Public key recovery method and device, electronic equipment and storage medium

Abstract

The invention provides a public key recovery method and device, electronic equipment and a storage medium, and belongs to the technical field of communication. The method comprises the steps of displaying a password input interface in response to a public key recovery request of a browser client; generating a first secret key based on the identity label of the browser client in response to the fact that the password input in the password input interface passes verification; decrypting locally backed-up public key encrypted data through the first secret key to obtain the browser public key; and returning the browser public key to the browser client. According to the scheme, local recovery of the browser public key can be achieved, the reliability and stability of the passkey function are improved, the password input by the user serves as the necessary premise for decrypting the public key encrypted data, the safety of the locally-stored public key encrypted data can be protected, and the data safety is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a public key recovery method, device, electronic device and storage medium. Background Art

[0002] With the continuous development of communication technology, passkey is usually used to replace the traditional way of logging into websites with account and password. Among them, Passkey is a password-free login solution initiated and promoted by the FIDO (Fast IDentity Online) Alliance, which supports biometrics, Pin (Personal identification number) and other ways to log into websites.

[0003] At present, the mainstream Passkey solution in the industry is: the electronic device generates a pair of public and private keys for each user's account on the website. Among them, the browser client holds the public key and verifies the user identity corresponding to the account through the public key. However, when the browser client fails and the locally stored browser public key is damaged, the browser client's support for Passkey functions will be abnormal. Therefore, how to recover the locally stored browser public key is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present application provide a public key recovery method, device, electronic device and storage medium, which can realize local recovery of browser public keys, improve the reliability and stability of the passkey function, and protect the security of locally stored public key encrypted data by using the password entered by the user as a necessary prerequisite for decrypting public key encrypted data, thereby improving data security. The technical solution is as follows:

[0005] According to one aspect of an embodiment of the present application, a public key recovery method is provided, the method comprising:

[0006] In response to a public key recovery request from a browser client, displaying a password input interface, wherein the public key recovery request is used to request recovery of a damaged browser public key in the browser client;

[0007] In response to the password input in the password input interface being verified, generating a first key based on the identity of the browser client, the password being used to determine whether the user account has the authority to restore the browser public key, the first key being a symmetric key associated with the identity;

[0008] Decrypting the locally backed-up public key encrypted data using the first key to obtain the browser public key, wherein the public key encrypted data is encrypted data obtained by encrypting the browser public key using the first key;

[0009] Return the browser public key to the browser client.

[0010] According to another aspect of an embodiment of the present application, a public key recovery device is provided, the device comprising:

[0011] A first display module, configured to display a password input interface in response to a public key recovery request from a browser client, wherein the public key recovery request is used to request recovery of a damaged browser public key in the browser client;

[0012] A generating module, configured to generate a first key based on the identity of the browser client in response to the password inputted in the password input interface being verified, wherein the password is used to determine whether the user account has the authority to restore the browser public key, and the first key is a symmetric key associated with the identity;

[0013] A decryption module, used to decrypt the locally backed-up public key encrypted data by using the first key to obtain the browser public key, wherein the public key encrypted data is encrypted data obtained by encrypting the browser public key by using the first key;

[0014] The sending module is used to return the browser public key to the browser client.

[0015] In some embodiments, the first display module includes:

[0016] A first acquisition unit, configured to acquire an identity and a security level of the browser client in response to a public key recovery request of the browser client;

[0017] The display unit is used to display the password input interface when the identity identifier of the browser client is a legal identity identifier and the security level of the browser client is a target security level, and the target security level is used to indicate that the browser client has no security risk.

[0018] In some embodiments, the generating module comprises:

[0019] A second acquiring unit, configured to acquire a password inputted on the password input interface in response to a password input operation on the password input interface;

[0020] A generating unit is used to generate the first key based on the identity identifier of the browser client when the password is consistent with the identity identification code of the user account, and the identity identification code is used to identify the identity of the user account.

[0021] In some embodiments, the decryption module is used to decrypt the key-encrypted data associated with the public key-encrypted data using the first key to obtain a second key, wherein the key-encrypted data is encrypted data obtained by encrypting the second key using the first key, and the second key is a symmetric key different from the first key; the public key-encrypted data is decrypted using the second key to obtain the browser public key.

[0022] In some embodiments, the decryption module is used to decrypt the public key encrypted data using the first key to obtain key encrypted data, where the key encrypted data is encrypted data obtained by encrypting the browser public key using a second key, where the second key is a symmetric key different from the first key; the key encrypted data is decrypted using the second key to obtain the browser public key.

[0023] In some embodiments, the apparatus further comprises:

[0024] The clearing module is used to clear the first key from the memory when the decryption is completed using the first key.

[0025] In some embodiments, the apparatus further comprises:

[0026] The first display module is further used to display the password input interface in response to a public key backup request from the browser client, wherein the public key backup request is used to request a backup of any browser public key in the browser client;

[0027] The generating module is further configured to generate the first key based on the identity of the browser client in response to the password inputted in the password input interface being verified, wherein the password is used to determine whether the user account has the authority to back up the browser public key;

[0028] An encryption module, used to encrypt the browser public key by using the first key to obtain public key encrypted data of the browser public key;

[0029] The storage module is used to store the public key encrypted data locally.

[0030] In some embodiments, the encryption module is used to encrypt the browser public key by a second key to obtain the public key encrypted data, where the second key is a symmetric key different from the first key; and to encrypt the second key by the first key to obtain the key encrypted data of the second key.

[0031] In some embodiments, the encryption module is used to encrypt the browser public key by a second key to obtain key-encrypted data of the browser public key, where the second key is a symmetric key different from the first key; and to encrypt the key-encrypted data by the first key to obtain the public key-encrypted data.

[0032] In some embodiments, the first display module is used to respond to the public key backup request of the browser client and obtain the browser public key carried in the public key backup request; when the browser public key is the public key of the target website, the password input interface is displayed, and the target website is a website with a browsing frequency greater than a frequency threshold in the browser client.

[0033] In some embodiments, the apparatus further comprises:

[0034] A second display module, configured to display an account login interface in response to an account login operation on the browser client;

[0035] The second display module is further configured to display a password setting interface when the login password input on the account login interface is consistent with the account password of the user account;

[0036] an acquisition module, configured to acquire, in response to a password setting operation on the password setting interface, an identity identification code set on the password setting interface, wherein the identity identification code is used to identify the identity of the user account;

[0037] A setting module is used to set the identity identification code as the correct password of the password input interface.

[0038] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the public key recovery method as described in the above aspect.

[0039] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the public key recovery method as described in the above aspects.

[0040] According to another aspect of an embodiment of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a computer device, it is used to implement the public key recovery method described in the above aspects.

[0041] According to another aspect of an embodiment of the present application, a computer program product is provided, wherein the computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the public key recovery method described in the above aspect.

[0042] The embodiment of the present application provides a public key recovery method. In the case where the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can request the user to enter a password by displaying a password input interface to confirm whether the user has the authority to recover the browser public key. After the password entered by the user is verified, the terminal can generate a first key associated with the identity identifier based on the identity identifier of the browser client, and then decrypt the public key encrypted data based on the first key to obtain the browser public key to be recovered. This solution realizes the local recovery of the browser public key, improves the reliability and stability of the passkey function, and by using the password entered by the user as a necessary prerequisite for decrypting the public key encrypted data, it can protect the security of the locally stored public key encrypted data and improve data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0044] Figure 1 It is a schematic diagram of an implementation environment of a public key recovery method provided in an embodiment of the present application;

[0045] Figure 2 is a flowchart of a public key recovery method provided by an embodiment of the present application;

[0046] Figure 3 is a flowchart of another public key recovery method provided by an embodiment of the present application;

[0047] Figure 4 It is a structural schematic diagram of a public key recovery device provided in an embodiment of the present application;

[0048] Figure 5It is a structural schematic diagram of another public key recovery device provided in an embodiment of the present application;

[0049] Figure 6 It is a structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0051] In this article, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0052] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions. For example, the browser public key and public key encryption data involved in this application are obtained with full authorization.

[0053] The public key recovery method provided in the embodiment of the present application can be executed by an electronic device. Taking the electronic device as a terminal as an example, Figure 1 Schematic diagram of the implementation environment of a public key recovery method provided in an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 and the server 102 are connected via a wireless network.

[0054] In some embodiments, the terminal 101 may be a mobile phone, a desktop computer, a laptop computer, a tablet computer, an intelligent voice interaction device, a vehicle-mounted terminal, or other types of terminals. A browser client is installed and running on the terminal 101. Schematically, the terminal 101 is a terminal used by a user, and the user can use the terminal to open the browser client and browse various websites through the browser client.

[0055] In some embodiments, the server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server 102 is used to provide background services for the browser client.

[0056] In some embodiments, the server 102 undertakes the main computing work and the terminal 101 undertakes the secondary computing work; or, the server 102 undertakes the secondary computing work and the terminal 101 undertakes the main computing work; or, the server 102 and the terminal 101 adopt a distributed computing architecture to perform collaborative computing.

[0057] Figure 2 This is a flowchart of a public key recovery method provided in an embodiment of the present application. The method is executed by an electronic device. In the embodiment of the present application, the method is described by taking the execution by a terminal as an example. Figure 2 , the method comprising:

[0058] 201. In response to a public key recovery request from a browser client, the terminal displays a password input interface, where the public key recovery request is used to request recovery of a damaged browser public key in the browser client.

[0059] In an embodiment of the present application, a browser client is installed on the terminal, and the browser client stores browser public keys corresponding to multiple websites. When a user logs in to a website through the browser client, the browser client can verify the user identity corresponding to the user account through the browser public key corresponding to the website, and return the verification result to the website. In the case that the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can display a password input interface to request the user to enter a password in the password input interface. Based on the password entered by the user, the terminal can confirm whether the user account currently logged in to the terminal has the authority to recover the browser public key.

[0060] 202. In response to the password input in the password input interface being verified, the terminal generates a first key based on the identity of the browser client. The password is used to determine whether the user account has the authority to restore the browser public key. The first key is a symmetric key associated with the identity.

[0061] In an embodiment of the present application, in response to the user's input operation in the password input interface, the terminal can obtain the password input by the user and verify the password to confirm whether the user account has the authority to restore the browser public key. When the password input by the user passes the verification, it indicates that the user account currently logged in to the terminal has the authority to restore the browser public key. Therefore, the terminal can generate a first key associated with the identity identifier based on the browser client through a key derivation algorithm, and the first key is a symmetric key. Among them, the identity identifier is an identifier used to indicate the identity of the browser client, such as a client package name. The identity identifier of the client installed on the terminal is unique, and one identity identifier only represents one client. Based on the identity identifier, the terminal can identify the identity of the client associated with the identity identifier.

[0062] 203. The terminal decrypts the locally backed-up public key encrypted data using the first key to obtain the browser public key, where the public key encrypted data is encrypted data obtained by encrypting the browser public key using the first key.

[0063] In the embodiment of the present application, the first key is a symmetric key associated with the identity of the browser client, and the symmetric key can be used as both an encryption key and a decryption key. When the terminal backs up the browser public key stored in the browser client, the browser public key is encrypted by the first key to obtain public key encrypted data. Therefore, the terminal can decrypt the locally backed-up public key encrypted data by the first key to obtain the browser public key.

[0064] 204. The terminal returns the browser public key to the browser client.

[0065] In an embodiment of the present application, after decrypting the locally backed-up public key encrypted data and obtaining the browser public key to be restored, the terminal can return the browser public key to the browser client so that the browser client can restore and send the damaged browser public key.

[0066] The embodiment of the present application provides a public key recovery method. In the case where the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can request the user to enter a password by displaying a password input interface to confirm whether the user has the authority to recover the browser public key. After the password entered by the user is verified, the terminal can generate a first key associated with the identity identifier based on the identity identifier of the browser client, and then decrypt the public key encrypted data based on the first key to obtain the browser public key to be recovered. This solution realizes the local recovery of the browser public key, improves the reliability and stability of the passkey function, and by using the password entered by the user as a necessary prerequisite for decrypting the public key encrypted data, it can protect the security of the locally stored public key encrypted data and improve data security.

[0067] Figure 3 Flowchart of another public key recovery method provided in the embodiment of the present application. The method is executed by an electronic device, and in the embodiment of the present application, the method is described by taking the execution by a terminal as an example. Figure 3 , the method comprising:

[0068] 301. In response to a public key backup request from a browser client, the terminal displays a password input interface, where the public key backup request is used to request a backup of any browser public key in the browser client.

[0069] In the embodiment of the present application, a browser client is installed on the terminal, and the browser client stores browser public keys corresponding to multiple websites. When a user logs in to a website through the browser client, the browser client can verify the user identity corresponding to the user account through the browser public key corresponding to the website, and return the verification result to the website.

[0070] In the related art, if the browser client needs to recover the damaged browser public key, the browser client can recover the damaged browser public key based on the cloud-backed browser public key if the user has registered and logged in to the account corresponding to the browser client and has enabled the cloud data backup function in advance. However, in scenarios where cloud data recovery cannot be used or the user chooses not to use it (for example, the terminal network signal is poor, the user has not registered the account corresponding to the browser client, the user has not enabled the cloud data backup function, etc.), when the browser client fails and the locally stored browser public key is damaged, it will cause the browser client to have abnormal support for the Passkey function.

[0071] The embodiment of the present application provides a local recovery method of a browser public key, where the browser client can send a public key backup request to the terminal to request the terminal to back up the browser public key stored in the browser client. In response to the public key backup request, the terminal can display a password input interface to request the user to enter a password in the password input interface. Based on the password entered by the user, the terminal can confirm whether the user account currently logged in to the terminal has the authority to back up the browser public key.

[0072] It should be noted that the embodiment of the present application is described by taking the browser client as a client installed on the first terminal as an example. Optionally, the browser client can also be a client installed on the second terminal, and the first terminal can perform short-range communication with the second terminal on which the browser client is installed, and the short-range communication includes Bluetooth communication, wireless local area network communication, near field communication, etc. Among them, the browser client can send a public key backup request or a public key recovery request to the first terminal through the short-range communication connection between the first terminal and the second terminal, and the first terminal can also return the browser public key to be recovered to the browser through the short-range communication connection after receiving the public key recovery request.

[0073] In some embodiments, in order to facilitate the distinction between the password entered by the user in the password input interface and the login password of the user account, the password can be referred to as an identity identification code, such as a Pin code, in the embodiments of the present application. Accordingly, before performing public key backup or public key recovery, the terminal can set the identity identification code of the user account as the basis for verifying whether the user account has the public key backup or public key recovery authority. Specifically, in the process of setting the identity identification code, in response to the account login operation of the browser client, the terminal displays the account login interface; when the login password entered in the account login interface is consistent with the account password of the user account, the terminal displays the password setting interface; in response to the password setting operation in the password setting interface, the identity identification code set in the password setting interface is obtained, and the identity identification code is used to identify the identity of the user account; the identity identification code is set to the correct password of the password input interface. Among them, when the login password entered in the account login interface is consistent with the account password of the user account, it indicates that the user account has successfully logged in to the browser client, and the terminal can display the password setting interface for setting the identity identification code. The user enters the identity identification code of the user account in the password setting interface, so that the terminal can set the identity identification code of the user account to the correct password of the above-mentioned password input interface. That is, the identity identification code is the basis for verifying whether the user account has public key backup or public key recovery permissions.

[0074] In some embodiments, in order to reduce the storage burden of the terminal when backing up the browser public key, the terminal can back up the browser public key of the key website in a targeted manner. Accordingly, in response to the public key backup request of the browser client, the terminal obtains the browser public key carried in the public key backup request; when the browser public key is the public key of the target website, the terminal displays the password input interface. Among them, after receiving the public key backup request of the browser public key, the terminal can determine the website corresponding to the browser public key according to the browser public key carried in the public key backup request. Since the target website is a website with a browsing frequency greater than the frequency threshold in the browser client, the browsing frequency is used to indicate the average number of times the website is browsed by the user in a day. When the browsing frequency of the website is greater than the frequency threshold, it indicates that the website is a frequently used website of the user, and accordingly, the browser client uses the browser public key corresponding to the website to verify the user identity corresponding to the user account. Therefore, when the website corresponding to the browser public key is the target website, it indicates that the browsing frequency of the website corresponding to the browser public key to be backed up is greater than the frequency threshold, and the browser public key is used more frequently. The terminal can back up the browser public key and display the password input interface. On the contrary, when the website corresponding to the browser public key is not the target website, the terminal may not back up the browser public key to reduce the storage burden of the terminal.

[0075] Optionally, the terminal can determine the browsing frequency of multiple websites browsed by the user based on the browsing records in the browser client, and determine the website with a browsing frequency greater than a frequency threshold as the target website.

[0076] 302. In response to the password input in the password input interface being verified, the terminal generates a first key based on the identity of the browser client, where the password is used to determine whether the user account has the authority to back up the browser public key.

[0077] In an embodiment of the present application, in response to the user's input operation in the password input interface, the terminal can obtain the password entered by the user and verify the password to confirm whether the user account has the authority to back up the browser public key. When the password entered by the user is consistent with the user's identity identification code, the password passes the verification, indicating that the user account currently logged in to the terminal has the authority to back up the browser public key. Therefore, the terminal can generate a first key associated with the identity identifier based on the browser client's identity identifier through a key derivation algorithm, and the first key is a symmetric key. Among them, the identity identifier is an identifier used to indicate the identity of the browser client, such as a client package name. The identity identifier of the client installed on the terminal is unique, and one identity identifier only represents one client. Based on the identity identifier, the terminal can identify the identity of the client associated with the identity identifier.

[0078] 303. The terminal encrypts the browser public key using the first key to obtain public key encrypted data of the browser public key.

[0079] In the embodiment of the present application, the first key is a symmetric key associated with the identity of the browser client, and the symmetric key can be used as both an encryption key and a decryption key. Therefore, the terminal can encrypt the browser public key carried in the public key backup request through the first key to obtain public key encrypted data.

[0080] In some embodiments, the terminal can encrypt the browser public key based on the first key through the following method 1 and method 2 to obtain public key encrypted data of the browser public key.

[0081] Method 1: The terminal encrypts the browser public key through the second key to obtain public key encrypted data, and the second key is a symmetric key different from the first key; the terminal encrypts the second key through the first key to obtain key encrypted data of the second key. Among them, the first key is a key encryption key KEK (Key Encryption Key) associated with the identity, which is used to encrypt or decrypt the key. The second key is a data encryption key DEK (Data Encryption Key) randomly generated by the terminal, which is used to encrypt or decrypt the data. Since the second key can encrypt the browser public key and the first key can encrypt the second key, in the process of encrypting the browser public key, the terminal can first use the second key to encrypt the browser public key to obtain the ciphertext of the browser public key, that is, the public key encrypted data. Then, the first key is used to encrypt the second key used to encrypt the browser public key to obtain the ciphertext of the second public key, that is, the key encrypted data. By executing the above encryption process, the terminal can indirectly realize the secondary encryption of the browser public key, so that the encrypted browser public key has double protection, which improves the security of the public key encrypted data.

[0082] Method 2: The terminal encrypts the browser public key through the second key to obtain the key-encrypted data of the browser public key, and the second key is a symmetric key different from the first key; the terminal encrypts the key-encrypted data through the first key to obtain the public key-encrypted data. Among them, the first key is a symmetric key associated with the identity identifier, and the second key is a symmetric key randomly generated by the terminal, and the symmetric key is used to encrypt or decrypt data. Since the second key is used to encrypt the browser public key for the first time, and the first key is used to encrypt the browser public key for the second time, in the process of encrypting the browser public key, the terminal can first use the second key to encrypt the browser public key for the first time to obtain the encrypted data of the browser public key, that is, the key-encrypted data. Then, the first key is used to encrypt the key-encrypted data obtained by the first encryption to obtain the public key-encrypted data. By executing the above encryption process, the terminal can realize the secondary encryption of the browser public key, so that the encrypted browser public key has double protection, which improves the security of the public key-encrypted data.

[0083] 304. The terminal stores the public key encrypted data locally.

[0084] In an embodiment of the present application, after the terminal encrypts the browser public key and obtains the public key encrypted data, the terminal can store the public key encrypted data locally for the browser client to recover the damaged browser public key sent.

[0085] Optionally, when the terminal encrypts the browser public key in the above manner, since the key-encrypted data is encrypted data of the second key used to decrypt the public key-encrypted data, the above step 304 can be changed to: the terminal locally stores the public key-decrypted data and the key-encrypted data.

[0086] 305. When encryption using the first key is completed, the terminal clears the first key from the memory.

[0087] In an embodiment of the present application, the first key is stored in the memory of the terminal. The terminal can clear the first key from the memory in a timely manner after the browser public key is encrypted using the first key. While reducing the storage burden, it can reduce the risk of the first key being stolen and improve the security of the public key encrypted data.

[0088] In some embodiments, when the browser adds a browser public key of another website, the browser client can send a new public key backup request to the terminal to request the terminal to back up the new browser public key. In response to the new public key backup request, the terminal can encrypt the new browser public key, obtain the public key encrypted data of the new browser public key, and store it locally. The specific process of the terminal backing up the new browser public key is the same as the above steps 301-305, which will not be repeated here.

[0089] 306. In response to the public key recovery request of the browser client, the terminal obtains the identity and security level of the browser client, where the public key recovery request is used to request recovery of a damaged browser public key in the browser client.

[0090] In an embodiment of the present application, in the case where the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can obtain the identity and security level of the browser client. Among them, the identity is an identifier used to indicate the identity of the browser client, and the terminal can identify the identity of the client associated with the identity based on the identity. The security level of the browser client usually includes 5 levels, namely: high, medium-high, medium, low, and lowest. High can block all website activities, including all pop-up windows and ActiveX controls, but may prevent some websites from working properly; medium-high is usually the default level of the browser, which can prevent the display of highly unsafe dynamic content and requires explicit permission to run ordinary ActiveX controls; medium can prevent the display of certain dynamic content, such as media resources, plug-ins, scripts, ActiveX controls, etc., and requires explicit permission to run other ActiveX controls; low is similar to medium, but has less control over dynamic content; the lowest level can allow all website activities. ActiveX control is an application that allows websites to provide content such as videos and games.

[0091] 307. When the identity identifier of the browser client is a legal identity identifier and the security level of the browser client is a target security level, the terminal displays a password input interface, and the target security level is used to indicate that the browser client has no security risk.

[0092] In an embodiment of the present application, the target security level is used to indicate that the browser client has no security risk, and can be intermediate, intermediate-high, or advanced. When the identity identifier of the browser client is a legal identity identifier and the security level of the browser client is the target security level, it indicates that the browser client requesting to recover the browser public key is a legal and formal client and has no security risk, so the terminal can display a password input interface to request the user to enter a password in the password input interface. Based on the password entered by the user, the terminal can confirm whether the user account currently logged in to the terminal has the authority to recover the browser public key. Before helping to recover the browser public key, the terminal can avoid obtaining the browser public key returned by the terminal when the browser is attacked by confirming that the identity of the browser client is legal and has no complete risk, thereby improving data security.

[0093] Optionally, the terminal can request the application management module in the terminal to confirm whether the identity of the browser client is legal, and request the security software in the terminal to check the security of the browser client, so as to confirm whether there is a security risk in the browser client.

[0094] 308. In response to the password input operation in the password input interface, the terminal obtains the password input in the password input interface, and the password is used to determine whether the user account has the authority to restore the browser public key.

[0095] In an embodiment of the present application, in response to the user's input operation in the password input interface, the terminal can obtain the password entered by the user and verify the password to confirm whether the user account has the authority to restore the browser public key.

[0096] 309. When the password is consistent with the identity identification code of the user account, the terminal regenerates the first key based on the identity identifier of the browser client, and the identity identification code is used to identify the identity of the user account.

[0097] In the embodiment of the present application, the identity identification code is a Pin code set by the user, which can be used to authenticate the identity of the user account, and if the authentication is passed, the terminal can grant the relevant permissions requested by the user account. When the password entered by the user is consistent with the identity identification code of the user account, it indicates that the user account currently logged in by the terminal has the permission to restore the browser public key. Therefore, the terminal can regenerate the first key associated with the identity identification based on the identity identification of the browser client through the key derivation algorithm. The regenerated first key is the same as the first key generated in the above step 302, and will not be repeated here.

[0098] 310. The terminal decrypts the locally backed-up public key encrypted data using the first key to obtain the browser public key.

[0099] In the embodiment of the present application, the first key is a symmetric key associated with the identity of the browser client, and the symmetric key can be used as both an encryption key and a decryption key. When the terminal backs up the browser public key stored in the browser client, the browser public key is encrypted by the first key to obtain public key encrypted data. Therefore, the terminal can decrypt the locally backed-up public key encrypted data by the first key to obtain the browser public key.

[0100] In some embodiments, the terminal can decrypt the public key encrypted data based on the first key through the following method 1 and method 2 to obtain the browser public key.

[0101] Method 1: The terminal decrypts the key-encrypted data associated with the public key-encrypted data by using the first key to obtain the second key, wherein the key-encrypted data is the encrypted data obtained by encrypting the second key by using the first key, and the second key is a symmetric key different from the first key; the terminal decrypts the public key-encrypted data by using the second key to obtain the browser public key. Among them, the first key is the key encryption key KEK (Key Encryption Key) associated with the identity identifier, which is used to encrypt or decrypt the key. The second key is the data encryption key DEK (Data Encryption Key) randomly generated by the terminal, which is used to encrypt or decrypt the data. Since the key-encrypted data is the encrypted data obtained by encrypting the second key used to decrypt the public key-encrypted data by using the first key, therefore, in the process of decrypting the public key-encrypted data, the terminal can first use the first key to decrypt the key-encrypted data to obtain the second key used to decrypt the public key-encrypted data. Then, the second key is used to decrypt the public key-encrypted data to obtain the browser public key. By executing the above decryption process, the terminal can increase the difficulty of decrypting the public key-encrypted data and improve the security of the public key-encrypted data.

[0102] Method 2: The terminal decrypts the public key encrypted data through the first key to obtain the key encrypted data, the key encrypted data is the encrypted data obtained by encrypting the browser public key through the second key, and the second key is a symmetric key different from the first key; the terminal decrypts the key encrypted data through the second key to obtain the browser public key. Among them, the first key is a symmetric key associated with the identity identifier, and the second key is a symmetric key randomly generated by the terminal. The symmetric key is used to encrypt or decrypt data. Since the key encrypted data is the encrypted data obtained by encrypting the browser public key through the second key, and the public key encrypted data is the encrypted data obtained by encrypting the key encrypted data through the first key. Therefore, in the process of decrypting the public key encrypted data, the terminal can first use the first key to decrypt the public key encrypted data to obtain the key encrypted data encrypted by the second key. Then use the second key to decrypt the key encrypted data to obtain the browser public key. By executing the above decryption process, the terminal can increase the difficulty of decrypting the public key encrypted data and improve the security of the public key encrypted data.

[0103] 311. The terminal returns the browser public key to the browser client.

[0104] In an embodiment of the present application, after decrypting the locally backed-up public key encrypted data and obtaining the browser public key to be restored, the terminal can return the browser public key to the browser client so that the browser client can restore and send the damaged browser public key.

[0105] 312. When decryption using the first key is completed, the terminal clears the first key from the memory.

[0106] In an embodiment of the present application, the first key is stored in the memory of the terminal. The terminal can clear the first key from the memory in a timely manner after decrypting the public key encrypted data using the first key. While reducing the storage burden, it can reduce the risk of the first key being stolen, thereby improving the security of the public key encrypted data.

[0107] The embodiment of the present application provides a public key recovery method. In the case where the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can request the user to enter a password by displaying a password input interface to confirm whether the user has the authority to recover the browser public key. After the password entered by the user is verified, the terminal can generate a first key associated with the identity identifier based on the identity identifier of the browser client, and then decrypt the public key encrypted data based on the first key to obtain the browser public key to be recovered. This solution realizes the local recovery of the browser public key, improves the reliability and stability of the passkey function, and by using the password entered by the user as a necessary prerequisite for decrypting the public key encrypted data, it can protect the security of the locally stored public key encrypted data and improve data security.

[0108] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0109] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0110] Figure 4 Schematic diagram of a public key recovery device provided by an embodiment of the present application. Figure 4 , the device comprises:

[0111] A first display module 401 is used to display a password input interface in response to a public key recovery request from a browser client, where the public key recovery request is used to request recovery of a damaged browser public key in the browser client;

[0112] A generating module 402, configured to generate a first key based on the identity of the browser client in response to the password inputted in the password input interface being verified, wherein the password is used to determine whether the user account has the authority to restore the browser public key, and the first key is a symmetric key associated with the identity;

[0113] The decryption module 403 is used to decrypt the locally backed-up public key encrypted data using the first key to obtain the browser public key, where the public key encrypted data is the encrypted data obtained by encrypting the browser public key using the first key;

[0114] The sending module 404 is used to return the browser public key to the browser client.

[0115] In some embodiments, Figure 5 is a schematic diagram of the structure of another public key recovery device provided in an embodiment of the present application. Figure 5 , the first display module 401 includes:

[0116] The first acquisition unit 501 is used to obtain the identity and security level of the browser client in response to the public key recovery request of the browser client;

[0117] The display unit 502 is used to display a password input interface when the identity identifier of the browser client is a legal identity identifier and the security level of the browser client is a target security level. The target security level is used to indicate that the browser client has no security risk.

[0118] In some embodiments, see Figure 5 , generating module 402, including:

[0119] A second acquiring unit 503 is used to acquire the password input on the password input interface in response to the password input operation on the password input interface;

[0120] The generating unit 504 is used to generate a first key based on the identity identifier of the browser client when the password is consistent with the identity identifier of the user account, and the identity identifier is used to identify the identity of the user account.

[0121] In some embodiments, the decryption module 403 is used to decrypt key-encrypted data associated with public key-encrypted data using a first key to obtain a second key, where the key-encrypted data is encrypted data obtained by encrypting the second key using the first key, and the second key is a symmetric key different from the first key; the public key-encrypted data is decrypted using the second key to obtain a browser public key.

[0122] In some embodiments, the decryption module 403 is used to decrypt the public key encrypted data using the first key to obtain key encrypted data, where the key encrypted data is encrypted data obtained by encrypting the browser public key using the second key, and the second key is a symmetric key different from the first key; the key encrypted data is decrypted using the second key to obtain the browser public key.

[0123] In some embodiments, see Figure 5 , the device further comprises:

[0124] The clearing module 405 is used to clear the first key from the memory when the decryption is completed using the first key.

[0125] In some embodiments, see Figure 5 , the device further comprises:

[0126] The first display module 401 is further used to display a password input interface in response to a public key backup request from a browser client, where the public key backup request is used to request a backup of any browser public key in the browser client;

[0127] The generating module 402 is further used to generate a first key based on the identity of the browser client in response to the password inputted in the password input interface being verified, wherein the password is used to determine whether the user account has the authority to back up the browser public key;

[0128] The encryption module 406 is used to encrypt the browser public key by using the first key to obtain public key encrypted data of the browser public key;

[0129] The storage module 407 is used to store the public key encrypted data locally.

[0130] In some embodiments, the encryption module 406 is used to encrypt the browser public key using a second key to obtain public key encrypted data, where the second key is a symmetric key different from the first key; and to encrypt the second key using the first key to obtain key encrypted data of the second key.

[0131] In some embodiments, the encryption module 406 is used to encrypt the browser public key using a second key to obtain key-encrypted data of the browser public key, where the second key is a symmetric key different from the first key; and to encrypt the key-encrypted data using the first key to obtain public key-encrypted data.

[0132] In some embodiments, the first display module 401 is used to respond to a public key backup request from a browser client and obtain the browser public key carried in the public key backup request; when the browser public key is the public key of a target website, a password input interface is displayed, and the target website is a website whose browsing frequency in the browser client is greater than a frequency threshold.

[0133] In some embodiments, see Figure 5 , the device further comprises:

[0134] The second display module 408 is used to display an account login interface in response to an account login operation on the browser client;

[0135] The second display module 408 is also used to display the password setting interface when the login password entered in the account login interface is consistent with the account password of the user account;

[0136] An acquisition module 409 is used to obtain an identity code set in the password setting interface in response to a password setting operation in the password setting interface, where the identity code is used to identify the identity of the user account;

[0137] The setting module 410 is used to set the identity identification code as the correct password of the password input interface.

[0138] The embodiment of the present application provides a public key recovery device. When the browser public key stored in the browser client is damaged, the browser client can send a public key recovery request to the terminal to request the recovery of the damaged browser public key. In response to the public key recovery request, the terminal can request the user to enter a password by displaying a password input interface to confirm whether the user has the authority to recover the browser public key. After the password entered by the user is verified, the terminal can generate a first key associated with the identity identifier based on the identity identifier of the browser client, and then decrypt the public key encrypted data based on the first key to obtain the browser public key to be recovered. This solution realizes the local recovery of the browser public key, improves the reliability and stability of the passkey function, and by using the password entered by the user as a necessary prerequisite for decrypting the public key encrypted data, it can protect the security of the locally stored public key encrypted data and improve data security.

[0139] It should be noted that the device provided in the above embodiment, when implementing its functions, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the server is divided into different functional modules to complete all or part of the functions described above. In addition, the device and method embodiments provided in the above embodiment belong to the same concept, and their specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0140] An embodiment of the present application provides an electronic device, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the public key recovery method provided by the above-mentioned various method embodiments.

[0141] Figure 6 6 is a block diagram of a structure of an electronic device 600 provided according to an embodiment of the present application. In some embodiments, the electronic device 600 is a smart phone, a tablet computer, a computer with wireless communication function, or a wearable device. The electronic device 600 in the present application includes at least one or more of the following components: a processor 610, a memory 620, and at least two wireless links 630.

[0142] In some embodiments, the processor 610 includes one or more processing cores. The processor 610 uses various interfaces and lines to connect various parts of the entire electronic device 600, and executes various functions and processes data of the electronic device 600 by running or executing program codes stored in the memory 620, and calling data stored in the memory 620. In some embodiments, the processor 610 is implemented in at least one hardware form of digital signal processing (DSP), field programmable gate array (FPGA), and programmable logic array (PLA). The processor 610 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 610, but may be implemented by a separate chip.

[0143] In some embodiments, the processor 610 is used to control the working conditions of at least two wireless links 630. Accordingly, the processor 610 is a processor integrated with a wireless fidelity (Wireless Fidelity, Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capabilities. For example, the Wi-Fi chip is a dual-band dual concurrent (Dual Band Dual Concurrent, DBDC) chip, or a dual-band synchronous (Dual Band Simultaneous, DBS) chip, etc.

[0144] In some embodiments, the memory 620 includes a random access memory (RAM), and in some embodiments, the memory 620 includes a read-only memory (ROM). In some embodiments, the memory 620 includes a non-transitory computer-readable storage medium. The memory 620 can be used to store program codes. The memory 620 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data (such as audio data, a phone book) created according to the use of the electronic device 600, etc.

[0145] In some embodiments, the memory 620 stores reception schemes for receiving beacon frames of different wireless links 630, as well as identifiers of access nodes connected to different wireless links 630, identifiers of wireless links 630, and the like.

[0146] The at least two wireless links 630 are used to connect different access points (APs) to receive downlink data sent by the APs, wherein the different access points are access points in the same router or access points in different routers.

[0147] In some embodiments, the electronic device 600 also includes a display screen. The display screen is a display component that displays a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can use any suitable object such as a finger or a stylus to perform touch operations on the display screen. In some embodiments, the display screen is generally arranged on the front panel of the electronic device 600. In some embodiments, the display screen is designed to be a full screen, a curved screen, a special-shaped screen, a double-sided screen, or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, etc., which is not limited in this embodiment.

[0148] In addition, those skilled in the art will appreciate that the structure of the electronic device 600 shown in the above figures does not limit the electronic device 600, and the electronic device 600 includes more or fewer components than shown, or combines certain components, or arranges components differently. For example, the electronic device 600 also includes components such as a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0149] The present application also provides a computer-readable storage medium, which stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the public key recovery method shown in the above embodiments.

[0150] The present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the public key recovery method shown in the above embodiments.

[0151] The present application also provides a computer program product, which stores at least one program code, and the at least one program code is used to be executed by a processor to implement the public key recovery method shown in the above embodiments.

[0152] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0153] Those skilled in the art can understand that all or part of the steps in the public key recovery method of the above embodiment can be completed by hardware, or by a program to instruct the relevant hardware to complete, and the program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk or an optical disk, etc. The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A public key recovery method, characterized in that: The method comprises: In response to a public key recovery request from a browser client, displaying a password input interface, wherein the public key recovery request is used to request recovery of a damaged browser public key in the browser client; In response to the password input in the password input interface being verified, generating a first key based on the identity of the browser client, the password being used to determine whether the user account has the authority to restore the browser public key, the first key being a symmetric key associated with the identity; Decrypting the locally backed-up public key encrypted data using the first key to obtain the browser public key, wherein the public key encrypted data is encrypted data obtained by encrypting the browser public key using the first key; Return the browser public key to the browser client.

2. The method according to claim 1, characterized in that The step of displaying a password input interface in response to a public key recovery request from a browser client includes: In response to a public key recovery request from a browser client, obtaining an identity and a security level of the browser client; When the identity identifier of the browser client is a legal identity identifier and the security level of the browser client is a target security level, the password input interface is displayed, and the target security level is used to indicate that the browser client has no security risk.

3. The method according to claim 1, characterized in that In response to the password inputted in the password input interface being verified, generating a first key based on the identity of the browser client includes: In response to a password input operation on the password input interface, acquiring the password input on the password input interface; In the case where the password is consistent with the identity identification code of the user account, the first key is generated based on the identity identifier of the browser client, and the identity identification code is used to identify the identity of the user account.

4. The method according to claim 1, characterized in that: The method of decrypting the locally backed-up public key encrypted data by using the first key to obtain the browser public key includes: Decrypting the key-encrypted data associated with the public key-encrypted data using the first key to obtain a second key, wherein the key-encrypted data is encrypted data obtained by encrypting the second key using the first key, and the second key is a symmetric key different from the first key; The public key encrypted data is decrypted by the second key to obtain the browser public key.

5. The method according to claim 1, characterized in that The method of decrypting the locally backed-up public key encrypted data by using the first key to obtain the browser public key includes: Decrypting the public key encrypted data by using the first key to obtain key encrypted data, wherein the key encrypted data is encrypted data obtained by encrypting the browser public key by using a second key, wherein the second key is a symmetric key different from the first key; The key-encrypted data is decrypted using the second key to obtain the browser public key.

6. The method according to claim 1, characterized in that The method further comprises: When decryption using the first key is completed, the first key is cleared from the memory.

7. The method according to claim 1, characterized in that The method further comprises: In response to a public key backup request from the browser client, displaying the password input interface, wherein the public key backup request is used to request a backup of any browser public key in the browser client; In response to the password inputted in the password input interface being verified, generating the first key based on the identity of the browser client, wherein the password is used to determine whether the user account has the authority to back up the browser public key; Encrypting the browser public key by using the first key to obtain public key encrypted data of the browser public key; The public key encrypted data is stored locally.

8. The method according to claim 7, characterized in that The step of encrypting the browser public key by using the first key to obtain public key encrypted data of the browser public key includes: The browser public key is encrypted by a second key to obtain the public key encrypted data, wherein the second key is a symmetric key different from the first key; The second key is encrypted by using the first key to obtain key-encrypted data of the second key.

9. The method according to claim 7, characterized in that: The step of encrypting the browser public key by using the first key to obtain public key encrypted data of the browser public key includes: The browser public key is encrypted by a second key to obtain key-encrypted data of the browser public key, wherein the second key is a symmetric key different from the first key; The key-encrypted data is encrypted using the first key to obtain the public key-encrypted data.

10. The method according to claim 7, characterized in that The step of displaying the password input interface in response to the public key backup request of the browser client comprises: In response to the public key backup request of the browser client, obtaining the browser public key carried in the public key backup request; In the case where the browser public key is the public key of a target website, the password input interface is displayed, and the target website is a website whose browsing frequency in the browser client is greater than a frequency threshold.

11. The method according to claim 1 or 7, characterized in that: The method further comprises: In response to an account login operation on the browser client, displaying an account login interface; If the login password entered in the account login interface is consistent with the account password of the user account, display the password setting interface; In response to a password setting operation in the password setting interface, obtaining an identity identification code set in the password setting interface, the identity identification code being used to identify the identity of the user account; The identity identification code is set as the correct password of the password input interface.

12. A public key recovery device, characterized in that: The device comprises: A first display module, configured to display a password input interface in response to a public key recovery request from a browser client, wherein the public key recovery request is used to request recovery of a damaged browser public key in the browser client; A generating module, configured to generate a first key based on the identity of the browser client in response to the password inputted in the password input interface being verified, wherein the password is used to determine whether the user account has the authority to restore the browser public key, and the first key is a symmetric key associated with the identity; A decryption module, used to decrypt the locally backed-up public key encrypted data by using the first key to obtain the browser public key, wherein the public key encrypted data is encrypted data obtained by encrypting the browser public key by using the first key; The sending module is used to return the browser public key to the browser client.

13. An electronic device, characterized in that: The electronic device includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the public key recovery method as described in any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the public key recovery method according to any one of claims 1 to 11.

15. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the chip runs on the terminal, it is used to implement the public key recovery method as described in any one of claims 1 to 11.

16. A computer program product comprising a computer program, characterized in that The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the public key recovery method according to any one of claims 1 to 11.

Images