Unlocking processing method, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an unlocking processing method, electronic equipment and a storage medium, in the embodiment of the invention, a client securely transmits ciphertext data required by unlocking to an application server, and the application server needs to decrypt to obtain plaintext data required by unlocking; only when the application server side verifies that the input password input by the user is the unlocking password, the application server side unlocks the service object related to the user in the application service provided by the application server side, so that the unlocking safety of the service object related to the user in the application service is greatly improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a manual unlocking processing method, an electronic device and a storage medium. Background Art

[0002] A network disk, also known as a network USB flash drive or network hard drive, provides users with online storage, access, backup or sharing services. After a user applies for a network disk account, the user can access the independent storage space under his or her network disk account at any time and anywhere. Usually, the user's storage space in the network disk needs to be unlocked with an unlock password before it can be accessed to ensure data security and privacy protection.

[0003] Currently, the user enters the unlock password on the client and sends the unlock password to the network disk through the client. After the network disk verifies the unlock password sent by the client, it unlocks the locked storage space under the user's network disk account for user access. However, the security of this unlocking method needs to be improved. Summary of the invention

[0004] Multiple aspects of the present application provide an unlocking processing method, an electronic device, and a storage medium to improve unlocking security.

[0005] An embodiment of the present application provides an unlocking processing method, including: in response to an unlocking instruction input by a user in a client, randomly generating a first symmetric key, the unlocking instruction including an input password input by the user; using the first symmetric key to symmetrically encrypt the input password to obtain a first ciphertext; using a public key to asymmetrically encrypt the first symmetric key to obtain a second ciphertext; sending an unlocking request to an application server, the unlocking request including the first ciphertext and the second ciphertext, so that the application server unlocks the service object related to the user in the application service provided by the application server based on the first ciphertext and the second ciphertext.

[0006] An embodiment of the present application also provides an unlocking processing method, including: receiving an unlocking request sent by a client, the unlocking request including a first ciphertext and a second ciphertext; in response to the unlocking request, decrypting the second ciphertext using a private key to obtain a first symmetric key; decrypting the first ciphertext using the first symmetric key to obtain an input password entered by the user in the client; if the input password is the same as a pre-set unlocking password, unlocking the service object related to the user in the application service provided by the application server.

[0007] An embodiment of the present application also provides an electronic device, including: a memory and a processor; the memory is used to store a computer program; the processor is coupled to the memory and is used to execute the computer program to perform the steps in the unlocking processing method.

[0008] The embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement the steps in the unlocking processing method.

[0009] In an embodiment of the present application, a user enters a password in a client, and the client randomly generates a symmetric key, and uses the symmetric key to symmetrically encrypt the input password to obtain the input password in ciphertext, and uses the public key to asymmetrically encrypt the symmetric key to obtain the symmetric key in ciphertext. The client transmits the input password in ciphertext and the symmetric key in ciphertext to the application server, and the application server uses the private key to decrypt the symmetric key in ciphertext to obtain the symmetric key in plaintext, and uses the symmetric key to decrypt the input password in ciphertext to obtain the input password in plaintext. The application server will unlock the service object related to the user in the application service provided by the application server only after verifying that the input password is the unlock password. As a result, the client securely transmits the ciphertext data required for unlocking to the application server, and the application server needs to decrypt to obtain the plaintext data required for unlocking, which greatly improves the unlocking security of the service object related to the user in the application service. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0011] Figure 1 An exemplary application scenario diagram provided for an embodiment of the present application;

[0012] Figure 2 A signaling interaction diagram of an unlocking processing method provided in an embodiment of the present application;

[0013] Figure 3 A signaling interaction diagram of another unlocking processing method provided by an embodiment of the present application;

[0014] Figure 4 A flowchart of an unlocking processing method provided in an embodiment of the present application;

[0015] Figure 5 A flowchart of another unlocking processing method provided in an embodiment of the present application;

[0016] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0018] In the embodiments of the present application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the access relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B may be singular or plural. In the text description of the present application, the character " / " generally indicates that the previous and next associated objects are in an "or" relationship. In addition, in the embodiments of the present application, "first", "second", "third", etc. are only used to distinguish the contents of different objects and have no other special meanings.

[0019] A network disk, also known as a network USB flash drive or a network hard drive, provides users with online storage, access, backup or sharing services. After a user applies for a network disk account, the user can access the independent storage space under his network disk account anytime and anywhere. Usually, the user's storage space in the network disk needs to be unlocked with an unlock password before it can be accessed to ensure data security and privacy protection. Currently, the user enters the unlock password on the client and sends the unlock password to the network disk through the client. After the network disk verifies the unlock password sent by the client, it unlocks the locked storage space under the user's network disk account for user access. However, the security of this unlocking method needs to be improved.

[0020] To this end, the embodiment of the present application provides an unlocking processing method, an electronic device and a storage medium. In the embodiment of the present application, the user enters a password in the client, the client randomly generates a symmetric key, and uses the symmetric key to symmetrically encrypt the input password to obtain the input password in ciphertext form, and uses the public key to asymmetrically encrypt the symmetric key to obtain the symmetric key in ciphertext form. The client transmits the input password in ciphertext form and the symmetric key in ciphertext form to the application server, the application server uses the private key to decrypt the symmetric key in ciphertext form to obtain the symmetric key in plaintext, and uses the symmetric key to decrypt the input password in ciphertext form to obtain the input password in plaintext. Only when the input password entered is verified to be the unlocking password, the application server will unlock the service object related to the user in the application service provided by the application server. As a result, the client securely transmits the ciphertext data required for unlocking to the application server, and the application server needs to decrypt to obtain the plaintext data required for unlocking, which greatly improves the unlocking security of the service object related to the user in the application service.

[0021] The following are some words related to the embodiments of the present application:

[0022] Symmetric encryption algorithms refer to encryption algorithms that use the same key for encryption and decryption. Symmetric encryption algorithms include, but are not limited to, DES (Data Encryption Standard) algorithms, AES (Advanced Encryption Standard) algorithms, and the like.

[0023] Asymmetric encryption algorithm: refers to an encryption algorithm that uses a public key for encryption and a private key for decryption, where the public key and the private key are completely different but completely match. Asymmetric encryption algorithms include, but are not limited to, the RSA algorithm. The principle of the RSA algorithm is that according to number theory, it is relatively simple to find two large prime numbers, but it is extremely difficult to factorize their product, so the product can be made public as an encryption key.

[0024] Figure 1 An exemplary application scenario diagram provided for the embodiment of the present application. Figure 1 In the application scenario shown, after the user registers as a registered user of the network disk service, the network disk service provides the user with an independent storage space associated with the user's network disk account. In order to ensure data security and privacy protection, when the user has not accessed the storage space for a long time, the storage space is locked. When the user needs to access the storage space, the user needs to first unlock the locked storage space using the unlock password.

[0025] In this embodiment, in order to more securely unlock the storage space associated with the user in the network disk service, whether in the password setting stage or the unlocking stage, the client transmits the corresponding password to the application server providing the network disk service in a secure transmission manner.

[0026] See also Figure 1 As shown in ①, in the password setting stage, the user performs the input operation of the unlock password in the client in the terminal device, and the client responds to the input operation and obtains the unlock password entered by the user. Then, the client uses the AES algorithm to randomly generate a symmetric key; the symmetric key is used to symmetrically encrypt the unlock password entered by the user to obtain the unlock password in ciphertext, and the ciphertext unlock password is Base64 encoded; the RSA algorithm is used to asymmetrically encrypt the randomly generated symmetric key based on the public key to generate a symmetric key in ciphertext. Figure 1 As shown in ②, the client securely transmits the "unlock password" to the application server, that is, the client transmits the unlock password in ciphertext form encoded by Base64 and the symmetric key in ciphertext form to the application server.

[0027] When the application server receives the Base64-encoded ciphertext unlocking password and the ciphertext symmetric key transmitted by the client, the application server first uses the private key to decrypt the ciphertext symmetric key to obtain the symmetric key. Then, the application server decodes the Base64-encoded ciphertext unlocking password to obtain the ciphertext unlocking password; then, it uses the symmetric key to decrypt the ciphertext unlocking password to obtain the unlocking password. Figure 1 As shown in ③, the application server encrypts and stores the unlock password. For example, the application server can call KMS (Key Management Service) to encrypt the unlock password and store the encrypted unlock password in the database. At this point, the application server has completed the task of setting the unlock password for the user's storage space in the network disk service. After setting the unlock password for the user's storage space in the network disk service, the user's storage space is in a locked state, and the user needs to enter the unlock password to unlock the user's storage space before accessing it.

[0028] See also Figure 1As shown in ④, in the unlocking stage, the user performs an input operation of inputting a password in the client in the terminal device, and the client responds to the input operation and obtains the input password entered by the user. Then, the client uses the AES algorithm to randomly generate a symmetric key; uses the symmetric key to symmetrically encrypt the user's input password to obtain the input password in ciphertext, and performs Base64 encoding on the ciphertext input password; uses the RSA algorithm to asymmetrically encrypt the randomly generated symmetric key based on the public key to generate a symmetric key in ciphertext. Figure 1 As shown in ⑤, the client securely transmits the "input password" to the application server, that is, the client transmits the input password in ciphertext form after Base64 encoding and the symmetric key in ciphertext form to the application server.

[0029] When the application server receives the Base64-encoded input password in ciphertext and the symmetric key in ciphertext transmitted by the client, the application server first uses the private key to decrypt the symmetric key in ciphertext to obtain the symmetric key. Then, the application server decodes the Base64-encoded input password in ciphertext to obtain the input password in ciphertext; then, it uses the symmetric key to decrypt the input password in ciphertext to obtain the input password. Figure 1 As shown in ⑥, the application server compares the input password with the unlock password in the database. If the input password and the unlock password in the database are the same, the comparison verification passes; if the input password and the unlock password in the database are different, the comparison verification fails. In actual applications, the application server can call KMS to decrypt the encrypted unlock password to obtain the unlock password. See Figure 1 As shown in ⑦, if the comparison verification passes, the application server unlocks the user's storage space in the network disk service for the user to access. At this point, the application server completes the unlocking task.

[0030] In this embodiment, since the password data transmitted from the client to the application server is encrypted and the symmetric key is randomly generated, the difficulty of cracking the password data when it is attacked is greatly improved, and the risk of leakage of the password data during transmission is greatly reduced.

[0031] It should be noted that Figure 1 The application scenario shown is only an exemplary application scenario, and the present application embodiment does not limit the application scenario. Figure 1 does not limit the equipment included in Figure 1 The positional relationship between the devices is limited.

[0032] In an embodiment of the present application, the terminal device can interact with the application server through a wired network or a wireless network. For example, the wired network may include coaxial cables, twisted pairs, and optical fibers, and the wireless network may be a 2G (2Generation, 2nd generation) network, a 3G (3Generation, 3rd generation) network, a 4G (4Generation, 4th generation) network, or a 5G (5Generation, 5th generation) network, a wireless fidelity (Wireless Fidelity, referred to as WIFI) network, etc. The present application does not limit the specific type or form of interaction, as long as it can realize the function of interaction between the terminal device and the application server. Among them, the terminal device includes, for example, but is not limited to, a mobile phone, a tablet computer, a desktop computer, a wearable smart device, a smart home device, etc. The application server includes, for example, but is not limited to: a single server, a distributed server cluster consisting of multiple servers, or a cloud server, etc.

[0033] The technical solutions provided by various embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0034] Figure 2 A signaling interaction diagram of an unlocking processing method provided in an embodiment of the present application. Figure 2 , the method may include the following steps:

[0035] 201. The client randomly generates a first symmetric key in response to an unlocking instruction input by a user in the client, where the unlocking instruction includes an input password input by the user.

[0036] In this embodiment, the user can access the service objects related to the user in the application service provided by the application server through the client anytime and anywhere. The application service can be any service, and the application service includes, for example, but is not limited to: a network disk service and an album service for managing photos. The service object related to the user refers to the service object related to the user's account in the application service after the user registers as a registered user of the application service. For example, in the network disk service scenario, the service object related to the user refers to the independent storage space under the user's network disk account. For another example, in the album service scenario, the service object related to the user refers to the independent storage space under the user's album account.

[0037] In this embodiment, in order to ensure data security and privacy protection, if the user has no access requirements for a long time, the service object related to the user in the application service is in a locked state. If the user has access requirements, the user needs to first switch the service object related to the user in the application service from the locked state to the unlocked state, that is, first unlock the service object related to the user in the application service and then access the service object related to the user in the application service.

[0038] In this embodiment, when a user needs to unlock a service object related to the user in an application service provided by an application server, the user inputs an unlock instruction to the client. The unlock instruction is used to instruct to unlock the service object related to the user in the application service provided by the application server, and the unlock instruction includes an input password input by the user. For example, the user triggers the client to display an unlock interface, the user enters the input password for unlocking on the unlock interface, and clicks the unlock control on the unlock interface to trigger the unlock instruction. For another example, the user inputs an unlock instruction to the client in a voice interaction manner, such as a voice instruction of "Please unlock the network disk service, the unlock password is 123456*&..."

[0039] In this embodiment, in response to the unlocking instruction input by the user, the client randomly generates a symmetric key using a symmetric encryption algorithm. Here, the symmetric key randomly generated in the unlocking phase is referred to as the first symmetric key.

[0040] It is worth noting that the client randomly generates symmetric keys, which can improve the security of unlocking and avoid the security risks brought by the cracking of fixed symmetric passwords.

[0041] 202. The client uses the first symmetric key to symmetric-encrypt the input password to obtain a first ciphertext.

[0042] In this embodiment, the client uses the first symmetric key to perform symmetric encryption processing on the input password based on the symmetric encryption algorithm to obtain the input password in ciphertext form. Here, the input password in ciphertext form is referred to as the first ciphertext.

[0043] 203. The client uses the public key to asymmetrically encrypt the first symmetric key to obtain a second ciphertext.

[0044] In this embodiment, the client uses the public key to perform asymmetric encryption processing on the first symmetric key based on an asymmetric encryption algorithm to obtain the first symmetric key in ciphertext form. Here, the first symmetric key in ciphertext form is referred to as the second ciphertext.

[0045] 204. The client sends an unlock request to the application server, where the unlock request includes the first ciphertext and the second ciphertext.

[0046] 205. In response to the received unlocking request, the application server uses the private key to decrypt the second ciphertext to obtain the first symmetric key.

[0047] 206. The application server uses the first symmetric key to decrypt the first ciphertext to obtain the input password entered by the user in the client.

[0048] 207. The application server determines whether the input password is the same as the preset unlock password. If they are the same, execute step 208; if they are different, execute step 209.

[0049] 208. The application server unlocks the service object related to the user in the application service provided by the application server.

[0050] 209. The application server continues to lock the service objects related to the user in the application service provided by the application server.

[0051] In this embodiment, after the application server obtains the input password entered by the user in the client, it determines whether the input password is the same as the preset unlock password. If they are the same, it means that the user has entered a correct unlock password. At this time, the application server unlocks the service object related to the user in the application service provided by the application server for the user to access. If they are different, it means that the user has entered an incorrect unlock password, and the service object related to the user in the application service provided by the application server continues to be locked.

[0052] In actual applications, it is inevitable that users will enter the wrong unlock password. Further optionally, in order to improve the reliability of unlocking, when the application server determines that the input password currently entered by the user is different from the preset unlock password, the number of consecutive incorrect password inputs by the user is increased by 1. If the number of consecutive incorrect password inputs by the user is greater than or equal to the set number threshold, it means that the user has entered the unlock password incorrectly many times recently, and the user is highly untrustworthy. At this time, the application server continues to lock the service objects related to the user in the application service provided by the application server. If the number of consecutive incorrect password inputs by the user is less than the set number threshold, the application server can input a prompt message to the client to prompt the user to re-enter the unlock password, so that the user can enter the unlock password again. Among them, the set number threshold is flexibly set as needed, for example, 3 times.

[0053] Of course, after each successful unlock or unlock, the number of consecutive wrong password inputs is reset to zero. If the user fails to complete the unlock within a certain period of time, the current unlock is terminated and the user needs to initiate the unlock command again to unlock.

[0054] The technical solution provided by the embodiment of the present application is that the user enters a password in the client, the client randomly generates a symmetric key, and uses the symmetric key to symmetrically encrypt the input password to obtain the input password in ciphertext form, and uses the public key to asymmetrically encrypt the symmetric key to obtain the symmetric key in ciphertext form. The client transmits the input password in ciphertext form and the symmetric key in ciphertext form to the application server, the application server uses the private key to decrypt the symmetric key in ciphertext form to obtain the symmetric key in plaintext form, and uses the symmetric key to decrypt the input password in ciphertext form to obtain the input password in plaintext form. The application server will unlock the service object related to the user in the application service provided by the application server only when it is verified that the input password is the unlock password. As a result, the client securely transmits the ciphertext data required for unlocking to the application server, and the application server needs to decrypt to obtain the plaintext data required for unlocking, which greatly improves the unlocking security of the service object related to the user in the application service.

[0055] Figure 3 This is a signaling interaction diagram of another unlocking processing method provided by the embodiment of the present application. Figure 3 , the method may include the following steps:

[0056] 301. The client randomly generates a first symmetric key in response to an unlocking instruction input by a user in the client, where the unlocking instruction includes an input password input by the user.

[0057] 302. The client uses the first symmetric key to symmetrically encrypt the input password to obtain a first ciphertext.

[0058] 303. The client uses the public key to asymmetrically encrypt the first symmetric key to obtain a second ciphertext.

[0059] 304. The client sends an unlock request to the application server, where the unlock request includes the first ciphertext and the second ciphertext.

[0060] 305. In response to the received unlocking request, the application server uses the private key to decrypt the second ciphertext to obtain the first symmetric key.

[0061] 306. The application server uses the first symmetric key to decrypt the first ciphertext to obtain the input password entered by the user in the client.

[0062] Steps 301 to 306 in this embodiment may refer to steps 201 to 206 in the aforementioned embodiment, and will not be described in detail here.

[0063] 307. The application server determines whether the input password is the same as the unlock password in the preset unlock passwords. If yes, execute step 308; if no, execute step 309.

[0064] 308. The application server unlocks the service object related to the user in the application service provided by the application server.

[0065] 309. The application server determines the similarity between the input password and each of the preset unlocking passwords.

[0066] 310. Determine whether there is a second unlock password with a higher security level than the first unlock password. If yes, execute step 311; if no, execute step 312. The first unlock password is the unlock password with the highest similarity to the input password among the multiple unlock passwords, the second unlock password is the input password with a similarity to the historical input password less than the similarity threshold among the multiple unlock passwords, and the historical input password is the input password input at a historical time.

[0067] 311. The application server sends a first prompt message to the client, where the first prompt message is used to prompt the user to enter an unlocking password with a higher security level.

[0068] 312. The application server continues to lock the service objects related to the user in the application service provided by the application server.

[0069] In this embodiment, the user sets multiple unlock passwords, so that the user can enter different unlock passwords as needed. If the application server determines that the input password is one of the multiple unlock passwords preset, the application server performs the unlock operation. If it is determined that the input password is different from each of the multiple unlock passwords preset, the application server continues to perform the lock operation. Further optionally, in order to improve the reliability of unlocking, if it is determined that the input password is different from each of the multiple unlock passwords preset, the application server determines whether there is an unlock password with a higher security level that has not been entered by the user. Based on this, the application server determines the similarity between the input password and each of the multiple unlock passwords preset. It is determined whether there is a second unlock password with a higher security level than the first unlock password, wherein the first unlock password is the unlock password with the highest similarity to the input password among the multiple unlock passwords, and the second unlock password is the unlock password among the multiple unlock passwords whose similarity to the historical input password is less than the similarity threshold, and the historical input password is the input password entered at a historical time. The similarity threshold is flexibly set as needed. The historical time is a period of time before the current time. The historical time is flexibly set as needed, for example, the historical time is the latest 30 seconds before the current time.

[0070] In actual applications, due to the user inputting the wrong unlock password, the user performs the password input operation multiple times in a short period of time. The application server records the historical input passwords input by the user at historical time, and the historical input passwords are the input passwords input by the user at historical time.

[0071] Specifically, the application server finds the first unlock password that is most similar to the input password currently entered by the user from multiple unlock passwords, that is, the first unlock password is the unlock password that the user should have entered correctly, but the user entered the wrong first unlock password. In response to this situation, the application server determines whether there is a second unlock password with a higher security level than the first unlock password, and the similarity between the second unlock password and the historical input password entered at a historical time is less than the similarity threshold, that is, the user did not intend to enter the second unlock password in a short period of time. In comparison, the second unlock password is a strong password, and the first unlock password is a weak password. In the case where the user enters the wrong weak password, requiring the user to enter a strong password can effectively improve the security and reliability of unlocking.

[0072] In this embodiment, when there is a second unlock password with a higher security level than the first unlock password, the application server sends a first prompt message to the client, and the first prompt message is used to prompt the user to enter an unlock password with a higher security level. When there is no second unlock password with a higher security level than the first unlock password, the application server continues to lock the service object related to the user in the application service provided by the application server.

[0073] In this embodiment, when the user sets multiple unlock passwords, multiple security levels of the unlock passwords can be set. The higher the security level, the more difficult it is for the unlock password to be attacked and cracked. Further optionally, in order to more efficiently and accurately determine the security levels of the multiple unlock passwords, the application server can sort the security levels of the multiple unlock passwords according to the attribute information of the preset multiple unlock passwords.

[0074] Specifically, the attribute information includes, but is not limited to, password length and / or character types of the unlock password. The longer the password length, the higher the security level of the unlock password. The more character types there are in the unlock password, the higher the security level of the unlock password. Character types include, but are not limited to, numbers, letters, special characters, and the like. For example, in the case of the same password length, relatively speaking, the security level of the unlock password that includes two characters such as numbers and letters is lower, and the security level of the unlock password that includes more than two characters such as numbers, letters, and special characters is higher.

[0075] Further optionally, in order to determine the security levels of multiple unlocking passwords more efficiently and accurately, an implementation method for sorting the security levels of multiple unlocking passwords according to the attribute information of multiple preset unlocking passwords is: dividing the multiple unlocking passwords into a first group of unlocking passwords and a second group of unlocking passwords according to the password length, the password length of the unlocking passwords in the first group of unlocking passwords is greater than or equal to the preset length, and the password length of the unlocking passwords in the second group of unlocking passwords is less than the preset length; based on the password length and character type of the unlocking passwords, the unlocking passwords in the first group of unlocking passwords and the unlocking passwords in the second group of unlocking passwords are respectively sorted by security level.

[0076] Exemplarily, in order to improve the accuracy of security level sorting, the security level of the unlocking password in the first group of unlocking passwords is higher than the security level of the unlocking password in the second group of unlocking passwords; for the unlocking password in the first group of unlocking passwords or the second group of unlocking passwords: the more character types the unlocking password has, the higher the security level of the unlocking password; when the number of character types is the same, the longer the password length of the unlocking password, the higher the security level of the unlocking password.

[0077] Specifically, the preset length is flexibly set as needed, for example, the preset length is 5 characters. First, multiple unlocking passwords are divided into two groups according to the password length, wherein the group with relatively longer password length is called the first group of unlocking passwords, and the group with relatively shorter password length is called the second group of unlocking passwords. The security level of the unlocking passwords in the first group of unlocking passwords is higher than the security level of the unlocking passwords in the second group of unlocking passwords. For any group of unlocking passwords, the security level is sorted according to the number of character types of the unlocking passwords. When the number of character types is the same, the security level is sorted according to the password length of the unlocking password.

[0078] In actual applications, it is inevitable that users will enter the wrong unlock password. Further optionally, in order to improve the reliability of unlocking, when the application server determines that the input password currently entered by the user is different from the pre-set multiple unlock passwords, the number of consecutive incorrect password inputs by the user is increased by 1; if the number of consecutive incorrect password inputs by the user is greater than the set number threshold, step 309 is executed; if the number of consecutive incorrect password inputs by the user is less than or equal to the set number threshold, a second prompt message is output to the client, and the second prompt message is used to prompt the user to re-enter the unlock password. Among them, the set number threshold is flexibly set as needed. Of course, after each successful unlocking or unlocking, the number of consecutive incorrect password inputs is reset to zero. If the user does not complete the unlocking within a certain period of time, the current unlocking ends, and the user needs to initiate the unlocking command again to unlock.

[0079] The technical solution provided by the embodiment of the present application is that the client securely transmits the ciphertext data required for unlocking to the application server, and the application server needs to decrypt to obtain the plaintext data required for unlocking. The application server will unlock the service objects related to the user in the application service provided by the application server only after verifying that the input password is the unlock password. Furthermore, it supports users to set multiple unlock passwords. In the case that the user enters the wrong unlock password with a lower security level, the user can also try to enter an unlock password with a higher security level to unlock the service object in the application service. As a result, the unlocking security and unlocking reliability of the service objects related to the user in the application service are greatly improved.

[0080] In this embodiment, the user can set one or more unlock passwords, and there is no restriction on this. If the user sets multiple unlock passwords, the user controls the client to send a password setting request to the application server to add indication information, and the indication information is used to indicate the number of unlock passwords currently required to be set and each unlock password.

[0081] In this embodiment, there is no restriction on the way in which the user sets the unlock password. For example, the user triggers the client to send a password setting request to the application server, and the password setting request includes the unlock password set by the user. The application server responds to the password setting request and sets the unlock password for the service object related to the user in the application service provided by the application server. Further, optionally, in order to improve the security of password setting, the client securely transmits the unlock password in ciphertext to the application server, and the application server needs to decrypt it to obtain the unlock password in plaintext, and sets the unlock password for the service object related to the user in the application service provided by the application server.

[0082] Based on the above, in the password setting stage, the client randomly generates a second symmetric key in response to the password setting instruction input by the user in the client, and the password setting instruction includes the unlocking password set by the user; the second symmetric key is used to symmetrically encrypt the unlocking password to obtain a third ciphertext; the second symmetric key is asymmetrically encrypted using the public key to obtain a fourth ciphertext; and a password setting request is sent to the application server, and the password setting request includes the third ciphertext and the fourth ciphertext. In response to the password setting request, the application server sets an unlocking password for the service object related to the user in the application service provided by the application server based on the third ciphertext and the fourth ciphertext. Specifically, the application server uses the private key to decrypt the fourth ciphertext to obtain the second symmetric key. The second symmetric key is used to decrypt the third ciphertext to obtain the unlocking password, and the unlocking password is used as the password for switching the service object related to the user in the application service provided by the application server from the locked state to the unlocked state, thereby completing the password setting task.

[0083] In some optional embodiments, during the password setting phase, the application server may also call KMS to encrypt the unlock password obtained by decrypting the third ciphertext, and store the encrypted unlock password in the database. Correspondingly, during the password unlocking phase, the application server calls KMS to decrypt the encrypted unlock password obtained from the database to obtain the unlock password.

[0084] Figure 4 This is a flowchart of an unlocking processing method provided in an embodiment of the present application. This method can be executed by the client, see Figure 4 , the method may include the following steps:

[0085] 401. In response to an unlocking instruction input by a user in a client, randomly generate a first symmetric key, where the unlocking instruction includes an input password input by the user.

[0086] 402. Use a first symmetric key to symmetric-encrypt the input password to obtain a first ciphertext.

[0087] 403. Use the public key to asymmetrically encrypt the first symmetric key to obtain a second ciphertext.

[0088] 404. Send an unlock request to the application server, where the unlock request includes the first ciphertext and the second ciphertext, so that the application server unlocks the service object related to the user in the application service provided by the application server based on the first ciphertext and the second ciphertext.

[0089] Further optionally, in response to an unlocking instruction entered by the user in the client, before randomly generating a first symmetric key, the method also includes: in response to a password setting instruction entered by the user in the client, randomly generating a second symmetric key, the password setting instruction including an unlocking password set by the user; symmetrically encrypting the unlocking password with the second symmetric key to obtain a third ciphertext; asymmetrically encrypting the second symmetric key with a public key to obtain a fourth ciphertext; and sending a password setting request to the application server, the password setting request including the third ciphertext and the fourth ciphertext, so that the application server sets an unlocking password for a service object related to the user in an application service provided by the application server based on the third ciphertext and the fourth ciphertext.

[0090] For the implementation methods of each step in this embodiment, reference can be made to the implementation methods of each step in the aforementioned embodiments, which will not be repeated here.

[0091] Figure 5 This is a flowchart of another unlocking processing method provided by an embodiment of the present application. This method can be executed by the application server, see Figure 5 , the method may include the following steps:

[0092] 501. Receive an unlock request sent by a client, where the unlock request includes a first ciphertext and a second ciphertext.

[0093] 502. In response to the unlocking request, decrypt the second ciphertext using the private key to obtain a first symmetric key.

[0094] 503. Decrypt the first ciphertext using the first symmetric key to obtain the input password entered by the user in the client.

[0095] 504. If the input password is the same as the preset unlock password, unlock the service object related to the user in the application service provided by the application server.

[0096] Further optionally, the above method also includes: if the input password and multiple preset unlocking passwords are different, then determining the similarity between the input password and each of the multiple preset unlocking passwords; judging whether there is a second unlocking password with a higher security level than the first unlocking password, wherein the first unlocking password is the unlocking password with the highest similarity to the input password among the multiple unlocking passwords, and the second unlocking password is the unlocking password with a similarity to the historical input password less than a similarity threshold among the multiple unlocking passwords, and the historical input password is an input password entered at a historical time; if it exists, outputting a first prompt message to the client, the first prompt message being used to prompt the user to enter an unlocking password with a higher security level; if it does not exist, continuing to lock the service object related to the user in the application server.

[0097] Further optionally, before determining whether there is a second unlocking password with a higher security level than the first unlocking password, it is also possible to: sort the security levels of the multiple unlocking passwords according to the pre-set attribute information of the multiple unlocking passwords, the attribute information including: password length and / or character type of the unlocking password.

[0098] Further optionally, according to the attribute information of multiple pre-set unlocking passwords, the multiple unlocking passwords are sorted by security level, including: dividing the multiple unlocking passwords into a first group of unlocking passwords and a second group of unlocking passwords according to the password length, the password length of the unlocking passwords in the first group of unlocking passwords is greater than or equal to the preset length, and the password length of the unlocking passwords in the second group of unlocking passwords is less than the preset length; based on the password length and character type of the unlocking passwords, the unlocking passwords in the first group of unlocking passwords and the unlocking passwords in the second group of unlocking passwords are sorted by security level respectively; wherein the security level of the unlocking passwords in the first group of unlocking passwords is higher than the security level of the unlocking passwords in the second group of unlocking passwords.

[0099] Further optionally, if the input password and multiple preset unlocking passwords are different, the similarity between the input password and each of the multiple preset unlocking passwords is determined respectively, including: if the input password and multiple preset unlocking passwords are different, the number of consecutive incorrect password inputs by the user is increased by 1; if the number of consecutive incorrect password inputs by the user is greater than a set number threshold, the similarity between the input password and each of the multiple preset unlocking passwords is determined respectively.

[0100] Further optionally, after the number of consecutive incorrect password inputs by the user is increased by 1, if the number of consecutive incorrect password inputs by the user is less than or equal to a set number threshold, a second prompt message is output to the client, and the second prompt message is used to prompt the user to re-enter the unlock password.

[0101] For the implementation methods of each step in this embodiment, reference can be made to the implementation methods of each step in the aforementioned embodiments, which will not be repeated here.

[0102] It should be noted that the execution subject of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 401 to 404 can be device A; for another example, the execution subject of steps 401 and 402 can be device A, and the execution subject of steps 403 and 404 can be device B; and so on.

[0103] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 401, 402, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0104] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0105] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device includes: a memory 61 and a processor 62;

[0106] The memory 61 is used to store computer programs and can be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc.

[0107] The memory 61 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0108] The processor 62 is coupled to the memory 61 and is used to execute the computer program in the memory 61 to: execute the steps in the unlocking processing method that can be executed by the client, or execute the steps in the unlocking processing method that can be executed by the application server.

[0109] Further, if Figure 6 As shown, the electronic device also includes: a communication component 63, a display 64, a power component 65, an audio component 66 and other components. Figure 6 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 6 In addition, Figure 6 The components in the dashed box are optional components, not mandatory components, and the specific components depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, or an IOT (Internet of Things) device, or a server device such as a conventional server, a cloud server, or a server array. If the electronic device of this embodiment is implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, etc., it can include Figure 6 If the electronic device of this embodiment is implemented as a server device such as a conventional server, a cloud server or a server array, it may not include Figure 6Components within the dashed box.

[0110] For the detailed implementation process of the processor executing each step, please refer to the relevant description in the above embodiments, which will not be repeated here.

[0111] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed, can implement each step that can be executed by an electronic device in the above method embodiment.

[0112] Accordingly, an embodiment of the present application also provides a computer program product, including a computer program / instruction. When the computer program / instruction is executed by a processor, the processor is enabled to implement each step in the above method embodiment that can be executed by an electronic device.

[0113] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi (Wireless Fidelity), 2G (2 Generation, 2 Generation), 3G (3 Generation, 3 Generation), 4G (4 Generation, 4 Generation) / LTE (long Term Evolution), 5G (5 Generation, 5 Generation) and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (Near Field Communication, NFC) module to facilitate short-range communication. For example, the NFC module can be based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra Wide Band (UWB) technology, Bluetooth (BT) technology and other technologies.

[0114] The above-mentioned display includes a screen, and the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0115] The power supply assembly provides power to various components of the device where the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device where the power supply assembly is located.

[0116] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as a call mode, a recording mode, and a speech recognition mode, the microphone is configured to receive an external audio signal. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting an audio signal.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0121] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interface, network interface and memory.

[0122] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0123] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, Phase Change RAM (PRAM), Static Random-Access Memory (SRAM), Dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), Read Only Memory (ROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technology, CD-ROM, Digital Versatile Disc (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. According to the definition in this article, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0125] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An unlocking processing method, characterized in that: include: In response to an unlock instruction input by a user in a client, randomly generating a first symmetric key, wherein the unlock instruction includes an input password input by the user; Using the first symmetric key to symmetric-encrypt the input password to obtain a first ciphertext; Asymmetrically encrypting the first symmetric key using a public key to obtain a second ciphertext; An unlock request is sent to an application server, wherein the unlock request includes the first ciphertext and the second ciphertext, so that the application server unlocks a service object related to the user in an application service provided by the application server based on the first ciphertext and the second ciphertext.

2. The method according to claim 1, characterized in that In response to an unlocking instruction input by a user in a client, before randomly generating a first symmetric key, the method further includes: In response to a password setting instruction input by the user in the client, randomly generating a second symmetric key, wherein the password setting instruction includes an unlocking password set by the user; Using the second symmetric key to symmetric-encrypt the unlock password to obtain a third ciphertext; Asymmetrically encrypting the second symmetric key using the public key to obtain a fourth ciphertext; A password setting request is sent to an application server, wherein the password setting request includes the third ciphertext and the fourth ciphertext, so that the application server sets the unlock password for a service object related to the user in an application service provided by the application server based on the third ciphertext and the fourth ciphertext.

3. An unlocking processing method, characterized in that: include: Receiving an unlock request sent by a client, wherein the unlock request includes a first ciphertext and a second ciphertext; In response to the unlocking request, decrypt the second ciphertext using a private key to obtain a first symmetric key; Decrypting the first ciphertext using the first symmetric key to obtain an input password entered by the user in the client; If the input password is the same as the preset unlock password, the service object related to the user in the application service provided by the application server is unlocked.

4. The method according to claim 3, characterized in that Also includes: If the input password and the preset multiple unlocking passwords are all different, then respectively determining the similarity between the input password and each of the preset multiple unlocking passwords; Determine whether there is a second unlocking password with a higher security level than the first unlocking password, wherein the first unlocking password is the unlocking password with the highest similarity to the input password among the multiple unlocking passwords, and the second unlocking password is the unlocking password with a similarity to a historical input password less than a similarity threshold among the multiple unlocking passwords, and the historical input password is an input password entered at a historical time; If so, outputting first prompt information to the client, where the first prompt information is used to prompt the user to enter an unlocking password with a higher security level; If not, continue to lock the service object related to the user in the application server.

5. The method according to claim 4, characterized in that Before determining whether there is a second unlocking password with a higher security level than the first unlocking password, the method further includes: The security levels of the multiple unlocking passwords are sorted according to the preset attribute information of the multiple unlocking passwords, wherein the attribute information includes: password length and / or character types of the unlocking passwords.

6. The method according to claim 5, characterized in that According to the attribute information of the preset multiple unlocking passwords, the multiple unlocking passwords are sorted by security level, including: Dividing the multiple unlocking passwords into a first group of unlocking passwords and a second group of unlocking passwords according to password length, wherein the password length of the unlocking passwords in the first group of unlocking passwords is greater than or equal to a preset length, and the password length of the unlocking passwords in the second group of unlocking passwords is less than the preset length; Based on the password length and character type of the unlocking password, the unlocking passwords in the first group of unlocking passwords and the unlocking passwords in the second group of unlocking passwords are respectively sorted by security level; The security level of the unlocking password in the first set of unlocking passwords is higher than the security level of the unlocking password in the second set of unlocking passwords.

7. The method according to claim 4, characterized in that If the input password and the preset multiple unlocking passwords are all different, then respectively determining the similarity between the input password and each of the preset multiple unlocking passwords includes: If the input password is different from the preset unlock passwords, the number of consecutive incorrect password inputs by the user is increased by 1; If the number of consecutive incorrect password inputs by the user is greater than a set number threshold, the similarity between the input password and each of the preset unlocking passwords is determined respectively.

8. The method according to claim 5, characterized in that After the number of consecutive incorrect password inputs by the user is increased by 1, the method further includes: If the number of consecutive incorrect password inputs by the user is less than or equal to a set number threshold, a second prompt message is output to the client, where the second prompt message is used to prompt the user to re-enter the unlock password.

9. An electronic device, characterized in that: include: Memory and processor; The memory is used to store computer programs; The processor is coupled to the memory and configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the processor is enabled to implement the steps in the method according to any one of claims 1 to 8.

Images