Software environment-based password management method, system, device and storage medium

Abstract

The application relates to a password management method, system and device based on a software environment and a storage medium. The method comprises the following steps: a password software module receives a password service request sent by a third-party application; an identity information corresponding to the request is verified by a password management module; when the verification is passed, authorization information of the third-party application is verified by a password function module; when the verification is passed, the legality of the password function module is verified again; when the legality of the password function module is verified, the third-party application is controlled to obtain a key corresponding to the password service request from the password function module, wherein the password software module can be embedded into the third-party application or can be used as an application to interact with the third-party application. According to the application, the password software module and the function of the third-party application are separated, the isolation of the password function and the business function is completed in a software mode, and the possibility that the security of the password function is affected due to improper implementation of the third-party application is reduced.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a cryptographic management method, system, device and storage medium based on a software environment. Background Technology

[0002] Cryptographic functions ensure the confidentiality, integrity, and non-repudiation of data, properties that can be achieved through various cryptographic algorithms. For example, SM3 and SHA series algorithms can be used to hash data; public-key cryptography can be used for digital signatures and data encryption / decryption; and symmetric cryptography can also be used to ensure data confidentiality through encryption / decryption. These cryptographic algorithms are often thoroughly verified by professionals or authoritative institutions to ensure they possess the security strength under specific security assumptions. Furthermore, the computation process of these algorithms is public. Therefore, in practical applications, the storage and generation of sensitive information such as keys and random numbers play a decisive role in the security of cryptographic functions.

[0003] Hardware-based cryptographic services offer high security by storing sensitive information within specific hardware products, thus separating cryptographic functionality from specific business functions. For example, keys and cryptographic algorithms can be stored in a USB key. When a cryptographic service is needed, the external USB key is plugged in, and the information requiring password protection is transmitted to it. After the USB key performs encryption and other operations, it only returns the result to the specific business function module. Alternatively, cryptographic hardware components can be integrated into specific hardware devices, meaning the cryptographic hardware components are integrated into the device at the time of manufacture.

[0004] While hardware-based cryptographic services operate in a hardware-isolated environment, reducing the risk of sensitive information leakage, they also lack flexibility due to complete isolation from business operations. This results in providing indiscriminate cryptographic functionality across different services. Furthermore, hardware-based cryptography often relies on hardware manufacturers, presenting a high barrier to entry, and problems with hardware-based cryptography cannot be promptly fixed.

[0005] In addition to hardware-based cryptographic services, mobile apps and desktop applications integrate the necessary cryptographic functions into their programs. However, the development of cryptographic functions requires a high level of expertise, and improper software implementation can compromise their security.

[0006] Therefore, providing reliable cryptographic services based on a software-based environment is the technical problem that this invention aims to solve. Summary of the Invention

[0007] In view of the above, this application provides a cryptographic management method, system, device and storage medium based on a software environment, the purpose of which is to provide reliable cryptographic services based on a software environment.

[0008] In a first aspect, this application provides a password management method based on a software environment, applied to an electronic device. The electronic device has a password software module installed, the password software module including a password management module and a password function module. The password software module interacts with a third-party application as an independent application, or the password software module is embedded in a third-party application and interacts with the third-party application. The method includes:

[0009] The cryptographic software module receives a cryptographic service request sent by a third-party application, and the cryptographic management module verifies the identity information corresponding to the cryptographic service request.

[0010] When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application;

[0011] When the authorization information of the third-party application is verified, the legality of the password function module is verified;

[0012] When the validity of the password function module is verified, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object.

[0013] Preferably, before the cryptographic software module receives a cryptographic service request sent by a third-party application, the method further includes:

[0014] Define key management class interface, key usage class interface and application management class interface in advance for the cryptographic function module.

[0015] Preferably, the password management module verifies the identity information corresponding to the password service request, including:

[0016] The password management module verifies the signature information of the application certificate corresponding to the password service request, and verifies the user identity information corresponding to the password service request.

[0017] Preferably, the identity information corresponding to the password service request is verified, including:

[0018] The signature information of the application certificate corresponding to the cryptographic service request is verified, and the user identity information corresponding to the cryptographic service request is verified.

[0019] Preferably, after the password management module verifies the identity information corresponding to the password service request, the method further includes:

[0020] When the identity information corresponding to the password service request fails verification, the password service request is rejected and a preset prompt message is returned.

[0021] Preferably, verifying the legitimacy of the cryptographic function module includes:

[0022] Obtain the first private key hash value pre-written in the cryptographic function module, and obtain the second private key hash value of the current signature. Determine whether the first private key hash value and the second private key hash value are the same. If they are, the legality of the cryptographic function module is verified.

[0023] Preferably, after verifying the legitimacy of the cryptographic function module, the method further includes:

[0024] When the validity of the cryptographic function module fails to pass verification, the cryptographic software module is destroyed.

[0025] Secondly, this application provides a password management system based on a software environment. The system has a password software module installed, which includes a password management module and a password function module. The password software module interacts with third-party applications as an independent application, or it is embedded in a third-party application and interacts with the third-party application. The system includes:

[0026] Receiving unit: used by the cryptographic software module to receive cryptographic service requests sent by third-party applications, and by the cryptographic management module to verify the identity information corresponding to the cryptographic service request;

[0027] First verification unit: used by the password function module to verify the authorization information of the third-party application when the identity information corresponding to the password service request is verified.

[0028] Second verification unit: used to verify the legality of the password function module when the authorization information of the third-party application passes the verification;

[0029] Control unit: When the validity of the password function module is verified, control the third-party application to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object.

[0030] Thirdly, this application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0031] Memory, used to store computer programs;

[0032] When a processor executes a program stored in memory, it implements the steps of the software-based password management method described in any embodiment of the first aspect.

[0033] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the software-based password management method as described in any embodiment of the first aspect.

[0034] The software-based cryptographic management method, system, device, and storage medium proposed in this application have the following advantages compared with existing technologies:

[0035] The cryptographic software module is not tied to hardware devices and is compatible with hardware devices from different manufacturers; thus giving users or application providers greater freedom to choose cryptographic function modules with more complete functions.

[0036] Password functionality is crucial for business security and user data security. Software-based password modules are easier and faster to upgrade than hardware-based password modules.

[0037] Distributing cryptographic functions uniformly to high-security cryptographic software modules is a more rational allocation of resources than having various third-party applications and business providers develop and maintain their own cryptographic modules, thus reducing the possibility of sensitive information leakage and business security threats.

[0038] Distributing cryptographic functions uniformly to a dedicated cryptographic software module can achieve a more reasonable degree of independence between the application's business functions and cryptographic functions.

[0039] This application combines the characteristics of independent cryptographic and business functions in hardware cryptographic modules with the characteristics of custom software cryptographic modules integrated within application programs. Compared to cryptographic functions integrated into specific software business programs, this application separates the cryptographic software module from the functions of third-party applications, achieving isolation between cryptographic and business functions in a software form. This reduces the possibility of cryptographic security being compromised due to improper software implementation in third-party applications. Compared to pure hardware cryptographic modules, software-based cryptographic software modules are more flexible, have a faster update and upgrade process, and can dynamically support more business applications to provide cryptographic services. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart illustrating a preferred embodiment of the password management method based on a software environment according to this application;

[0043] Figure 2 This is a schematic diagram of a preferred embodiment of the password management system based on a software environment according to this application;

[0044] Figure 3 This is a schematic diagram of a preferred embodiment of the electronic device of this application;

[0045] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0047] It should be noted that the use of terms such as "first" and "second" in this application is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed in this application.

[0048] This application provides a password management method based on a software environment. (Refer to...) Figure 1The diagram shown is a flowchart illustrating an embodiment of the software-based password management method of this application. This method can be executed by an electronic device, which can be implemented by software and / or hardware. The electronic device has a password software module installed, which includes a password management module and a password function module. The password software module interacts with third-party applications as an independent application, or it can be embedded in a third-party application to interact with it. The software-based password management method includes:

[0049] Step S10: The password software module receives a password service request sent by a third-party application, and the password management module verifies the identity information corresponding to the password service request;

[0050] Step S20: When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application;

[0051] Step S30: When the authorization information of the third-party application passes the verification, verify the legality of the password function module;

[0052] Step S40: When the legality of the password function module is verified, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application performs the operation corresponding to the password service request based on the password object.

[0053] Electronic devices can be terminals (such as mobile phones, computers, etc.), and third-party applications refer to apps or applications that require password functionality within the software operating environment. These third-party applications are also installed on the terminal and include, but are not limited to, social networking applications, shopping applications, or news and information applications. Third-party applications can interact with the password software module, which includes a password management module and a password function module. The password function module provides password operation services, such as random number generation, hash calculation, data encryption and decryption, digital signatures, and secure storage of sensitive information. The password management module manages the correspondence and resource allocation between third-party applications and the password function module, and also checks and audits access to the password function module initiated by third-party applications.

[0054] It should be noted that the cryptographic software module of this application can be embedded into third-party applications and used as the same SDK or APP as the third-party application. Alternatively, the cryptographic software module can interact with third-party applications independently as an SDK or APP. For example, the interaction process between the third-party application and the cryptographic software module for digital signature includes: the third-party application connects to the cryptographic software module, opens the cryptographic software module after authentication; creates a new key container object, obtains the container handle from the cryptographic software module, and uses the handle to obtain the container object for signing; calls the signature method to export the container key; after signing the message, the cryptographic software module returns the signature result. The methods for decryption, encryption, and signature verification are similar to the digital signature process.

[0055] Specifically, the cryptographic function module has the following functions:

[0056] Cryptographic Algorithm Functionality: By calling relevant resources from the cryptographic algorithm software library in the basic resource layer, it provides third-party applications with functions such as key generation, key storage, key usage, and key export / import. It includes symmetric / asymmetric cryptographic algorithms and cryptographic hash algorithms, as well as the protection and maintenance of the entire lifecycle of key usage.

[0057] Certificate functionality: Supports certificate import and export by calling the file storage in the basic resource layer. Supports digital certificate application, certificate-based verification and signature verification by calling the cryptographic service in the core component layer, and provides digital certificate parsing services for third-party applications.

[0058] Random number management: This method collects data from various sensors in the basic resource layer and is responsible for generating random numbers during the private key generation process. A random number pool is created using the sensor data, and this pool is used to generate random numbers when needed. Compared to the pseudo-random number generator interface provided by existing systems, this method can provide higher quality true random numbers, further ensuring the security of the underlying cryptographic algorithms.

[0059] The password management module has the following functions:

[0060] When multiple third-party applications send cryptographic service requests to the cryptographic software module, if the identity verification of all third-party applications passes, then parallel access to the cryptographic software module SDK is allowed. By configuring multiple different keys for each third-party application, the cryptographic software module calls different keys to perform key calculation services according to the service type.

[0061] In this embodiment, when a third-party application needs to use the password function (for example, when the third party needs to encrypt plaintext information), the third-party application can send a password service request to the password software module. When the password software module receives the password service request from the third-party application, the password management module in the password software module verifies the identity information corresponding to the password service request. The identity information can be the identifier of the third-party application or the identifier of the user of the third-party application (i.e., the user who initiated the use of the password function by the third-party application). By authenticating the identity of the third-party application calling the password service, it is ensured that attackers cannot modify the password software module or impersonate the third-party application to call the password service to obtain the user's private data.

[0062] Once the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application. When the authorization information of the third-party application is verified, the password function module then verifies the legitimacy of the password function module itself. This allows the system to promptly determine whether the password function module has been repackaged, preventing the leakage of users' private data.

[0063] When the validity of the password function module is verified, it means that the password function module is valid and has not been repackaged. At this time, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can use the password object to perform the operation corresponding to the password service request. For example, the third-party application obtains the key corresponding to the request from the password function module and uses the obtained key to perform encryption operation on plaintext information.

[0064] The cryptographic software module of this application only provides cryptographic services such as encryption and decryption for business operations. The cryptographic software module provides calling interfaces to third-party applications installed on the terminal, providing terminal developers with complete cryptographic calculation and key management functions. Different third-party applications call the cryptographic software module independently, which can effectively ensure the confidentiality and integrity of the key itself and sensitive data, and complete the isolation of cryptographic service functions from the functions of third-party applications in the software form.

[0065] In one implementation, before the cryptographic software module receives a cryptographic service request sent by a third-party application, the method further includes:

[0066] Define key management class interface, key usage class interface and application management class interface in advance for the cryptographic function module.

[0067] The cryptographic function module can be integrated into third-party applications, or it can operate independently of third-party applications, providing cryptographic services to third-party applications through predefined interfaces. The predefined interfaces for the cryptographic function module include key management interfaces, key usage interfaces, and application management interfaces.

[0068] The key management interface is responsible for managing keys, and implementing key generation, storage, use, export, and import according to the requests of the cryptographic service.

[0069] The key usage class interface supports functions such as encryption, decryption, signing, and signature verification.

[0070] The application management interface is responsible for verifying whether the application is authorized and for verifying the integrity of the password function module itself.

[0071] In one embodiment, the password management module verifies the identity information corresponding to the password service request, including:

[0072] The password management module verifies the signature information of the application certificate corresponding to the password service request, and verifies the user identity information corresponding to the password service request.

[0073] The certificate application process involves registering with the server. The password management module verifies the signature information of the applied certificate and the user's identity information corresponding to the password service request. By verifying the signature information and user identity information of all third-party applications calling the password service, it ensures that attackers cannot modify the password software module or impersonate third-party applications to access users' private data. When the password service request requires the use of a private key, a PIN code is also required for secondary authentication, preventing attackers from directly impersonating users and accessing their confidential data through the password software module.

[0074] Furthermore, the identity information corresponding to the cryptographic service request is verified, including:

[0075] The signature information of the application certificate corresponding to the cryptographic service request is verified, and the user identity information corresponding to the cryptographic service request is verified.

[0076] In other words, the identity information corresponding to the password service request is considered verified only when the signature information of the application certificate corresponding to the password service request is verified and the user identity information corresponding to the password service request is verified.

[0077] In one embodiment, after the password management module verifies the identity information corresponding to the password service request, the method further includes:

[0078] When the identity information corresponding to the password service request fails verification, the password service request is rejected and a preset prompt message is returned.

[0079] When the signature information of the certificate application corresponding to the password service request fails to be verified, or when the user identity information corresponding to the password service request fails to be verified, it means that the identity information corresponding to the password service request has failed to be verified. In this case, the password service request may be a malicious request. Therefore, the password service request is rejected and a preset prompt message is returned. For example, the preset message may be "Request failed to be verified".

[0080] In one embodiment, verifying the legitimacy of the cryptographic function module includes:

[0081] Obtain the first private key hash value pre-written in the cryptographic function module, and obtain the second private key hash value of the current signature. Determine whether the first private key hash value and the second private key hash value are the same. If they are, the legality of the cryptographic function module is verified.

[0082] The validity of the cryptographic module is verified using digital signature technology. Verification will fail if the cryptographic module is maliciously tampered with. Specifically, the system retrieves the hash value of the private key pre-written into the cryptographic module and the hash value of the private key used for the current signature. It then determines whether the two hash values ​​are the same. If they are the same, the cryptographic module passes the validity verification.

[0083] In one embodiment, after verifying the legitimacy of the cryptographic function module, the method further includes:

[0084] When the validity of the cryptographic function module fails to pass verification, the cryptographic software module is destroyed.

[0085] When the validity of the cryptographic function module fails to pass verification, that is, when the hash value of the first private key is different from the hash value of the second private key, it indicates that the cryptographic software module may have been repackaged. In this case, the destruction process of the cryptographic software module can be started, or an error status can be returned to the third-party application and the service can be stopped.

[0086] In one embodiment, the password management module can also periodically query the log information of password service calls. If abnormal password services are found from the log information, the module can reject password service requests from third-party applications or stop providing password services.

[0087] Reference Figure 2 The diagram shown is a functional module diagram of the password management system 100 based on the software environment of this application.

[0088] The software-based password management system 100 described in this application can be installed in an electronic device. The system includes a password software module, which comprises a password management module and a password function module. The password software module can interact with third-party applications as an independent application, or it can be embedded in a third-party application for interaction. Depending on the implemented functions, the software-based password management system 100 may include a receiving unit 110, a first verification unit 120, a second verification unit 130, and a control unit 140. The unit described in this application refers to a series of computer program segments that can be executed by the processor of an electronic device and perform a fixed function, and which are stored in the memory of the electronic device.

[0089] In this embodiment, the functions of each unit are as follows:

[0090] Receiving unit 110: Used for the cryptographic software module to receive a cryptographic service request sent by a third-party application, and for the cryptographic management module to verify the identity information corresponding to the cryptographic service request;

[0091] First verification unit 120: When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application;

[0092] Second verification unit 130: used to verify the legality of the password function module when the authorization information of the third-party application passes the verification;

[0093] Control unit 140: When the legality of the password function module is verified, control the third-party application to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object.

[0094] In one embodiment, the receiving unit is further configured to:

[0095] Define key management class interface, key usage class interface and application management class interface in advance for the cryptographic function module.

[0096] In one embodiment, the password management module verifies the identity information corresponding to the password service request, including:

[0097] The password management module verifies the signature information of the application certificate corresponding to the password service request, and verifies the user identity information corresponding to the password service request.

[0098] In one embodiment, the identity information corresponding to the cryptographic service request is verified, including:

[0099] The signature information of the application certificate corresponding to the cryptographic service request is verified, and the user identity information corresponding to the cryptographic service request is verified.

[0100] In one embodiment, the first verification unit is further configured to:

[0101] When the identity information corresponding to the password service request fails verification, the password service request is rejected and a preset prompt message is returned.

[0102] In one embodiment, verifying the legitimacy of the cryptographic function module includes:

[0103] Obtain the first private key hash value pre-written in the cryptographic function module, and obtain the second private key hash value of the current signature. Determine whether the first private key hash value and the second private key hash value are the same. If they are, the legality of the cryptographic function module is verified.

[0104] In one embodiment, the control unit is further configured to:

[0105] When the validity of the cryptographic function module fails to pass verification, the cryptographic software module is destroyed.

[0106] Reference Figure 3 The diagram shown is a schematic diagram of a preferred embodiment of the electronic device 1 of this application.

[0107] The electronic device 1 includes, but is not limited to, a memory 11, a processor 12, a display 13, and a network interface 14. The electronic device 1 connects to a network via the network interface 14 to acquire raw data. The network can be an intranet, the Internet, a Global System for Mobile Communications (GSM), Wideband Code Division Multiple Access (WCDMA), a 4G network, a 5G network, Bluetooth, Wi-Fi, a voice communication network, or other wireless or wired networks.

[0108] The memory 11 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of the electronic device 1, such as the hard disk or memory of the electronic device 1. In other embodiments, the memory 11 may also be an external storage device of the electronic device 1, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped with the electronic device 1. Of course, the memory 11 may include both the internal storage unit and its external storage device of the electronic device 1. In this embodiment, the memory 11 is typically used to store the operating system and various application software installed on the electronic device 1, such as the program code of the password management program 10 based on the software environment. In addition, the memory 11 can also be used to temporarily store various types of data that have been output or will be output.

[0109] In some embodiments, processor 12 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. Processor 12 is typically used to control the overall operation of the electronic device 1, such as performing data interaction or communication-related control and processing. In this embodiment, processor 12 is used to run program code stored in memory 11 or process data, such as running program code for a software-based password management program 10.

[0110] The display 13 may be referred to as a display screen or display unit. In some embodiments, the display 13 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touch screen, etc. The display 13 is used to display information processed in the electronic device 1 and to display a visual working interface, such as displaying the results of data statistics.

[0111] The network interface 14 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface), which is typically used to establish communication connections between the electronic device 1 and other electronic devices.

[0112] Figure 3Only an electronic device 1 with components 11-14 and a software-based password management program 10 is shown. However, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0113] Optionally, the electronic device 1 may further include a user interface, which may include a display, an input unit such as a keyboard, and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 1 and to display a visual user interface.

[0114] The electronic device 1 may also include radio frequency (RF) circuits, sensors, and audio circuits, etc., which will not be described in detail here.

[0115] In the above embodiments, when the processor 12 executes the software-based password management program 10 stored in the memory 11, it can perform the following steps:

[0116] The cryptographic software module receives a cryptographic service request sent by a third-party application, and the cryptographic management module verifies the identity information corresponding to the cryptographic service request.

[0117] When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application;

[0118] When the authorization information of the third-party application is verified, the legality of the password function module is verified;

[0119] When the validity of the password function module is verified, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object.

[0120] The storage device can be the memory 11 of the electronic device 1, or it can be other storage devices that are communicatively connected to the electronic device 1.

[0121] For a detailed explanation of the above steps, please refer to the above. Figure 2 Functional module diagram of an embodiment of a software-based password management system 100 and... Figure 1Description of the flowchart of an embodiment of a password management method based on a software environment.

[0122] Furthermore, this application also proposes a computer-readable storage medium, which can be non-volatile or volatile. This computer-readable storage medium can be any one or any combination of several of the following: hard disk, multimedia card, SD card, flash memory card, SMC, read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, etc. The computer-readable storage medium includes a data storage area and a program storage area. The program storage area stores a software-based password management program 10, which, when executed by a processor, performs the following operations:

[0123] The cryptographic software module receives a cryptographic service request sent by a third-party application, and the cryptographic management module verifies the identity information corresponding to the cryptographic service request.

[0124] When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application;

[0125] When the authorization information of the third-party application is verified, the legality of the password function module is verified;

[0126] When the validity of the password function module is verified, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object.

[0127] The specific implementation of the computer-readable storage medium in this application is largely the same as the specific implementation of the above-described software-based password management method, and will not be repeated here.

[0128] It should be noted that the sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0129] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, electronic device, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0130] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A password management method based on a software environment, applied to electronic devices, characterized in that, The electronic device is equipped with a cryptographic software module, which includes a cryptographic management module and a cryptographic function module. The cryptographic software module interacts with third-party applications as an independent application, or it can be embedded in a third-party application for interaction. The cryptographic function module provides key generation, key storage, key usage, and key export / import functions for third-party applications by calling relevant resources from the cryptographic algorithm software library of the basic resource layer. The cryptographic function module also provides certificate import and export functions by calling the file storage of the basic resource layer. The method includes: The cryptographic software module receives a cryptographic service request sent by a third-party application, and the cryptographic management module verifies the identity information corresponding to the cryptographic service request. When the identity information corresponding to the password service request is verified, the password function module verifies the authorization information of the third-party application; When the authorization information of the third-party application passes the verification, the legality of the password function module is verified. The verification of the legality of the password function module includes: obtaining the first private key hash value pre-written in the password function module, and obtaining the second private key hash value of the current signature, and determining whether the first private key hash value and the second private key hash value are the same. If they are the same, the legality of the password function module is verified. When the validity of the password function module is verified, the third-party application is controlled to obtain the password object corresponding to the password service request from the password function module, so that the third-party application performs the operation corresponding to the password service request based on the password object. When the password service request requires the use of a private key, a PIN code must be entered for secondary authentication before the third-party application can obtain the password object; if the validity of the password function module fails verification, the password software module is destroyed. Before the cryptographic software module receives a cryptographic service request sent by a third-party application, the method further includes: Define key management class interface, key usage class interface and application management class interface in advance for the cryptographic function module; The password management module verifies the identity information corresponding to the password service request, including: The password management module verifies the signature information of the application certificate corresponding to the password service request, and verifies the user identity information corresponding to the password service request; The identity information corresponding to the cryptographic service request has been verified, including: The signature information of the application certificate corresponding to the cryptographic service request is verified, and the user identity information corresponding to the cryptographic service request is verified. After the password management module verifies the identity information corresponding to the password service request, the method further includes: When the identity information corresponding to the password service request fails verification, the password service request is rejected and a preset prompt message is returned.

2. A password management system based on a software environment, characterized in that, The system is equipped with a cryptographic software module, which includes a cryptographic management module and a cryptographic function module. The cryptographic software module interacts with third-party applications as an independent application, or it can be embedded in a third-party application for interaction. The cryptographic function module provides key generation, key storage, key usage, and key export / import functions for third-party applications by calling relevant resources from the cryptographic algorithm software library in the basic resource layer. The cryptographic function module also provides certificate import and export functions by calling the file storage in the basic resource layer. The system includes: Receiving unit: used by the cryptographic software module to receive cryptographic service requests sent by third-party applications, and by the cryptographic management module to verify the identity information corresponding to the cryptographic service request; First verification unit: used by the password function module to verify the authorization information of the third-party application when the identity information corresponding to the password service request is verified. The second verification unit is used to verify the legality of the password function module when the authorization information of the third-party application passes verification. The verification of the legality of the cryptographic function module includes: obtaining the first private key hash value pre-written in the cryptographic function module, and obtaining the second private key hash value of the current signature, determining whether the first private key hash value and the second private key hash value are the same, and if so, the legality of the cryptographic function module is verified. Control unit: When the validity of the password function module is verified, it controls the third-party application to obtain the password object corresponding to the password service request from the password function module, so that the third-party application can perform the operation corresponding to the password service request based on the password object. When the password service request requires the use of a private key, a PIN code needs to be entered for secondary authentication before the third-party application obtains the password object. When the validity of the password function module fails verification, the password software module is destroyed.

3. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the software-based password management method as described in claim 1.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the software environment-based password management method as described in claim 1.

Images