Account management method, device, equipment and storage medium

Abstract

The present invention discloses an account management method, device, equipment and storage medium. The present invention is based on identity identification cryptographic technology, directly uses identity identification as the user's public key, and the user does not need a third party to guarantee the authenticity of the public key, which simplifies the user identity authentication process, is efficient, and is easy to deploy and use. The private key of the main account is used to perform secondary encryption on the private key of the mirror account. When other users use the secret key of the mirror account to log in to the business platform, the secret key of the main account can be used to verify the secret key of the mirror account for logging in. Only when the verification is passed, it is allowed to enter the business platform to handle the corresponding business, thereby improving the security of the account. The corresponding authority and time limit are granted to the private key of each mirror account to avoid the leakage of the user's main account and the risk of other users handling business beyond their authority, thereby improving the security of the account.

Description

Technical Field

[0001] The present invention relates to computer application technology, and in particular to an account management method, device, equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, most of the authentication methods of various business platforms on the Internet adopt a registration system, that is, users register a personal account on the business platform, set a password, and then log in using the account and password. The business platform verifies the account and password to confirm the user's identity.

[0003] An account registered on the business platform can have multiple permissions, and users can use these permissions to handle corresponding businesses. In some specific cases, users may need to entrust one of the businesses to other users. At this time, the user can only tell the account and password to other users, and other users will log in to the business platform to handle it. This will lead to the leakage of user accounts and passwords. In addition, there is also the risk of other users exceeding their authority to handle other businesses. Summary of the invention

[0004] The present invention provides an account management method, device, equipment and storage medium to avoid leakage of a user's main account and the risk of other users handling business without authorization, thereby improving account security.

[0005] In a first aspect, the present invention provides an account management method, comprising:

[0006] In response to a mirror account creation request sent by a target user through a user terminal, obtaining basic personal information authorized by the target user, the basic personal information including a key identity identifier and a plurality of additional identifiers of the target user;

[0007] Using the key identity as the public key of the primary account, generating a private key paired with the public key of the primary account based on identity cryptography technology;

[0008] For each of the additional identifiers, the additional identifier is used as the public key of the mirror account, and a private key paired with the public key of the mirror account is generated based on the identity identifier cryptography technology;

[0009] The private key of the mirror account is encrypted twice using the private key of the primary account;

[0010] The private key of each mirror account is granted corresponding permissions and time limits, and the mirror account is authorized to other users for temporary use.

[0011] Optionally, before responding to the mirror account creation request sent by the target user through the user terminal and obtaining the personal basic information authorized by the target user, the method further includes:

[0012] In response to a primary account registration application sent by a target user through a user terminal, obtaining a key identity identifier input by the target user;

[0013] Acquire the physiological characteristics of the target user, and use biometrics to identify the physiological characteristics to verify whether the key identity identifier corresponds to the identity of the target user;

[0014] When the verification is passed, multiple additional identifiers input by the target user are received, and the step of obtaining the personal basic information authorized by the target user is executed in response to a mirror account creation request sent by the target user through the user terminal.

[0015] Optionally, the private key of the mirror account is encrypted twice using the private key of the primary account, including:

[0016] The private key of the mirror account is digitally signed using the private key of the primary account.

[0017] Optionally, using the private key of the primary account to digitally sign the private key of the mirror account includes:

[0018] Calculate the private key of the mirror account using a hash algorithm to obtain a first hash value;

[0019] The first hash value is encrypted using the private key of the primary account to obtain a digital signature of the private key of the mirror account.

[0020] Optionally, grant corresponding permissions and validity periods to the private key of each mirror account, including:

[0021] Establish a valid account list, add the public key and private key of the mirror account to the valid account list, and set the validity period of the mirror account;

[0022] The private key of the mirror account and the identifier representing the authority are written into the electronic key.

[0023] Optionally, the account management method also includes:

[0024] Get the public key of the mirror account entered by other users when logging in;

[0025] Use the private key of the mirror account in the electronic key inserted by the user to verify whether the public key of the input mirror account matches the private key in the electronic key;

[0026] When the public key of the input mirror account matches the private key in the electronic key, verify the timeliness of the private key of the mirror account;

[0027] When the verification is passed, the authority of the private key of the mirror account is determined.

[0028] Optionally, the account management method also includes:

[0029] Decrypting the digital signature using the public key of the primary account;

[0030] When the digital signature is successfully decrypted to obtain the first hash value, determining that the digital signature is issued by the target user;

[0031] Calculate the private key of the mirror account using a hash algorithm to obtain a second hash value;

[0032] The first hash value is compared with the second hash value. When the first hash value is the same as the second hash value, a step is performed to verify whether the public key of the input mirror account matches the private key in the electronic key using the private key of the mirror account in the electronic key inserted by the user.

[0033] In a second aspect, the present invention further provides an account management transposition, comprising:

[0034] An information acquisition module, configured to obtain basic personal information authorized by a target user in response to a mirror account creation request issued by the target user through a user terminal, wherein the basic personal information includes a key identity identifier and a plurality of additional identifiers of the target user;

[0035] A first private key generation module, configured to use the key identity as the public key of the primary account and generate a private key paired with the public key of the primary account based on identity cryptography technology;

[0036] A second private key generation module is used to generate a private key paired with the public key of the mirror account based on the identity cryptography technology for each of the additional identifiers, using the additional identifier as the public key of the mirror account;

[0037] A secondary encryption module, used to perform secondary encryption on the private key of the mirror account using the private key of the primary account;

[0038] The authorization module is used to grant corresponding permissions and time limits to the private key of each mirror account, and authorize the mirror account to other users for temporary use.

[0039] In a third aspect, the present invention further provides an electronic device, comprising:

[0040] one or more processors;

[0041] A memory for storing one or more programs;

[0042] When the one or more programs are executed by the one or more processors, the one or more processors implement the account management method provided in the first aspect of the present invention.

[0043] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the account management method provided in the first aspect of the present invention.

[0044] The account management method provided by the present invention includes: in response to a mirror account creation request sent by a target user through a user terminal, obtaining the personal basic information authorized by the target user, the personal basic information including the key identity identifier and multiple additional identifiers of the target user, using the key identity identifier as the public key of the main account, generating a private key paired with the public key of the main account based on the identity identifier cryptographic technology, using the additional identifier as the public key of the mirror account for each additional identifier, generating a private key paired with the public key of the mirror account based on the identity identifier cryptographic technology, using the private key of the main account to perform secondary encryption on the private key of the mirror account, granting corresponding permissions and time limits to the private key of each mirror account, and authorizing the mirror account to other users for temporary use. The present invention is based on the identity identifier cryptographic technology, directly uses the identity identifier as the user public key, and the user does not need a third party to ensure the authenticity of the public key, which simplifies the user identity authentication process, is efficient, and is easy to deploy and use. The private key of the mirror account is encrypted twice with the private key of the master account. When other users use the secret key of the mirror account to log in to the business platform, the secret key of the master account can be used to verify the secret key of the mirror account. Only when the verification is passed can they enter the business platform to handle the corresponding business, which improves the security of the account. The private key of each mirror account is granted corresponding permissions and time limits to avoid the leakage of the user's master account and the risk of other users handling business beyond their authority, which improves the security of the account.

[0045] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A flowchart of an account management method provided by an embodiment of the present invention;

[0048] Figure 2 A flowchart of another account management method provided by an embodiment of the present invention;

[0049] Figure 3A flowchart of another account management method provided by an embodiment of the present invention;

[0050] Figure 4 A schematic diagram of the structure of an account management device provided by an embodiment of the invention;

[0051] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0053] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0054] It should be emphasized that the acquisition, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations.

[0055] Figure 1 This is a flow chart of an account management method provided by an embodiment of the present invention. This embodiment is applicable to a situation where a user entrusts another user to temporarily handle a certain business. The method can be executed by an account management device provided by an embodiment of the present invention. The device can be implemented by software and / or hardware and is usually configured in a business platform, such as Figure 1 As shown, the method specifically comprises the following steps:

[0056] S101. In response to a mirror account creation request sent by a target user through a user terminal, obtain basic personal information authorized by the target user, where the basic personal information includes a key identity identifier and multiple additional identifiers of the target user.

[0057] In an embodiment of the present invention, when the target user wants to entrust other users to handle a certain business in the business platform, the target user can log in to the business platform through the user terminal and send a mirror account creation request through the user terminal. After receiving the mirror account creation request, the business platform obtains the personal basic information authorized by the target user, and the personal basic information includes the key identity identifier and multiple additional identifiers of the target user. In an authentication system, the core part of an account is account number + password + certificate type and certificate number. In addition to these elements, there are others, such as name, mobile phone number, email address, etc. In an embodiment of the present invention, the key identity identifier of the target user can be a key unique identifier in the core part of the account that is used to characterize the identity of the target user, such as an ID number or other certificate number used to characterize the user's identity. The additional identifier of the target user refers to a user identifier that is unique in the account, but is not a key element of the account in the authentication system, such as an email address, phone number, etc.

[0058] Among them, the mirror account is a mirror of the target user's account and can have some or all permissions of the target user's account. The target user can inform other users of the mirror account, and other users use the mirror account to log in to the business platform to handle one or several businesses entrusted by the target user.

[0059] The mirror account creation request is used to indicate the action of the user terminal of the target user applying to create a mirror account, and the method of triggering the mirror account creation request can be pre-configured according to actual needs, and is not limited by the embodiment of the present invention. For example, when the application scenario is a bidding application scenario, when entrusting other users to handle a certain business in the business platform, the interface of the user terminal of the target user can set a virtual button for triggering the mirror account creation request. When the target user clicks the virtual button, it is deemed that the user has triggered the mirror account creation request.

[0060] S102: Using the key identity as the public key of the primary account, a private key paired with the public key of the primary account is generated based on identity cryptography technology.

[0061] In the embodiment of the present invention, the identity-based cryptograph (IBC) is an asymmetric public key cryptographic system. The identity-based cryptographic technology uses the elliptic curve bilinear pairing theory and the user's unique identity to realize the cryptographic technology of directly binding the user identity and the key pair. The cryptographic technology can use the other party's unique identity as the public key, and the user's private key is calculated by the key generation center (Key Generate Center, referred to as KGC) according to the system master key and the user's identity. When the public key of the traditional asymmetric algorithm, such as RSA (Rivest, Shamir, Adleman), is distributed, because the public key is just a string of meaningless random numbers, it is necessary to use the PKI (Public Key Infrastructure) system to add additional identity authentication to the public key. In this way, when transmitting the key, it is necessary to bring a set of digital certificates, and the authentication process is relatively cumbersome. Based on the identity-based cryptographic technology, the identity is directly used as the user's public key. The user does not need a third party to guarantee the authenticity of the public key, which simplifies the user identity authentication process, is efficient, and is easy to deploy and use. Exemplarily, in a specific embodiment of the present invention, the SM9 algorithm is used to generate a private key paired with the public key of the primary account. SM9 is a type of identity identification cryptographic algorithm.

[0062] In the embodiment of the present invention, the key identity is used as the public key of the master account, and a private key paired with the public key of the master account is generated based on the identity cryptographic technology. Specifically, the key generation center gives a security parameter K, and outputs the system parameter params and the master key MasterKey. Among them, the system parameter params is public, and the master key MasterKey is only known to the key generation center. Then, the private key paired with the public key of the master account is calculated mathematically using the system parameter params, the master key MasterKey and the key identity.

[0063] S103: For each additional identifier, use the additional identifier as the public key of the mirror account, and generate a private key paired with the public key of the mirror account based on identity identifier cryptography technology.

[0064] In the embodiment of the present invention, for each additional identifier, the additional identifier is used as the public key of the mirror account, and a private key paired with the public key of the mirror account is generated based on the identity identifier cryptographic technology. Specifically, the process and principle of using the additional identifier as the public key of the mirror account and generating a private key paired with the public key of the mirror account based on the identity identifier cryptographic technology are similar to the aforementioned process of using the key identity identifier as the public key of the primary account and generating a private key paired with the public key of the primary account based on the identity identifier cryptographic technology, and the embodiment of the present invention will not be repeated here.

[0065] S104: Use the private key of the primary account to perform secondary encryption on the private key of the mirror account.

[0066] In an embodiment of the present invention, after obtaining the public key and private key of the main account, as well as the public key and private key of the mirror account, the private key of the mirror account is encrypted twice using the private key of the main account. In this way, the secret key of the main account is used as the root secret key of the mirror account. When other users use the secret key of the mirror account to log in to the business platform, the secret key of the main account can be used to verify the secret key of the mirror account to log in. Only when the verification is passed can the user be allowed to enter the business platform to process the corresponding business, thereby improving the security of the account. Exemplarily, in an embodiment of the present invention, the form of secondary encryption is not limited, for example, it can be in the form of a digital signature.

[0067] S105: Grant corresponding permissions and time limits to the private key of each mirror account, and authorize the mirror account to other users for temporary use.

[0068] In an embodiment of the present invention, after the private key of the mirror account is encrypted twice, the private key of each mirror account is granted corresponding authority and time limit, and the mirror account is authorized to other users for temporary use. Exemplarily, mirror accounts corresponding to different attachment identifiers can be granted different authority to handle different businesses. In addition, since the target user only temporarily gives the mirror account to other users to temporarily handle one or several businesses, the private key of each of the mirror accounts can be granted a corresponding time limit, for example, within the same day, within a week, etc., which is not limited in the embodiment of the present invention. Within the time limit, other entrusted users can log in to the business platform with the mirror account and handle the business within the scope of the granted authority. Once the time limit is exceeded, the private key of the mirror account becomes invalid and cannot log in to the business platform.

[0069] The account management method provided by the embodiment of the present invention includes: in response to a mirror account creation request sent by a target user through a user terminal, obtaining the basic personal information authorized by the target user, the basic personal information including the key identity identifier and multiple additional identifiers of the target user, using the key identity identifier as the public key of the main account, generating a private key paired with the public key of the main account based on the identity identifier cryptographic technology, using the additional identifier as the public key of the mirror account for each additional identifier, generating a private key paired with the public key of the mirror account based on the identity identifier cryptographic technology, using the private key of the main account to perform secondary encryption on the private key of the mirror account, granting corresponding permissions and time limits to the private key of each mirror account, and authorizing the mirror account to other users for temporary use. The present invention is based on the identity identifier cryptographic technology, directly uses the identity identifier as the user public key, and the user does not need a third party to guarantee the authenticity of the public key, which simplifies the user identity authentication process, is efficient, and is easy to deploy and use. The private key of the mirror account is encrypted twice with the private key of the master account. When other users use the secret key of the mirror account to log in to the business platform, the secret key of the master account can be used to verify the secret key of the mirror account. Only when the verification is passed can they enter the business platform to handle the corresponding business, which improves the security of the account. The private key of each mirror account is granted corresponding permissions and time limits to avoid the leakage of the user's master account and the risk of other users handling business beyond their authority, which improves the security of the account.

[0070] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, each step in the above embodiment will be described in detail below.

[0071] Figure 2 A flowchart of another account management method provided by an embodiment of the present invention, such as Figure 2 As shown, the account management method includes:

[0072] S201. In response to a primary account registration application sent by a target user through a user terminal, a key identity identifier input by the target user is obtained.

[0073] In an embodiment of the present invention, when the target user logs in to the service platform for the first time, the service platform will give a registration prompt to prompt the target user to register a primary account. The service platform responds to the primary account registration application sent by the target user through the user terminal and obtains the key identity identifier input by the target user. As mentioned above, the key identity identifier of the target user can be a key unique identifier in the core part of the account that is used to characterize the identity of the target user, such as an identity card number or other certificate number used to characterize the user's identity.

[0074] S202: Verify whether the key identity identifier corresponds to the identity of the target user.

[0075] In an embodiment of the present invention, in order to confirm that the target user himself registers the main account and to prevent others from registering as the target user, the physiological characteristics of the target user can be collected, and the physiological characteristics can be identified using biometric technology to verify the key identity identifier. Exemplarily, in an embodiment of the present invention, the physiological characteristics can be facial features, voiceprint features, fingerprint features, etc., which are not limited in this embodiment of the present invention. After the physiological characteristics are collected, the collected physiological characteristics are compared with the physiological characteristic samples of the target user pre-stored in the feature library. If they are consistent, it is confirmed that the target user himself registers the main account, and the key identity identifier corresponds to the identity of the target user. If the verification passes, step S203 is executed. If the verification fails, the process ends.

[0076] S203: Receive multiple additional identifiers input by the target user.

[0077] After verifying that the key identity identifier corresponds to the identity of the target user, multiple additional identifiers entered by the target user are received. As mentioned above, the additional identifier of the target user refers to a user identifier that is unique in the account but is not a key element of the account in the authentication system, such as an email address, phone number, etc.

[0078] S204: In response to a mirror account creation request sent by the target user through the user terminal, obtain the basic personal information authorized by the target user, where the basic personal information includes a key identity identifier and multiple additional identifiers of the target user.

[0079] In an embodiment of the present invention, when a target user wants to entrust another user to handle a certain service in a service platform, the target user can log in to the service platform through a user terminal and send a mirror account creation request through the user terminal. After receiving the mirror account creation request, the service platform obtains the target user's authorized personal basic information, which includes the target user's key identity identifier and multiple additional identifiers.

[0080] S205. Use the key identity as the public key of the primary account, and generate a private key paired with the public key of the primary account based on the identity cryptography technology.

[0081] In the embodiment of the present invention, the key identity is used as the public key of the master account, and a private key paired with the public key of the master account is generated based on the identity cryptographic technology. Specifically, the key generation center gives a security parameter K, and outputs the system parameter params and the master key MasterKey. Among them, the system parameter params is public, and the master key MasterKey is only known to the key generation center. Then, the private key paired with the public key of the master account is calculated mathematically using the system parameter params, the master key MasterKey and the key identity.

[0082] S206. For each additional identifier, use the additional identifier as the public key of the mirror account, and generate a private key paired with the public key of the mirror account based on identity identifier cryptography technology.

[0083] In the embodiment of the present invention, for each additional identifier, the additional identifier is used as the public key of the mirror account, and a private key paired with the public key of the mirror account is generated based on the identity identifier cryptographic technology. Specifically, the process and principle of using the additional identifier as the public key of the mirror account and generating a private key paired with the public key of the mirror account based on the identity identifier cryptographic technology are similar to the aforementioned process of using the key identity identifier as the public key of the primary account and generating a private key paired with the public key of the primary account based on the identity identifier cryptographic technology, and the embodiment of the present invention will not be repeated here.

[0084] S207: Use the private key of the primary account to digitally sign the private key of the mirror account.

[0085] In the embodiment of the present invention, the private key of the primary account is used to digitally sign the private key of the mirror account. A digital signature is a string of numbers that can only be generated by the sender of the information and cannot be forged by others. This string of numbers is also a valid proof of the authenticity of the information sent by the sender of the information. For example, the specific process of using the private key of the primary account to digitally sign the private key of the mirror account is as follows:

[0086] 1. Use the hash algorithm to calculate the private key of the mirror account to obtain the first hash value.

[0087] Exemplarily, in an embodiment of the present invention, after the private key of the mirror account is generated, a hash algorithm is used to calculate the private key of the mirror account to obtain a first hash value, which can also be called the summary of the private key of the mirror account. The hash algorithm maps a binary value string of any length to a binary value string of fixed length. Exemplarily, in an embodiment of the present invention, the MD5 algorithm is used to calculate the private key of the mirror account to obtain a 128-bit first hash value.

[0088] 2. Use the private key of the primary account to encrypt the first hash value and obtain the digital signature of the private key of the mirror account.

[0089] After the private key of the mirror account is calculated using a hash algorithm to obtain a first hash value, the first hash value is encrypted using the private key of the primary account to obtain a digital signature of the private key of the mirror account, and the digital signature is attached to the private key of the mirror account.

[0090] S208. Create a valid account list, add the public key and private key of the mirror account to the valid account list, and set the validity period of the mirror account.

[0091] In the embodiment of the present invention, in order to facilitate the management of the mirror account, the public key and private key of the mirror account are added to the valid account list, and the validity period of the mirror account is set. Within the validity period, other entrusted users can log in to the business platform with the public key and private key of the mirror account and handle the business within the scope of the granted authority. Once the validity period is exceeded, the mirror account is automatically removed from the valid account list, the private key becomes invalid, and it is impossible to log in to the business platform.

[0092] S209: Write the private key of the mirror account and the identifier representing the authority into the electronic key.

[0093] In an embodiment of the present invention, the private key of the mirror account is written into an electronic key (Ukey) and distributed to other authorized users. When the private key of the mirror account is written into Ukey, an identifier representing the authority is written. For example, different authority identifiers represent different authorities, and corresponding services can be processed.

[0094] The following will introduce the verification process of the service platform when the entrusted user logs in using a mirror account in the embodiment of the present invention.

[0095] Figure 3 A flowchart of another account management method provided by an embodiment of the present invention, such as Figure 3 As shown, the account management method includes:

[0096] S301. Create a mirror account of the main account.

[0097] Exemplarily, the business platform responds to the mirror account creation request sent by the target user through the user terminal, obtains the target user's authorized basic personal information, the basic personal information includes the target user's key identity and multiple additional identities, uses the key identity as the public key of the main account, generates a private key paired with the public key of the main account based on the identity cryptographic technology, uses the additional identity as the public key of the mirror account for each additional identity, generates a private key paired with the public key of the mirror account based on the identity cryptographic technology, uses the private key of the main account to perform secondary encryption on the private key of the mirror account, grants corresponding permissions and time limits to the private key of each mirror account, and authorizes the mirror account to other users for temporary use. Specifically, the specific process of creating a mirror account has been detailed in the aforementioned embodiments, and the embodiments of the present invention will not be repeated here.

[0098] S302: Obtain the public key of the mirror account entered by other users when logging in.

[0099] When the other entrusted user logs in to the business platform through the mirror account, enters the public key of the mirror account, and reads the private key of the mirror account in the electronic key inserted by the user. Exemplarily, in an embodiment of the present invention, as described above, the public key is an additional identifier of the target user, and the private key is written into the electronic key together with the authority identifier. After the other entrusted user opens the login page, enters the public key and inserts the electronic key on the login device, the login device can read the private key of the mirror account in the electronic key.

[0100] S303: Decrypt the digital signature using the public key of the primary account to determine whether the decryption is successful.

[0101] As mentioned above, the digital signature is encrypted and issued using the private key of the target user's primary account, and can only be decrypted using the public key of the target user's primary account. After obtaining the private key of the mirror account, decrypt the digital signature attached to it. If the decryption is successful, it means that the digital signature is issued by the target user, and the first hash value is obtained by decryption. If the decryption fails, it means that the digital signature is not issued by the target user, then the verification fails, the login fails, and the process ends.

[0102] S304: When the digital signature is successfully decrypted to obtain the first hash value, it is determined that the digital signature is issued by the target user.

[0103] In the embodiment of the present invention, the public key of the primary account is used to decrypt the digital signature, that is, to verify whether the digital signature is issued by the target user. If the decryption is successful, it means that the digital signature is issued by the target user, and the first hash value is obtained by decryption.

[0104] S305: Use a hash algorithm to calculate the private key of the mirror account to obtain a second hash value.

[0105] In the embodiment of the present invention, after the digital signature is verified, a hash algorithm is used to calculate the private key of the mirror account to obtain a second hash value.

[0106] S306: Compare the first Hash value with the second Hash value.

[0107] The first hash value obtained by decrypting the digital signature is compared with the second hash value. If the first hash value is the same as the second hash value, it means that the private key of the mirror account has not been tampered with during the transmission process, and step S307 is executed. If the first hash value is different from the second hash value, it means that the private key of the mirror account has been tampered with during the transmission process, the verification fails, the login fails, and the process ends.

[0108] S307: Verify whether the public key of the input mirror account matches the private key in the electronic key.

[0109] In an embodiment of the present invention, verifying whether the public key of the input mirror account matches the private key in the electronic key is to verify whether the public key of the mirror account is correct. Exemplarily, the business platform generates a random number and encrypts it using the public key of the mirror account. The encrypted random number is then decrypted using the private key in the mirror account. If the decryption is successful, it is considered that the public key of the input mirror account matches the private key in the electronic key, and step S308 is executed. If the decryption fails, it is considered that the public key of the input mirror account does not match the private key in the electronic key, then the verification fails, the login fails, and the process ends.

[0110] S308: Verify the validity of the private key of the mirror account.

[0111] Exemplarily, in an embodiment of the present invention, it is determined whether the mirror account is in the valid account list. If so, it means that the mirror account is still within the valid period, the verification passes, and step S309 is executed; if not, it means that the mirror account has expired, the verification fails, the login fails, and the process ends.

[0112] S309: Determine the authority of the private key of the mirror account.

[0113] When the validity of the private key of the mirror account is verified, the login is determined to be successful, and the authority of the private key of the mirror account is further determined. Exemplarily, by reading the authority identifier in the electronic key, the authority corresponding to the authority identifier is determined, thereby determining the business that the mirror account can proxy process.

[0114] The embodiment of the present invention also provides an account management transposition. Figure 4 A schematic diagram of the structure of an account management device provided by an embodiment of the invention, such as Figure 4 As shown, the account management device includes:

[0115] The information acquisition module 401 is used to obtain the basic personal information authorized by the target user in response to the mirror account creation request sent by the target user through the user terminal, wherein the basic personal information includes the key identity identifier and multiple additional identifiers of the target user;

[0116] A first private key generation module 402, configured to use the key identity as the public key of the primary account and generate a private key paired with the public key of the primary account based on identity cryptography technology;

[0117] The second private key generation module 403 is used to generate a private key paired with the public key of the mirror account based on the identity cryptography technology for each additional identifier, using the additional identifier as the public key of the mirror account;

[0118] A secondary encryption module 404, configured to perform secondary encryption on the private key of the mirror account using the private key of the primary account;

[0119] The authorization module 405 is used to grant corresponding permissions and time limits to the private key of each mirror account, and authorize the mirror account to other users for temporary use.

[0120] In some embodiments of the present invention, the account management transposition further includes:

[0121] A key identity acquisition module, used to obtain the key identity input by the target user in response to a primary account registration application sent by the target user through the user terminal before obtaining the basic personal information authorized by the target user in response to a mirror account creation request sent by the target user through the user terminal;

[0122] A physiological feature verification module, used to obtain the physiological features of the target user, and identify the physiological features using biometrics to verify whether the key identity identifier corresponds to the identity of the target user;

[0123] The additional identification receiving module is used to receive multiple additional identifications input by the target user when the verification is passed, and execute the step of obtaining the personal basic information authorized by the target user in response to the mirror account creation request sent by the target user through the user terminal.

[0124] In some embodiments of the present invention, the secondary encryption module 404 includes:

[0125] The digital signature submodule is used to digitally sign the private key of the mirror account using the private key of the primary account.

[0126] In some embodiments of the present invention, the digital signature submodule includes:

[0127] A first hash value calculation unit, configured to calculate the private key of the mirror account by using a hash algorithm to obtain a first hash value;

[0128] The encryption unit is used to encrypt the first hash value using the private key of the primary account to obtain a digital signature of the private key of the mirror account.

[0129] In some embodiments of the present invention, the authorization module 405 includes:

[0130] An account list establishment submodule, used to establish a valid account list, add the public key and private key of the mirror account to the valid account list, and set the validity period of the mirror account;

[0131] The writing submodule is used to write the private key of the mirror account and the identifier representing the authority into the electronic key.

[0132] In some embodiments of the present invention, the account management transposition further includes:

[0133] The mirror account key acquisition module is used to obtain the public key of the mirror account entered by other users when logging in;

[0134] A first verification module, used to verify whether the input public key of the mirror account matches the private key in the electronic key by using the private key of the mirror account in the electronic key inserted by the user;

[0135] A second verification module, used to verify the timeliness of the private key of the mirror account when the public key of the input mirror account matches the private key in the electronic key;

[0136] The authority determination module is used to determine the authority of the private key of the mirror account when the verification is passed.

[0137] In some embodiments of the present invention, the account management transposition further includes:

[0138] A digital signature decryption module, used to decrypt the digital signature using the public key of the primary account;

[0139] A determination module, configured to determine that the digital signature is issued by a target user when the first hash value is obtained by successfully decrypting the digital signature;

[0140] A second hash value calculation module, used to calculate the private key of the mirror account using a hash algorithm to obtain a second hash value;

[0141] A comparison module is used to compare the first hash value with the second hash value. When the first hash value is the same as the second hash value, a step is performed to verify whether the public key of the input mirror account matches the private key in the electronic key by using the private key of the mirror account in the electronic key inserted by the user.

[0142] The above-mentioned account management device can execute the account management method provided by any embodiment of the present application, and has the corresponding functional modules and beneficial effects for executing the account management method.

[0143] The embodiment of the present application provides an electronic device, which may be the service platform in the aforementioned embodiment of the present application. Figure 5A schematic diagram of the structure of an electronic device provided for an embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0144] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0145] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0146] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the account management method.

[0147] In some embodiments, the account management method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the account management method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the account management method in any other appropriate manner (e.g., by means of firmware).

[0148] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0149] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0150] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0151] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0152] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0153] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0154] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the account management method provided in any embodiment of the present application.

[0155] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0156] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0157] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An account management method, characterized in that: include: In response to a mirror account creation request sent by a target user through a user terminal, obtaining basic personal information authorized by the target user, the basic personal information including a key identity identifier and a plurality of additional identifiers of the target user, wherein the mirror account is a mirror image of the target user's account, the key identity identifier is a key unique identifier in the core part of the target user's account used to characterize the identity of the target user, and the additional identifier is a unique user identifier that does not include the key identity identifier; Using the key identity as the public key of the primary account, generating a private key paired with the public key of the primary account based on identity cryptography technology; For each of the additional identifiers, the additional identifier is used as the public key of the mirror account, and a private key paired with the public key of the mirror account is generated based on the identity identifier cryptography technology; The private key of the mirror account is encrypted twice using the private key of the primary account; The private key of each mirror account is granted corresponding permissions and time limits, and the mirror account is authorized to other users for temporary use.

2. The account management method according to claim 1, characterized in that: Before obtaining the basic personal information authorized by the target user in response to the mirror account creation request sent by the target user through the user terminal, the method further includes: In response to a primary account registration application sent by a target user through a user terminal, obtaining a key identity identifier input by the target user; Acquire the physiological characteristics of the target user, and use biometrics to identify the physiological characteristics to verify whether the key identity identifier corresponds to the identity of the target user; When the verification is passed, multiple additional identifiers input by the target user are received, and the step of obtaining the personal basic information authorized by the target user is executed in response to a mirror account creation request sent by the target user through the user terminal.

3. The account management method according to claim 1, characterized in that: The private key of the mirror account is encrypted twice using the private key of the primary account, including: The private key of the mirror account is digitally signed using the private key of the primary account.

4. The account management method according to claim 3, characterized in that: The private key of the mirror account is digitally signed using the private key of the primary account, including: Calculate the private key of the mirror account using a hash algorithm to obtain a first hash value; The first hash value is encrypted using the private key of the primary account to obtain a digital signature of the private key of the mirror account.

5. The account management method according to any one of claims 1 to 4, characterized in that: Grant corresponding permissions and validity periods to the private key of each mirror account, including: Establish a valid account list, add the public key and private key of the mirror account to the valid account list, and set the validity period of the mirror account; The private key of the mirror account and the identifier representing the authority are written into the electronic key.

6. The account management method according to claim 4, characterized in that: Also includes: Get the public key of the mirror account entered by other users when logging in; Use the private key of the mirror account in the electronic key inserted by the user to verify whether the public key of the input mirror account matches the private key in the electronic key; When the public key of the input mirror account matches the private key in the electronic key, verify the timeliness of the private key of the mirror account; When the verification is passed, the authority of the private key of the mirror account is determined.

7. The account management method according to claim 6, characterized in that: Also includes: Decrypting the digital signature using the public key of the primary account; When the digital signature is successfully decrypted to obtain the first hash value, determining that the digital signature is issued by the target user; Calculate the private key of the mirror account using a hash algorithm to obtain a second hash value; The first hash value is compared with the second hash value. When the first hash value is the same as the second hash value, a step is performed to verify whether the public key of the input mirror account matches the private key in the electronic key using the private key of the mirror account in the electronic key inserted by the user.

8. An account management transposition, characterized in that: include: An information acquisition module, configured to, in response to a mirror account creation request sent by a target user through a user terminal, acquire the basic personal information authorized by the target user, wherein the basic personal information includes a key identity identifier and a plurality of additional identifiers of the target user, wherein the mirror account is a mirror image of the target user's account, the key identity identifier is a key unique identifier in the core part of the target user's account used to characterize the identity of the target user, and the additional identifier is a unique user identifier that does not include the key identity identifier; A first private key generation module, configured to use the key identity as the public key of the primary account and generate a private key paired with the public key of the primary account based on identity cryptography technology; A second private key generation module is used to generate a private key paired with the public key of the mirror account based on the identity cryptography technology for each of the additional identifiers, using the additional identifier as the public key of the mirror account; A secondary encryption module, used to perform secondary encryption on the private key of the mirror account using the private key of the primary account; The authorization module is used to grant corresponding permissions and time limits to the private key of each mirror account, and authorize the mirror account to other users for temporary use.

9. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the account management method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the account management method as described in any one of claims 1 to 7 is implemented.

Images