manager functions; The local decryption module is used to perform local decryption on the password database ciphertext to restore access after the password database key is recovered. It also supports resetting the master password and reconfiguring the recovery mechanism, completing the permission persistence after recovery, and supporting subsequent reconfiguration of the recovery mechanism. The server also includes a password database storage module, which stores the encrypted password database ciphertext and account synchronization data. The server does not hold the user's plaintext password or the plaintext password database key, and follows the end-to-end encryption principle to ensure the data security boundary of the server.

[0014] Furthermore, the recovery state storage module is equipped with several recovery buckets of the same length. The recovery buckets are initialized with random bit strings. The location of valid data is masked by storage units of a uniform format, thereby improving the security of the storage side. After the recovered data is encrypted with the candidate recovery password and the encryption key derived from the user's identity, it is stored in the corresponding recovery bucket obtained by mapping, realizing the cryptographic binding between the password and the storage location, and preventing unauthorized location and access. After the registration and cancellation operations are completed, the recovery password management module performs re-randomization processing on the recovery bucket corresponding to the registered recovery password, updates the encrypted metadata and synchronizes it to the recovery status storage module, eliminates the side-channel characteristics of the operation behavior, and prevents the recovery password information from being inferred through changes in the storage status.

[0015] Furthermore, the password strength assessment module outputs the number of guess-resistant candidates for recovery passwords as a strength metric, using the industry-standard number of guess-resistant candidates as a quantitative indicator to ensure the objectivity and rationality of the strength assessment. The system presets a resistance to guessing benchmark. Passwords with a resistance to guessing below the benchmark are not eligible for recovery. This sets an entry threshold to prevent weak passwords from lowering the overall security level of the recovery mechanism. Passwords with a higher resistance to guessing than the baseline are assigned a corresponding number of recovery fragments according to the resistance to guessing level, establishing a positive mapping between strength and weight, and achieving a balance between security and availability.

[0016] Furthermore, the system supports the registration, revocation, and replacement of recovery passwords. The replacement operation is achieved by first revoking the original recovery password and then registering a new recovery password, supporting the full lifecycle management of recovery passwords and adapting to dynamic changes in user passwords. The system supports parameterized configuration of recovery threshold, number of recovery buckets, total number of secret shares, strength mapping rules, and re-randomization strategy, adapting to different security levels and product deployment requirements. It has flexible parameter adjustment capabilities, improving the engineering adaptability and scenario coverage of the solution.

[0017] Compared with existing technologies, this key recovery method and system based on password strength allocation and threshold combination has the following advantages: First, this invention constructs a key recovery mechanism by matching the strength of the recovery password with a corresponding number of secret shares and combining it with a threshold-based secret sharing algorithm. This allows users to directly select various passwords already stored in the password database as recovery credentials, eliminating the need to separately memorize dedicated recovery passwords. At the same time, passwords of different strengths bear different weights in the recovery process. Only when the accumulated effective shares reach the recovery threshold can the password database key be reconstructed. Thus, while ensuring that password database access can be successfully restored after the master password is forgotten, this invention effectively reduces the risk of weak passwords being exploited and cracked, balancing the usability and security of the recovery process.

[0018] Second, by employing a randomly initialized equal-length recovery bucket storage structure, combined with fixed-length encrypted recovery data and post-operation re-randomization processing, this invention enables the cloud side to be unable to distinguish between valid and empty recovery buckets, and also to identify user registration and cancellation operations through state changes. All recovery data is stored in encrypted form, and the cloud server does not hold any plaintext passwords or key information, thereby further enhancing the recovery mechanism's resistance to side-channel analysis, preventing the leakage of user recovery configuration information, and achieving end-to-end password recovery security protection.

[0019] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination or study, or may be learned from the practice of the invention. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is an overall flowchart of the present invention; Figure 2 This is a diagram of the method architecture of the present invention. Detailed Implementation

[0022] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0023] The key recovery method based on password strength allocation and threshold combination provided by this invention generally includes an initialization phase, a password recovery registration phase, a password recovery revocation phase, and a key recovery phase (e.g., Figure 1(As shown). The initialization phase is a prerequisite for the entire recovery mechanism and must be completed before other phases. The password registration phase, password revocation phase, and key recovery phase can be executed multiple times according to the user's actual needs after the initialization phase is completed. There is no strict order restriction between the three phases. Users can register multiple recovery passwords in sequence, revoke registered recovery passwords at any time, and initiate the key recovery process at any time after forgetting the master password.

[0024] like Figure 2 As shown, the system includes a password database access module, a password recovery management module, a password strength assessment module, a recovery execution module, and a local decryption module deployed on the client, as well as a password database storage module and a recovery status management module deployed on the cloud server.

[0025] The client refers to the actual password manager terminal entity used by the user, typically corresponding to the password manager application in the user's mobile phone, tablet, laptop, or browser environment. The cloud server refers to the server entity that provides remote storage and state synchronization services for the password manager. The client and the cloud server work together to form an end-to-end encrypted password management system. During normal use, the client accesses the password database using the master password and synchronizes the encrypted password database to the cloud server; during the recovery configuration phase, the client selects candidate recovery passwords from the stored passwords, allocates recovery shares based on password strength, and stores the corresponding recovery data encrypted on the cloud server; during the recovery phase, the client reads the corresponding recovery bucket from the cloud server based on multiple recovery passwords entered by the user and reconstructs the password database key.

[0026] The password database storage module is used to store the user's password database ciphertext and account synchronization data. This module does not directly hold the user's plaintext master password, plaintext stored password, or plaintext password database key.

[0027] The recovery status management module is used to store recovery status information related to the password database recovery mechanism, including recovery parameters, encrypted recovery metadata, recovery records, and protected share allocation status.

[0028] In this embodiment, the purpose of the initialization phase is to establish the basic cryptographic parameters and storage structure required for the recovery mechanism. Before obtaining the password database key, the system first initializes or loads the current user's password database instance to ensure that the password database is in an operational state, and then obtains the password database key used for encryption from that instance.

[0029] Restore password management module initialization security parameters This parameter determines the security strength of subsequent cryptographic operations. The Shamir secret-sharing algorithm is set up, where each share is represented as a dot. Its value range is The core construction of Shamir's secret-sharing algorithm is as follows: For finite fields Randomly select one Polynomial of degree: ; The constant term That is, the password vault key k to be protected, and the coefficient Elements are randomly selected over a finite field. The n secret shares are determined by computing a polynomial at different points. The value obtained on is: ; in Let be distinct non-zero elements over a finite field. Any t shares can be used to reconstruct the polynomial using Lagrange interpolation. Thus restoring the constant term : ; Set two hash functions h and h. The output range of h is , The output range is ,in To restore the total number of buckets. Set the password-based key derivation function. This function is used to derive an encryption key from the user's password and identity: ; Set the bucket encryption algorithm This algorithm employs an authentication encryption mode for encrypting and decrypting data written to the recovery bucket. (Setting the authentication encryption algorithm...) This is used for authentication and encryption of secret shares and internal states with associated data. The recovery threshold t, the number of buckets l, the total number of secret shares n, and the password evaluation function I in the password strength evaluation module are set. These parameters together constitute the common parameters. This parameter remains public during system operation: ; The password evaluation function I outputs the number of shares corresponding to a candidate recovery password based on its strength. The design principle of this function is: passwords with higher resistance to guessing are allocated more shares, passwords with lower resistance are allocated fewer shares, and passwords with excessively low resistance are not allocated any shares. Specifically, the system presets a baseline for resistance to guessing. Passwords with a resistance to guessing greater than this threshold are not eligible for recovery. The password is assigned a corresponding number of shares based on its anti-guessing level. The share allocation rule can be expressed as: ; in Let w represent the number of passwords that resist guessing, and p represent the number of actual shares allocated.

[0030] The password management module retrieves the password repository key k, and calls the Shamir secret sharing algorithm to split the password repository key k into n secret shares, obtaining the complete secret share sequence. And enable any number of valid shares not less than t to reconstruct the exit command library key k.

[0031] The password recovery management module initializes l recovery buckets. , obtain the bucket set Each recovery bucket is initialized as a random bit string of the same length as the subsequent fixed-length recovery data ciphertext. The purpose of the recovery bucket is to provide an independent storage location for each registered recovery password. However, since all buckets are initially random bit strings, external observers cannot distinguish which buckets actually store recovery information and which are empty buckets.

[0032] The password recovery management module randomly generates internal protection keys. And set the current share allocation index. This index is used to record the position of the next share to be allocated within the entire sequence of secret shares. It also initializes the recovery record. This record is used to record passwords that have been registered as recovery passwords and their corresponding bucket positions. Initially, it is an empty record, and its data structure can be represented as follows: ; in For the registered recovery password, This is the bucket location index corresponding to the password. The number of shares allocated to this password, where m is the total number of currently registered recovery passwords.

[0033] The password recovery management module uses an internal protection key. For the entire secret share sequence Perform authentication encryption to obtain the share ciphertext. Then, the internal state is authenticated and encrypted using the password library key k, and the bucket set B, recovery threshold t, and password evaluation function I are used as associated data to obtain the metadata ciphertext: ; The encrypted metadata contains an internal protection key. Current share allocation index and recovery records This information is essential for subsequent password recovery registration, revocation, and key recovery. Using the bucket set B, recovery threshold t, and password evaluation function I as associated data means that this data will be verified together during authentication and decryption; any tampering with it will result in decryption failure.

[0034] The password recovery management module generates a recovery status. And send it to the server's recovery status management module for storage, while also storing common parameters. To make it public.

[0035] After the initialization phase is complete, users can register some of their stored passwords as recovery passwords. The input to this phase is a candidate recovery password selected by the user from the stored passwords; the output is the encrypted recovery data corresponding to that password stored in the specified recovery bucket. Multiple candidate recovery passwords can be registered by repeatedly executing this phase.

[0036] The client reads the recovery status from the server's recovery status management module. The client uses the password repository key k to encrypt the metadata. Perform authentication and decryption: ; Obtain the internal protection key Current share allocation index and recovery records Due to metadata encryption It is generated using the password repository key k during the initialization phase, so it can only be successfully decrypted if the client currently possesses the correct password repository key k. This ensures that the password recovery registration operation can only be performed when the user has normal access to the password repository.

[0037] The client uses the internal protection key obtained through decryption. Share cipher Perform authentication and decryption: ; Obtain the complete secret share sequence .

[0038] The password recovery management module selects candidate passwords. The strength is used to calculate the corresponding share number. .like This indicates that the candidate recovery password is not strong enough and does not meet the registration requirements; therefore, the system rejects this registration. (If starting from the current share allocation index...) Begin with the complete secret share sequence. The number of unallocated remaining shares is less than ,Right now If no available allocation resources are available, the system will reject the registration. In other cases, the registration process will continue.

[0039] The password management module recovers from the entire secret share sequence. From the current share allocation index Start continuous selection One real share: ; And randomly generated Random fill points Each fill point has the same length as the actual share. Constructing fixed-length data recovery: ; Data recovery The total length is the length of t shares, independent of the actual number of shares. Random fill points use the same data format as the actual shares, with a length of [missing information]. Bits ensure that external observers cannot distinguish between the actual share and the padding content based on data format differences. This fixed-length design means that even if a recovery password is allocated only a small number of actual shares, the length of its corresponding recovery bucket ciphertext is exactly the same as the length of other recovery buckets allocated more actual shares, thus hiding the actual number of shares allocated to each recovery password.

[0040] The password recovery management module selects candidate passwords. and user identity identifier calculate: ; Then calculate the bucket encryption key. and bucket position index The calculated bucket location index falls within the range [0, l], ensuring it points to a valid recovery bucket. By using the user's identity as one of the inputs to the key derivation function, different users will be mapped to different bucket locations even if they choose the same recovery password, thus avoiding cross-user storage conflicts.

[0041] Recover password management module detects bucket location index Has the record been recovered? Other recovery passwords are in use. If any exist... Make If the current candidate recovery password conflicts with a registered recovery password in a bucket location, the system rejects the registration. If the bucket is not occupied, the subsequent write step continues. This conflict detection mechanism ensures that each recovery bucket stores recovery data for at most one recovery password.

[0042] The password recovery management module uses bucket encryption keys. Data recovery for fixed length Encrypt: ; Then write the ciphertext into bucket set B at index [index missing]. recovery bucket and update the current share allocation index. Simultaneously update the recovery record. Register candidate recovery password It has been registered as a recovery password, and its corresponding bucket position has been recorded. and the number of allocated shares .

[0043] To mitigate the risk of external observers inferring password recovery registration behavior by repeatedly observing changes in the bucket's ciphertext, the password recovery management module monitors currently registered passwords... All recovery buckets are rerandomized to obtain a new set of buckets. The specific method of re-randomization is as follows: for each recovery bucket corresponding to a registered recovery password, re-encrypt using the same plaintext data but changing the random number or initialization vector used for encryption. For each registered recovery password Its plaintext data recovery Restore the encrypted random number to the same value. ,calculate This allows the ciphertext to change, but the plaintext obtained after decryption remains unchanged. Empty buckets retain the random bit string and do not perform rerandomization.

[0044] The client regenerates encrypted metadata: ; And update the recovery status to After rerandomization, even if an external observer compares the recovery state before and after the update, they cannot distinguish whether the update was caused by registering a new recovery password or by the rerandomization operation itself.

[0045] When a user wishes to revoke recovery permissions for a registered recovery password, they can initiate a recovery password revocation process. The input to this stage is the registered recovery password to be revoked, and the output is that the contents of the recovery bucket corresponding to that password are cleared and the recovery status is updated.

[0046] The client reads the recovery status from the server's recovery status management module. And use the password library key k to cipher the metadata. Authentication and decryption are performed to obtain the internal protection key. Current share allocation index and recovery records .

[0047] The recovery status management module checks the password to be revoked. Has it been registered in the recovery record? In the middle. If This indicates that the password is not a registered recovery password, and the system rejects this revocation operation. If it has been registered, proceed with the following steps.

[0048] The recovery status management module is based on the password to be revoked. and user identity identifier calculate: ; And further calculate the bucket location index corresponding to the recovery password. This calculation process is completely consistent with the registration phase, ensuring that the recovery bucket corresponding to the password can be located.

[0049] Update recovery records in the recovery status management module The password will be withdrawn. Delete from the record. Simultaneously, add the record indexed in bucket set B. recovery bucket Rewritten as a random bit string of the same length as the original bucket ciphertext: ; This deletes the previously stored recovery data. The random bit string written here is identical in format and length to the random bit string of the empty bucket during the initialization phase, making it impossible for an external observer to distinguish whether a bucket was initially empty or emptied after being revoked.

[0050] The password recovery management module keeps passwords that have been revoked in the recovery log. The recovery buckets in the process are rerandomized to obtain a new set of buckets. Rerandomization only applies to registered recovery buckets that remain valid after revocation; empty buckets retain their random bit strings. Regenerate metadata ciphertext: ; And update the recovery status to .

[0051] Once the revocation operation is completed, the revoked password is no longer recoverable. Even if the user enters the password during the key recovery phase, the system will not be able to extract a valid share of the secret from its corresponding recovery bucket.

[0052] In practical use, users may want to replace a registered recovery password. The replacement operation is achieved by first revoking the original recovery password in the revocation phase, and then registering a new recovery password in the registration phase. To ensure the atomicity of the replacement operation, if the new password registration fails after successfully revoking the original recovery password, the system retains the revoked state of the original password, and the user can choose to retry registering the new password or abandon the replacement. Alternatively, the system can also execute the process of registering the new password first and then revoking the old password, but this method may fail during the registration phase due to bucket position conflicts, making the former method more robust.

[0053] When a user forgets their master password but can still recall some of their registered recovery passwords, a key recovery process can be initiated. The input for this stage is a set of one or more recovery passwords entered by the user. The output is either the password library key k obtained from the reconstruction or the result of recovery failure.

[0054] The client reads the recovery status from the server's recovery status management module. It initializes an empty share set R to accumulate valid shares extracted from multiple recovery passwords.

[0055] For each recovery password in the recovery password set The recovery execution module performs the following operations: ; The execution module resumes reading the position from bucket set B. recovery bucket and using the bucket encryption key Decrypt it: ; Obtain candidate recovery data Subsequently, data was recovered from the candidates. Extracting the first Each share is used as a recovery password Valid shares provided: ; Ignore the remaining fill data to The extracted valid shares are added to the share set R.

[0056] It should be noted that if the recovery password entered by the user is not a registered recovery password, or if the corresponding recovery bucket has been revoked and cleared, then the recovery bucket will be... The data stored is a random bit string, and the candidate recovery data obtained by decryption is... Given a random number, extract the first few digits from it. Each share is actually invalid data. These invalid shares are also added to the share set R. When the recovery execution module selects any t shares from the share set R and calls the Shamir secret reconstruction algorithm, if the selected combination contains invalid shares, the Lagrange interpolation will output a meaningless value, and the reconstructed candidate password library key will be lost. This is an error value. Subsequent processing of the encrypted metadata... The authentication and decryption verification will fail, and the recovery attempt will be rejected. If the number of valid shares in the share set R reaches t and all t shares actually selected during reconstruction are valid shares, then the authentication and decryption verification will pass, and the correct password library key will be output. After a failed attempt, the user can change the recovery password combination and re-initiate the recovery process, or enter more than the threshold of recovery passwords, and the system will attempt reconstruction sequentially for different share combinations.

[0057] After all recovery passwords have been processed, the recovery execution module selects any t shares from the share set R and calls the secret reconstruction algorithm in the Shamir secret sharing algorithm to perform Lagrange interpolation: ; Obtain candidate password library key If the total number of available valid shares in the share set R is less than t, or if the share combination selected during reconstruction contains invalid data, then... This is an error value or a random value.

[0058] The execution recovery module utilizes candidate password library keys. Encryption of metadata Perform authentication and decryption verification: ; metadata ciphertext It is generated using the real password repository key k during the initialization phase, therefore only the correct password repository key can be used for successful decryption. If authentication and decryption verification fails, it means that the valid share corresponding to the current recovery password set W is insufficient or contains incorrect recovery passwords, and recovery fails and a rejection result is returned. If verification succeeds, that is, authentication and decryption are completed correctly and the output is... , , If the format and semantics are reasonable, then it indicates that the candidate password database key is valid. This is the actual password database key k, which the client outputs.

[0059] After the client successfully recovers the password database key, the local decryption module uses this key to decrypt the password manager's password database. ; Restore the user's access to the password database. The user can then set a new master password and reconfigure the recovery mechanism. If recovery fails, the user can try entering other registered recovery password combinations to re-initiate the recovery process.

[0060] The system supports flexible configuration of several key parameters to adapt to different deployment scenarios: The value of the recovery threshold t determines the minimum number of valid shares required for key reconstruction, and its value ranges from [value missing]. The smaller the t-value, the easier the recovery, but the security is correspondingly reduced; the larger the t-value, the higher the security, but the user needs to remember more recovery passwords or ensure that the sum of the shares of each password reaches a threshold.

[0061] The value of the recovery bucket number 'l' determines the upper limit of the total number of registerable recovery passwords, and also affects the probability of bucket location index conflicts. The larger the value of 'l', the lower the probability of conflicts, but the storage overhead increases accordingly.

[0062] The value of the total number of secret shares n, used in conjunction with the recovery threshold t, determines the system's maximum fault tolerance and the total amount of resources that can be allocated.

[0063] The password strength mapping rule determines the specific parameters of the password evaluation function I, including the anti-guessing benchmark. The granularity of hierarchical division directly affects the number of shares allocated to each candidate recovery password.

[0064] The rerandomization strategy determines the scope of rerandomization performed on the recovery bucket after each registration or revocation operation. It can be performed on all registered recovery buckets or only on the individual buckets involved in the operation. The former is more secure but has a larger computational cost, while the latter is more efficient but has relatively obvious observable features.

[0065] The following describes an embodiment of the present invention through a specific use case: Assume the system's core parameters are configured as follows: security parameters Total number of secret shares Recovery threshold Restore total number of buckets Anti-guessing benchmark Password evaluation function Map according to the following hierarchical rules: when hour, They are not eligible for reinstatement. when hour, Allocate 1 real share; when hour, Two real shares will be allocated. when hour, , allocate 3 real shares; Stronger password press The powers follow the same pattern.

[0066] A user is using the password manager normally, with password database key 'k', and the database stores account passwords from dozens of platforms. During the phase where the user can normally access the password database, the system has completed the initialization process: based on... The secret sharing scheme splits the password vault key k into 10 secret shares. k can be reconstructed by Lagrange interpolation if there are at least 5 valid shares; at the same time, initialize A recovery bucket with an initial value of a random bit string is used to generate an internal protection key. Share cipher With metadata ciphertext And will fully restore the state. Synchronize to the cloud server.

[0067] The user selects three passwords from the password database as recovery passwords: email password. Social media passwords Online banking password The password strength assessment module calculated the anti-guessing scores for the three passwords as follows: ,fall into interval, therefore , allocate 3 real shares; ,fall into interval, therefore Two real shares will be allocated. ,fall into interval, therefore Allocate 1 real share.

[0068] The password recovery registration process is executed sequentially as follows: register Selected sequentially from the share sequence A total of 3 real shares were generated. Using 10 random fill points, construct a fixed-length recovery data of length t. ;pass Derived bucket encryption key Bucket position index , ciphertext Write to the corresponding recovery bucket, and update the share allocation index to... .

[0069] register Select There are a total of 2 real shares, generated Constructing restored data using random fill points After key derivation, the data is written to the corresponding recovery bucket, and the share allocation index is updated. .

[0070] register Select There is a total of 1 real share, generated Constructing restored data using random fill points After key derivation, the data is written to the corresponding recovery bucket, and the share allocation index is updated. .

[0071] After each registration is completed, the system performs rerandomization on all registered recovery buckets, regenerating the ciphertext using the same plaintext but with a different encrypted random number, and synchronously updating the metadata ciphertext and recovery status, so that the cloud cannot observe the registration behavior through status changes.

[0072] If a user subsequently forgets their master password but can only recall the three recovery passwords mentioned above, they will initiate a key recovery process. The client will then retrieve the recovery status from the cloud. Initialize an empty share set R, and process each input recovery password sequentially: right :calculate ,get , Read and decrypt the corresponding recovery bucket to obtain Before extraction Each valid share is added to set R; right : Same understanding of the corresponding recovery bucket Before extraction Each valid share is added to set R; right : Same understanding of the corresponding recovery bucket Before extraction Each valid share is added to set R.

[0073] After processing, the total number of shares in the share set R is [number missing]. One valid share, meeting the recovery threshold. The requirement is that the execution recovery module arbitrarily selects 5 shares from R and substitutes them into the Lagrange interpolation formula: Calculate the candidate password library key Then use Encryption of metadata Perform authentication and decryption verification: ; Verification passed, confirmed. This is the actual password repository key. The client uses 'k' to decrypt the password repository ciphertext, allowing the user to regain access to the password repository, reset the master password, and reconfigure the recovery mechanism.

[0074] If the user can only recall and The two together provide One effective share, exactly equal to the recovery threshold. Even if the user can only recall the key, the key recovery can still be successfully completed. If only 3 valid shares are provided, which is insufficient to meet the threshold requirement, the authentication and decryption verification will fail, and the recovery process will be terminated.

[0075] Throughout the entire process, all recovery buckets in the cloud storage contain encrypted data of equal length and random pattern. Attackers cannot distinguish between valid and empty buckets, nor can they infer the actual number of shares corresponding to each recovery password from the encrypted length. The re-randomization mechanism further eliminates the state change characteristics caused by registration and revocation operations, ensuring the unobservability and anti-analysis capabilities of the recovery mechanism.

[0076] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A key recovery method based on password strength allocation and threshold combination, characterized in that, The method includes the following steps: S1. Initialization phase: Obtain the password database key, split the password database key into n recovery fragments according to the preset recovery threshold t, and construct the recovery storage structure; S2, Password Recovery Registration Stage: Receive candidate recovery passwords selected by the user from the saved password database, evaluate the password strength of each candidate recovery password to obtain the corresponding strength value, determine the number of recovery segments that can be allocated to each candidate recovery password based on the strength value, allocate the corresponding number of recovery segments to each candidate recovery password and generate corresponding recovery data, and encrypt and store the recovery data after associating it with the user's identity information and the candidate recovery password. S3, Recovery Password Revocation Phase: Receive the registered recovery password selected by the user, clear the recovery data stored corresponding to the recovery password, and revoke the recovery permission; S4. Key recovery stage: Receive the user's input password to be verified and recover, locate and decrypt the corresponding recovery data in combination with the user's identity information, extract and accumulate valid recovery fragments, and when the number of accumulated valid recovery fragments reaches the preset recovery threshold t, reconstruct the password library key and thus recover the password library key.

2. The key recovery method based on password strength allocation and threshold combination according to claim 1, characterized in that, S1 specifically includes: Initialize security parameters and cryptographic algorithms, including the Shamir secret sharing algorithm, hash functions, password-based key derivation functions, bucket encryption algorithms, and authentication encryption algorithms; The Shamir secret sharing algorithm is called to split the password vault key into n secret shares as recovery fragments. A recovery threshold t is set so that no less than t valid shares can reconstruct the password vault key. Initialize several recovery buckets of equal length, with each recovery bucket initialized as a random bit string; Generate an internal protection key to perform authentication encryption on all secret shares to obtain share ciphertext. Use the password library key to perform authentication encryption on the internal state to obtain metadata ciphertext. Generate and store the recovery state containing the recovery bucket, share ciphertext, and metadata ciphertext.

3. The key recovery method based on password strength allocation and threshold combination according to claim 1, characterized in that, In S2, the password strength assessment outputs the number of candidate recovery passwords that resist guessing as the strength value; Based on a preset anti-guessing number as the allocation benchmark, candidate recovery passwords with an anti-guessing number lower than the benchmark will not be allocated recovery segments; Candidate recovery passwords with a resistance to guessing higher than the baseline are assigned different numbers of recovery fragments based on the resistance to guessing level. When constructing the recovery data, for allocating Candidate recovery password supplement for each recovery segment A number of random fill points are used to form a fixed-length recovery data, and the random fill points use the same data format as the actual recovery fragment.

4. The key recovery method based on password strength allocation and threshold combination according to claim 1, characterized in that, In step S2, the corresponding bucket position index is obtained by key derivation calculation using candidate recovery passwords and user identity information. Before registration, it is checked whether the bucket position is occupied by other recovery passwords. If it is occupied, the registration is rejected. After the registration and revocation of the recovery password are completed, a re-randomization process is performed on the recovery bucket corresponding to all registered recovery passwords to regenerate the encrypted metadata and update the recovery status.

5. The key recovery method based on password strength allocation and threshold combination according to claim 1, characterized in that, S4 specifically includes: Process each input recovery password to be verified one by one, decrypt the corresponding recovery bucket, and then extract the previous password. Each valid recovery segment is added to the share set accumulation; After accumulation, the secret reconstruction algorithm is called to generate candidate password base keys. The correctness of the candidate password base keys is verified by authentication and decryption of the metadata ciphertext. If the verification is successful, the password library key will be output to complete the recovery; if the verification fails, a recovery failure result will be returned.

6. A key recovery system based on password strength allocation and threshold combination, applicable to the key recovery method based on password strength allocation and threshold combination as described in any one of claims 1-5, characterized in that, The system includes a password recovery management module, a password strength assessment module, and a recovery execution module deployed on the client side, as well as a recovery status storage module deployed on the server side. The password recovery management module is used to execute the initialization process, split the password library key into n recovery fragments according to the preset recovery threshold t, construct the recovery storage structure, and initiate the registration and revocation operations of the recovery password; The password strength evaluation module is used to evaluate the strength of candidate recovery passwords to obtain a strength value and output the number of recovery segments that can be allocated for the candidate recovery password. The recovery password management module is also used to allocate a corresponding number of recovery fragments to each candidate recovery password according to the number of recovery fragments, generate recovery data, encrypt it, and synchronize it to the recovery status storage module; The recovery execution module is used to receive the recovery password to be verified input by the user, obtain the corresponding recovery data from the recovery status storage module and extract the valid recovery fragments. When the number of valid recovery fragments reaches the threshold t, the password library key is reconstructed.

7. The key recovery system based on password strength allocation and threshold combination according to claim 6, characterized in that, The client also includes a password database access module and a local decryption module; The password database access module is used to unlock, view, edit and synchronize the password database after the user enters the master password; The local decryption module is used to perform local decryption of the password database ciphertext to restore access after the password database key is recovered, and supports resetting the master password and reconfiguring the recovery mechanism. The server also includes a password database storage module, which stores encrypted password database ciphertext and account synchronization data. The server does not hold users' plaintext passwords or plaintext password database keys.

8. The key recovery system based on password strength allocation and threshold combination according to claim 6, characterized in that, The recovery state storage module is equipped with several recovery buckets of the same length, and the recovery buckets are initialized as random bit strings; The recovered data is encrypted using the candidate recovery password and the encryption key derived from the user's identity, and then stored in the corresponding recovery bucket obtained through mapping. After the registration and revocation operations are completed, the recovery password management module performs rerandomization processing on the recovery bucket corresponding to the registered recovery password, updates the encrypted metadata, and synchronizes it to the recovery status storage module.

9. The key recovery system based on password strength allocation and threshold combination according to claim 6, characterized in that, The password strength assessment module outputs the number of guess-resistant candidate recovery passwords as a strength metric. The system has a preset anti-guessing threshold; passwords with an anti-guessing threshold below the threshold are not eligible for recovery. Passwords with a resistance to guessing higher than the baseline are allocated a corresponding number of recovery fragments according to the resistance to guessing level.

10. The key recovery system based on password strength allocation and threshold combination according to claim 6, characterized in that, The system supports the registration, cancellation, and replacement of recovery passwords. The replacement operation is achieved by first canceling the original recovery password and then registering a new recovery password. The system supports parameterized configuration of recovery threshold, number of recovery buckets, total number of secret shares, strength mapping rules, and rerandomization strategy.

Images