Pki-based password remote assistance method, system and electronic device

Abstract

The PKI-based password remote assistance method, system and electronic device disclosed in the application comprises the following steps: obtaining a receiver ID account, setting read-write permission and limitation conditions for the receiver ID account, and recording the receiver ID account in a shareable ID list; obtaining a receiver asymmetric public key; encrypting password information to be shared by using the receiver asymmetric public key to obtain a second encrypted package; sending the second encrypted package, the shareable ID list and a sender asymmetric public key to the receiver; and the receiver performs the first operation step, which comprises: judging whether the receiver is in the shareable ID list and whether the read-write permission and the limitation conditions are met; and if any condition is not met, encrypting the second encrypted package by using the sender asymmetric public key to obtain a third encrypted package. Compared with the prior art, the technical solution disclosed in the application can improve the security of password remote assistance, prevent password abuse, and reduce the negative impact caused by password leakage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of password management, more particularly to a password remote assistance method based on PKI; the present application also relates to a password remote assistance system based on PKI; and the present application also relates to an electronic device. BACKGROUND

[0002] When a password or some secret information needs to be used in a certain field, the user (sender) cannot operate by himself / herself because he / she is not in the field, and other people (receiver) need to perform remote assistance operation, the user needs to share his / her password or secret information with the people who assist the operation in the field, but if the password is directly sent to the assistants through a mobile terminal, there is a risk of leakage in the communication link, and the people who assist the operation may also misuse the password.

[0003] Therefore, how to provide a password remote assistance method based on PKI, which is applied to password management, can improve the security of password remote assistance, and reduce the negative impact caused by password leakage, has become a technical problem to be solved by the technical personnel in the field. SUMMARY

[0004] To solve the above technical problems, the present application provides a password remote assistance method based on PKI, which can improve the security of password remote assistance, prevent password misuse, and reduce the negative impact caused by password leakage.

[0005] The present application provides a password remote assistance method based on PKI, which issues a digital certificate to a user through the CA function of the software on the PC. When the user has registered the digital certificate in advance and needs remote assistance on the password, the assistant can register the digital certificate on the spot, the user who needs to share information authorizes the assistant to use the password or secret information, so that the assistant can remotely view the relevant password or secret information. The password or secret information is encrypted in an asymmetric manner to ensure that only the assistant can decrypt and view it. SSL VPN is used when transmitting the password information to maximize the security of information transmission.

[0006] The technical scheme provided by the present application is as follows:

[0007] The present application provides a password remote assistance method based on PKI, which includes: obtaining a receiver ID account, setting read-write permissions and restriction conditions for the receiver ID account, and recording the receiver ID account in a shareable ID list; obtaining a receiver asymmetric public key; if the sender's to-be-logged-in device terminal is a fixed password login, performing a first operation step;

[0008] The sending party performs the first operation step, which includes: encrypting the to-be-shared password information by the receiving party asymmetric public key to obtain a second encrypted package; and sending the second encrypted package, the shareable ID list and the sending party asymmetric public key to the receiving party.

[0009] The receiving party performs the first operation step, which includes: judging whether the receiving party is in the shareable ID list and whether the read-write permission and the restriction condition are met; if both are met, the receiving party decrypts the second encrypted package by the receiving party asymmetric private key to obtain the to-be-shared password information; if any of the conditions is not met, the second encrypted package is encrypted by the sending party asymmetric public key to obtain a third encrypted package.

[0010] Further, in a preferred mode of the present application, the read-write permission includes: read-write permission and read-only permission.

[0011] Further, in a preferred mode of the present application, the restriction condition includes: one or more of a use time limit, a use device, and a use geographical range limit; the use time limit is a time limit for the receiving party to operate the second encrypted package after receiving the second encrypted package; the use device is a permitted device used by the receiving party to receive and process the second encrypted package; and the use geographical range limit is a permitted geographical position where the receiving party uses the permitted device.

[0012] Further, in a preferred mode of the present application, the method further includes: synchronizing the shareable ID list to a server.

[0013] Further, in a preferred mode of the present application, the "obtaining the receiving party asymmetric public key" specifically includes: sending an assistance instruction to the receiving party by the sending party; after the receiving party confirms, sending the receiving party asymmetric public key to the sending party; and the sending party obtains the receiving party asymmetric public key.

[0014] Further, in a preferred mode of the present application, the "sending the second encrypted package, the shareable ID list and the sending party asymmetric public key to the receiving party" specifically includes: the sending party sends the second encrypted package to the server, and the server sends the second encrypted package, the shareable ID list and the sending party asymmetric public key to the receiving party.

[0015] Further, in a preferred mode of the present application, the method further includes: after the server encrypts the to-be-shared password information of the sending party in combination with the sending party asymmetric public key to obtain a first encrypted package, the first encrypted package is sent to the sending party; and after the sending party receives the first encrypted package, the to-be-shared password information is obtained by decrypting the first encrypted package by the sending party asymmetric private key.

[0016] Further, in a preferred mode of the present application, the method further comprises: if the to-be-logged-in device of the sender is a dynamic password login, performing the second operation step.

[0017] The second operation step performed by the sender comprises: the password in the to-be-shared password information is a dynamic password; after the receiving party account information is logged in by the to-be-logged-in device of the sender, a dynamic password is generated; the to-be-shared password information is encrypted by the asymmetric public key of the receiving party to obtain a fourth encrypted package; and the fourth encrypted package is sent to the receiving party through the server.

[0018] The second operation step performed by the receiving party comprises: the fourth encrypted package is decrypted by the asymmetric private key of the receiving party to obtain the to-be-shared password information.

[0019] The present application also provides a PKI-based password remote assistance system, which is used to perform the above-mentioned PKI-based password remote assistance method, and comprises: a first processing module arranged on the mobile terminal of the sender, which is used to obtain the ID account of the receiving party, set the read-write permission and the limitation condition for the ID account of the receiving party, and record the ID account of the receiving party in the shareable ID list; a first obtaining module arranged on the mobile terminal of the sender, which is used to obtain the asymmetric public key of the receiving party; a first execution module used to perform the first operation step; and a second execution module used to perform the second operation step.

[0020] The present application also provides a PKI-based password remote assistance system, which is used to perform the above-mentioned PKI-based password remote assistance method, and comprises: a server; a to-be-logged-in device terminal of the sender in data connection with the server, which needs to be logged in by a fixed password or a dynamic password; a mobile terminal of the sender in data connection with the server, which is used to perform the first operation step or the second operation step; and a mobile terminal of the receiving party in data connection with the server, which is used to perform the first operation step or the second operation step.

[0021] The present application also provides an electronic device, which comprises: a computer program used to perform the above-mentioned PKI-based password remote assistance method; a memory used to store the computer program; and a processor used to execute the computer program.

[0022] Compared with the prior art, in the technical scheme, the receiver needs to be a user of the password management system and has an ID account. In the initial stage, the sender acquires the ID account of the receiver, and after setting read-write permissions and restriction conditions for the ID account of the receiver, the ID account is added to the ID list associated with the sender; after acquiring the asymmetric public key of the receiver, different operation steps are performed according to the password type of the device terminal to be logged in by the sender, and if the device terminal to be logged in by the sender is in a fixed password login mode, the first operation step is performed. In the first operation step, the sender encrypts the password information to be shared by using the asymmetric public key of the receiver to obtain a second encrypted package. The second encrypted package, the shareable ID list and the asymmetric public key of the sender are sent to the receiver; and the receiver's device terminal judges. The receiver needs to meet the following conditions to decrypt the second encrypted package: the ID account of the receiver needs to be in the shareable ID list, and the receiver meets the read-write permissions and restriction conditions; if any of the above conditions is not met, the receiver's device terminal will encrypt the second encrypted package by using the asymmetric public key of the sender to obtain a third encrypted package, so that the receiver cannot decrypt the third encrypted package, ensuring the security of the password of the sender. By setting the permissions and restriction conditions of the receiver for processing the second encrypted package, the abuse of the second encrypted package by the receiver is prevented; by encrypting the second encrypted package into the third encrypted package by using the asymmetric public key of the sender, even if the third encrypted package is leaked by the receiver, the third encrypted package cannot be decrypted by an external device to obtain the password, avoiding the negative impact of password leakage on the sender. The technical scheme provided by the present application can improve the security of password remote assistance, prevent password abuse, and reduce the negative impact of password leakage. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical schemes in the embodiments of the present application or the prior art, the drawings needed in the following embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0024] Figure 1 Flowchart of only the first operation step of the PKI-based password remote assistance method provided by the embodiment of the present application;

[0025] Figure 2 Flowchart of the PKI-based password remote assistance method provided by the embodiment of the present application with the first operation step and the second operation step;

[0026] Figure 3 Structure diagram of the PKI-based password remote assistance system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0027] In order for those skilled in the art to better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.

[0028] It should be noted that when an element is referred to as being "fixed" or "disposed" on another element, it can be directly on the other element or indirectly disposed on the other element; when an element is referred to as being "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element.

[0029] It should be understood that the terms "length", "width", "upper", "lower", "front", "back", "first", "second", "vertical", "horizontal", "top", "bottom", "inner", "outer" and the like indicate the orientation or positional relationship shown in the drawings based on the orientation or positional relationship shown in the drawings, and are only for the purpose of facilitating the description of the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation on the present application.

[0030] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "a plurality of", "several" is two or more, unless otherwise explicitly specified.

[0031] It should be understood that the structures, proportions, sizes and the like shown in the drawings of the present application are only used to cooperate with the content disclosed in the specification, to enable those skilled in the art to understand and read, and do not have technical substantive significance, and any modification of the structure, change of the proportion relationship or adjustment of the size, without affecting the effect and purpose that can be achieved by the present application, should still fall within the scope of the technical content disclosed by the present application.

[0032] Please note that Figure 1 and Figure 3As shown, the PKI-based password remote assistance method provided by the embodiment of the application includes: obtaining a receiver ID account, setting read-write permissions and restriction conditions for the receiver ID account, and then recording the receiver ID account in a shareable ID list; obtaining a receiver asymmetric public key; if the to-be-logged-in device terminal of the sender is in a fixed password login mode, a first operation step is performed; the first operation step performed by the sender includes: encrypting the to-be-shared password information by using the receiver asymmetric public key to obtain a second encrypted package; sending the second encrypted package, the shareable ID list, and the sender asymmetric public key to the receiver; the first operation step performed by the receiver includes: judging whether the receiver is in the shareable ID list and whether the read-write permissions and the restriction conditions are met; if both conditions are met, the receiver decrypts the second encrypted package by using a receiver asymmetric private key to obtain the to-be-shared password information; if any one of the conditions is not met, the second encrypted package is encrypted by using the sender asymmetric public key to obtain a third encrypted package.

[0033] The technical scheme of the PKI-based password remote assistance method provided by the embodiment of the application is used to solve the problem that the password is easily leaked or misused due to remote assistance by others. In the technical scheme, the receiver needs to be a user of a password management system and has an ID account. In the initial stage, the sender obtains the ID account of the receiver, sets read-write permissions and restriction conditions for the ID account of the receiver, and then records the ID account in an ID list associated with the sender. After obtaining the asymmetric public key of the receiver, different operation steps are performed according to the password type of the to-be-logged-in device terminal of the sender. If the to-be-logged-in device terminal of the sender is in a fixed password login mode, a first operation step is performed. In the first operation step, the sender encrypts the to-be-shared password information by using the receiver asymmetric public key to obtain a second encrypted package. The second encrypted package, the shareable ID list, and the sender asymmetric public key are sent to the receiver, and the receiver's device terminal performs a judgment. The receiver needs to meet the following conditions to decrypt the second encrypted package: the ID account of the receiver needs to be in the shareable ID list, and the receiver needs to meet the read-write permissions and the restriction conditions. If any one of the conditions is not met, the receiver's device terminal will encrypt the second encrypted package by using the sender asymmetric public key to obtain a third encrypted package, so that the receiver cannot decrypt the third encrypted package, and the security of the password of the sender is ensured. By setting the permissions and the restriction conditions of the receiver for processing the second encrypted package, the misuse of the second encrypted package by the receiver is prevented. By encrypting the second encrypted package into the third encrypted package by using the sender asymmetric public key, even if the third encrypted package is leaked by the receiver, the third encrypted package cannot be decrypted by an external device to obtain the password, and the negative impact of the password leakage on the sender is avoided. The technical scheme provided by the application can improve the security of password remote assistance, prevent password misuse, and reduce the negative impact of password leakage.

[0034] It should be noted that the password information to be shared includes a password and other secret information.

[0035] Specifically, in the embodiment of the present application, the read-write permission includes read-write permission and read-only permission.

[0036] It should be noted that the sender sets the read permission for the sender password data operated for the receiver ID account when the receiver ID account is entered. Specifically, the read-write permission is to read and write the sender password; the read-only permission is to read the sender password to obtain the password information.

[0037] Specifically, in the embodiment of the present application, the restriction condition includes one or more of the following: a use period, a use device, and a use geographical range restriction; the use period is a time limit for the receiver to operate the second encrypted package after receiving the second encrypted package; the use device is a permitted device for the receiver to receive and process the second encrypted package; and the use geographical range restriction is a permitted geographical position for the receiver to use the permitted device.

[0038] It should be noted that further, by setting the use period, the use device, and the use geographical range, the receiver is prevented from decrypting and processing the second encrypted package at a non-designated time, on a non-designated device, or in a non-designated area; thereby further ensuring the safety of the time, running basis, and environment for the receiver to process the second encrypted package after the second encrypted package is sent to the receiver, and improving the security of the password remote assistance management.

[0039] Specifically, in the embodiment of the present application, the method further includes synchronizing the shareable ID list to a server.

[0040] It should be noted that the sender synchronizes the shareable ID list to the server after updating the shareable ID list, so that the server can assist in identifying and sending relevant data to the receiver, reduce the data storage pressure of the sender, and ensure the convenience and security of data sending.

[0041] Specifically, in the embodiment of the present application, the "obtaining the asymmetric public key of the receiver" specifically includes: the sender sending an assistance instruction to the receiver; after the receiver confirms, the receiver sends the asymmetric public key of the receiver to the sender; and the sender obtains the asymmetric public key of the receiver.

[0042] It should be noted that only when the sender actively sends the remote assistance instruction to the receiver and the receiver confirms, the sender can receive the asymmetric public key of the receiver; so as to facilitate subsequent encryption of the to-be-shared password information in combination with the asymmetric public key of the receiver, and only the receiver can decrypt the second encrypted package by using the asymmetric private key of the receiver, thereby further improving the security of password management.

[0043] Specifically, in the embodiment of the present application, the "sending the second encrypted package, the shareable ID list and the sender asymmetric public key to the receiver" specifically refers to that the sender sends the second encrypted package to the server, and the server sends the second encrypted package, the shareable ID list and the sender asymmetric public key to the receiver.

[0044] It should be noted that only the second encrypted package is sent by the sender, and the shareable ID list and the sender asymmetric public key are directly sent by the server, so as to reduce the information pressure of the sender sending data and improve the security.

[0045] Specifically, in the embodiment of the present application, the method further comprises: the to-be-shared password information of the sender is sent to the sender after being encrypted into a first encrypted package by the server in combination with the sender asymmetric public key; and the to-be-shared password information is obtained by the sender after receiving the first encrypted package and decrypting the first encrypted package by using the sender asymmetric private key.

[0046] It should be noted that in the embodiment, the password information of the sender is actually stored in the server, and the sender does not store the password itself, so as to prevent the password from being leaked in the terminal of the sender.

[0047] Specifically, in the embodiment of the present application, the method further comprises: if the to-be-logged-in terminal of the sender is a dynamic password login, a second operation step is performed.

[0048] The second operation step performed by the sender comprises: the password in the to-be-shared password information is a dynamic password; the dynamic password is generated after the to-be-logged-in terminal of the sender recognizes the login of the receiver account information; the to-be-shared password information is encrypted by using the receiver asymmetric public key to obtain a fourth encrypted package; and the fourth encrypted package is sent to the receiver by the server.

[0049] The second operation step performed by the receiver comprises: the fourth encrypted package is decrypted by using the receiver asymmetric private key to obtain the to-be-shared password information.

[0050] It should be noted that if the sender to be logged in device is a dynamic password login, the sender to be logged in device is installed with a sandbox module, the sandbox module is used to generate a dynamic password and check an externally input password. The generated dynamic password is directly encrypted by the server through the asymmetric public key of the receiver to obtain a fourth encrypted package, and then sent to the receiver device terminal. The receiver decrypts to obtain it. Improve the security of the sender to be logged in device.

[0051] The application also provides a PKI-based password remote assistance system for executing the above-mentioned PKI-based password remote assistance method, which comprises: a first processing module arranged on the sender mobile terminal, used for obtaining a receiver ID account, setting read-write permissions and limitation conditions for the receiver ID account, and recording the receiver ID account in a shareable ID list; a first acquisition module arranged on the sender mobile terminal, used for obtaining a receiver asymmetric public key; a first execution module used for executing the first operation step; and a second execution module used for executing the second operation step. The technical scheme of the PKI-based password remote assistance system provided by the application also has the above-mentioned technical effects.

[0052] The application also provides a PKI-based password remote assistance system for executing the above-mentioned PKI-based password remote assistance method, which comprises: a server; a sender to be logged in device terminal in data connection with the server, which needs to be logged in through a fixed password or a dynamic password; a sender mobile terminal in data connection with the server, used for executing the first operation step or the second operation step; and a receiver mobile terminal in data connection with the server, used for executing the first operation step or the second operation step. The technical scheme of the PKI-based password remote assistance system provided by the application also has the above-mentioned technical effects.

[0053] The application also provides an electronic device, which comprises: a computer program used for executing the above-mentioned PKI-based password remote assistance method; a memory used for storing the computer program; and a processor used for executing the computer program. The technical scheme of the electronic device provided by the application also has the above-mentioned technical effects.

[0054] It should be noted that the structural diagram of the application is as shown in Figure 3

[0055] ​The use scenario is an enterprise, and the CA system in the server has issued asymmetrically encrypted digital certificates to the A user mobile terminal (computer used by the user) and the A user mobile terminal (mobile phone or smart watch, smart glasses, etc. wearable device). The asymmetric encryption algorithm includes but is not limited to SM2 national encryption algorithm, RSA, Elgamal, knapsack algorithm, Rabin, D-H, etc. The private key of the digital certificate is stored in the PC of the user A and the mobile terminal of the user A respectively; the server has stored the information of each client (computer), including the client network card number, the public key of the client digital certificate; the server has stored the user information, including the user login account, the login password, the user mobile terminal public key and other information.

[0056] Further, the functions of the main parts of the system are introduced as follows:

[0057] 1. Server:

[0058] (1) Provide registration user and device information management service:

[0059] The registration user and device information includes: registration user (user ID, such as yd0345) and its bound device (user account bound PC (MAC address, etc.), mobile phone (IMEI code, etc.) and other information), user digital certificate information (certificate contains user A ID, user account ID bound PC information (certificate computer network card MAC number, etc.), mobile phone information (employee personal mobile phone IMEI number, etc.), user A asymmetric public key information, etc.

[0060] When the server transmits and shares information, it needs to check whether the use permission of a certain password or secret of the information sending and receiving party and the use limitation condition meet the requirements, such as sending if meeting the requirements, so the server also needs to save the following information:

[0061] a. All the numbers of the passwords or secrets established by the user (give a number to each password or secret of the user, such as the employee ID + type code + number, for example: the number of a password is yd0345 (employee ID) 003 (password) 0032 (order number in the password category), that is, yd03450030032)

[0062] b. User-established password or secret has ID list of operation permissions (permissions include read-write or read-only types, etc.) (for example, the password or secret has 1 user with read-write permissions and another user with read-only permissions), usage period (usage period of users with operation permissions on the password: users with read-write permissions need to change the password every certain period of time (e.g., 1 day / 1 week / 1 month / forever, etc.), and users with read-only permissions have a usage period (e.g., 1 time / 3 times / 1 day, etc.)), usage device and geographical range restrictions (the password is limited to use within a certain geographical range (IP belonging range), etc.)

[0063] (2) Provide ciphertext information transfer service:

[0064] The password or secret is encrypted using the asymmetric public key of the user himself or an assistant, and is stored in the user's personal mobile phone and computer in the form of encrypted ciphertext. When user A needs user B to provide remote password support or assistance, user A uploads the encrypted ciphertext (second encrypted package) of the password to be shared using user B's public key to the server through SSL VPN, etc. The server forwards the ciphertext (second encrypted package) to user B, which is decrypted and viewed by user B using his own private key in the personal terminal.

[0065] (3) Provide personal PC software and mobile terminal software downloads for users: Users can download PC software and mobile terminal software through the server before registration.

[0066] 2. PC software:

[0067] (1) Certificate making and certificate management: The PC software includes CA function, which can apply for certificate for users or devices that have not applied for certificate, and can manage existing digital certificate, including but not limited to adding, querying and modifying digital work certificate making operation, etc. The PC software communicates with the server through SSL VPN when making certificate.

[0068] (2) Password and information maintenance and inspection: Users can enter passwords and related information (related information refers to the use scenario of the password, such as the name of a certain software, the computer number and use page website of the software login password, etc.) through the PC software. Passwords are divided into dynamic passwords and non-dynamic passwords. Dynamic passwords are important passwords for enterprises or employees, which need to be changed regularly and use the one-time password principle (such as the boot password of some important computers of the company); non-dynamic passwords are passwords that do not need to be updated in real time (such as employee personal ERP account password, etc.). Once the password is entered, it is encrypted using the user's asymmetric public key and stored.

[0069] 3. Mobile terminal software:

[0070] (1) Mobile phone verification code login: The software can be logged in through the form of mobile phone SMS verification code.

[0071] (2) Password and its information maintenance and check: this function is the same as the PC terminal software

[0072] (3) Password decryption display or sharing: the password is stored in the mobile terminal in the form of ciphertext encrypted by the asymmetric public key of the user, and the asymmetric private key is also stored in the mobile terminal software.

[0073] View: when the user needs to view, the asymmetric private key in the mobile terminal is used for decryption.

[0074] Remote assistance: when user A needs to share the password with user B in remote assistance, the private key of user A is used for decryption first, and the public key of user B is used for encryption to form ciphertext (second encryption package) which is forwarded to user B through the server, and user B needs to use his own asymmetric private key for decryption and use the password or secret.

[0075] 4. One-time password, i.e. system using dynamic password (need to install sandbox software)

[0076] (1) Dynamic password function (see the following description for use and process)

[0077] Example 1

[0078] Non-one-time password related process and method

[0079] 1. User A and user B are employees of a certain enterprise, user A has installed PC terminal software and mobile terminal software in advance, and has a digital certificate issued by the PC terminal software (the certificate contains user A's work ID, user account ID binding PC terminal information (certificate issuing computer network card MAC number, etc.), mobile phone information (employee personal mobile phone IMEI number and other information), user A's asymmetric public key information, etc.). User A creates several passwords and perfects password number, related permissions, use restriction conditions and other information. And saves user A's various information (user number and binding device information, password number, use permission, use restriction condition, etc.) in the server

[0080] 2. User A is in a foreign place and needs to assist user B in the enterprise remotely, and uses a certain password of A on A's PC terminal to perform related operations, so as to share the password with B.

[0081] 3. If the current user B does not have a digital certificate, it is necessary to download the relevant software from the server and install it on the PC and mobile terminal of user B, use the PC software of user B to issue a digital certificate for user B, and upload the user information of user B to the server (the PC and the server are connected through SSL VPN), complete the preparation work. If user B has completed the registration and other preparation work of the digital certificate, user B can use the communication tool (email, short message, WeChat, etc.) to inform user A of the user ID of user B

[0082] 4. User A shares the password or secret information to be shared with user B

[0083] (1) Add the ID of user B to the ID list of the password to be shared, and set user B to have read-only permission, and synchronize the revised information to the server.

[0084] (2) Set the restriction conditions for user B to use the password, such as setting B to be able to use the password within 24 hours from the authorized time, and the user's location must be inside the enterprise when using, and synchronize the revised information to the server.

[0085] (3) User A's operation process for the password

[0086] a. User A initiates a request to the server in the mobile terminal software, requiring to obtain the asymmetric public key information of user B.

[0087] b. After receiving the request, the server requests user B for confirmation, and user B confirms in the mobile terminal of user B to allow user A to obtain the public key information of user B (if user B refuses, user A cannot obtain the public key of user B, and the sharing fails); after receiving the feedback that user B has confirmed, the server sends the asymmetric public key information of user B to user A through SSL VPN.

[0088] c. After user A obtains the asymmetric public key information of user B, user A uses the asymmetric private key in the mobile terminal to decrypt the ciphertext (ciphertext 1) of the password to be shared, and then uses the asymmetric public key of user B to encrypt the decrypted password, thereby obtaining the ciphertext (second encrypted package) of the password to be shared.

[0089] d. User A uploads ciphertext 2 to the server through SSL VPN, and specifies the sending target as the mobile terminal of user B.

[0090] (4) After the server receives ciphertext 2, the server sends ciphertext 2, the use ID list of the password corresponding to ciphertext 2, the use restriction conditions, and the public key of user A to the mobile terminal of user B through SSL VPN.

[0091] 5. After the mobile terminal of user B receives ciphertext 2, the public key of user A, and other related information from the server, the operation process is as follows:

[0092] (1) The mobile terminal software of user B checks whether the ciphertext 2 currently meets the decryption restriction condition, and the required checking restriction condition includes but is not limited to the following: whether user B has the use right (whether user B is in the password use ID list, whether user B has the read-only or read-write right), the use period of the password of user B (for example, 1 time / 3 times / 1 day, etc.), the geographic position of the mobile terminal of user B (checking the current positioning information of the mobile terminal of user B, checking whether the current position of user B is within the IP territory range set by user A), etc.

[0093] (2) The checking result is that the ciphertext 2 does not meet one or more decryption restriction conditions, the mobile terminal software of user B encrypts the ciphertext 2 by using the asymmetric public key of user A to obtain ciphertext 3, and user B cannot decrypt the ciphertext 3, thereby preventing the leakage and the abuse of the password by user B.

[0094] (3) The checking result is that the ciphertext 2 meets the decryption restriction condition, the mobile terminal software of user B decrypts the ciphertext 2 by using the asymmetric private key of user B to obtain the password or secret information, and user B can normally use the information.

[0095] Embodiment 2

[0096] Related process and method of one-time-one-multiple

[0097] 1. User A and user B are employees of a certain enterprise, user A and user B have installed the mobile terminal software and have the digital certificate. A certain system (hereinafter referred to as system c) in the computer of user A in the enterprise uses the one-time-one-multiple login rule.

[0098] 2. The server stores the user attribute list of the login system c in the enterprise, and the list includes the following attributes: user login ID, PC MAC card code that can be logged in by the ID, operation right (read-only, read-write, etc.) of the ID on each loginable PC, and login time limit of the ID on each loginable PC (for example, an ID can log in the system c of a certain PC in the enterprise within 24 hours / 1 week / 1 month, and has the read-only right). The mobile terminal software of each user stores the PC MAC card code that can be logged in by the user ID, the operation right of the user ID on each loginable PC, and the login time limit of the ID on each loginable PC.

[0099] 3. When user A is in an external place and needs user B to log in the system c on the computer in the enterprise to perform a certain operation (user A is the administrator of the computer), user A grants the login right of the system c of the PC to the ID of user B in the mobile terminal software, and the modified information is synchronized to the server through the SSL VPN.

[0100] 4. User B enters the user name (ID of user B) and the login password in the login interface when logging into the system c in user A's computer, and clicks confirm. The system c monitors the login of the user, and uploads the login ID filled in by the user to the server through SSL VPN. The server searches the user attribute list for the user name, and checks whether the user has the use right of the computer (MAC number).

[0101] 5. The system c of user A's computer changes the login password after monitoring that the ID of user B has the login right, downloads the asymmetric public key of the login ID (i.e. the asymmetric public key of user B) from the server, and encrypts the changed new password with the public key of user B, and uploads the ciphertext to the server through SSL VPN.

[0102] 6. The server forwards the ciphertext to the mobile terminal software of user B after receiving the ciphertext, and the mobile terminal software of user B decrypts the ciphertext with the asymmetric private key of user B to obtain the login password.

[0103] The above description of disclosed embodiments enables those skilled in the art to carry out or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments shown herein, but will accord with the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for password remote assistance based on PKI, characterized in that, The method comprises the steps of: obtaining a receiver ID account, setting read-write permissions and restrictions for the receiver ID account, and recording the receiver ID account in a shareable ID list; obtaining a receiver asymmetric public key; if the sender's to-be-logged-in device terminal is a fixed password login, performing a first operation step; the sender performing the first operation step comprises: encrypting the to-be-shared password information by using the receiver asymmetric public key to obtain a second encrypted package, and sending the second encrypted package, the shareable ID list, and a sender asymmetric public key to the receiver; the receiver performing the first operation step comprises: determining whether the receiver meets the three conditions of being in the shareable ID list, meeting the set read-write permissions, and meeting the set restrictions; if the three conditions are met, the receiver decrypts the second encrypted package by using a receiver asymmetric private key to obtain the to-be-shared password information; if any of the three conditions is not met, a third encrypted package is obtained by encrypting the second encrypted package by using the sender asymmetric public key.

2. The PKI-based password remote assistance method of claim 1, wherein, The read-write permissions include read-write permissions and read-only permissions.

3. The PKI-based password remote assistance method of claim 1, wherein, The restrictions include one or more of a use period, a use device, and a use geographic range restriction; the use period is a time period during which the receiver can operate the second encrypted package after receiving the second encrypted package; the use device is a permitted device that the receiver can use to receive and process the second encrypted package; the use geographic range restriction is a permitted geographic location in which the receiver uses the permitted device.

4. The PKI-based password remote assistance method of claim 1, wherein, The method further comprises synchronizing the shareable ID list to a server; and / or the "obtaining a receiver asymmetric public key" specifically comprises: sending an assistance instruction to the receiver by the sender; after the receiver confirms, sending a receiver asymmetric public key to the sender; and the sender obtains the receiver asymmetric public key.

5. The PKI-based password remote assistance method of claim 1, wherein, the "sending the second encrypted package, the shareable ID list, and the sender asymmetric public key to the receiver" specifically comprises: the sender sends the second encrypted package to the server, and the server sends the second encrypted package, the shareable ID list, and the sender asymmetric public key to the receiver.

6. The PKI-based password remote assistance method according to any one of claims 1 to 5, characterized in that, The method further comprises: after the to-be-shared password information of the sender is encrypted into a first encrypted package by the server in combination with the sender asymmetric public key, the first encrypted package is sent to the sender; after the sender receives the first encrypted package, the to-be-shared password information is obtained by decrypting the first encrypted package by using a sender asymmetric private key.

7. The PKI-based password remote assistance method according to any one of claims 1 to 5, characterized in that, The method further comprises: if the sender's to-be-logged-in device terminal is a dynamic password login, performing a second operation step; the sender performing the second operation step comprises: the password in the to-be-shared password information is a dynamic password; after the sender's to-be-logged-in device recognizes the receiver account information login, the dynamic password is generated; the to-be-shared password information is encrypted by using the receiver asymmetric public key to obtain a fourth encrypted package; the fourth encrypted package is sent to the receiver by the server; the receiver performing the second operation step comprises: the receiver decrypts the fourth encrypted package by using a receiver asymmetric private key to obtain the to-be-shared password information.

8. A password remote assistance system based on PKI, characterized in that, The system is used for executing the PKI-based password remote assistance method in any one of claims 1 to 7, comprising: a first processing module, configured to acquire a receiver ID account, set read-write permission and limitation conditions for the receiver ID account, and record the receiver ID account in a shareable ID list; a first acquiring module arranged on the sender mobile terminal and configured to acquire a receiver asymmetric public key; a first executing module configured to execute the first operation step; a second executing module configured to execute the second operation step.

9. A password remote assistance system based on PKI, characterized in that, The system is used for executing the PKI-based password remote assistance method in any one of claims 1 to 7, comprising: a server; a sender to-be-logged-in device terminal in data connection with the server, which needs to be logged in through a fixed password or a dynamic password; a sender mobile terminal in data connection with the server, which is used for executing the first operation step or the second operation step; a receiver mobile terminal in data connection with the server, which is used for executing the first operation step or the second operation step.

10. An electronic device, characterized by comprising: a computer program, configured to execute the PKI-based password remote assistance method in any one of claims 1 to 7; a memory, configured to store the computer program; a processor, configured to execute the computer program.

Images