Website login method, terminal equipment and storage medium

Abstract

The embodiment of the invention provides a website login method, terminal equipment and a storage medium, and the website login method comprises the following steps: logging in a first website account in a first browser, and under the condition that the first browser does not register a password-free credential of the first website account, initiating a signature request to a sharing module by the first browser; the sharing module requests the application management module to verify the identity of the first browser, and when the first browser is a legal browser and the first browser is in a browser set, the sharing module uses an account private key of the first website account to sign data carried by the signature request to obtain a signature value, and the signature value is sent to the application management module; the sharing module feeds back the signature value to the first browser, and the first browser transmits the signature value to a website corresponding to the first website account, so that the website corresponding to the first website account uses an account public key of the first website account to verify the signature value. The complexity of login between browsers based on password-free credentials can be reduced.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to a website login method, terminal equipment and storage medium. Background Art

[0002] Fast identity online (FIDO) is a technical specification for verifying user identity online. It was developed by the FIDO Alliance industry association. The protocol is the first open industry standard for online and digital authentication, which can improve security, protect privacy and simplify user experience. The password-free credential (passkey) solution launched by the FIDO Alliance supports biometrics, personal identification numbers (Pin), etc., instead of the traditional way of logging into a website with an account and password. The core of the passkey solution is that the device generates a pair of public and private key pairs for each user's account on the website. The public and private key pairs corresponding to each account on each website are independent and different.

[0003] When using different browsers on the same device, you need to repeatedly register passwordless credentials for the same website on different browsers, which is cumbersome and complex. Summary of the invention

[0004] The embodiments of the present application provide a website login method, a terminal device, and a storage medium, which can reduce the complexity of password-free credential-based login between browsers.

[0005] A first aspect of an embodiment of the present application provides a website login method, the method is applied to a terminal device, the terminal device includes a sharing module, an application management module and N browsers, the method includes:

[0006] When a first website account is logged in in a first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module, the first browser is any one of the N browsers, and the signature request carries the first website account;

[0007] The sharing module requests the application management module to verify the identity of the first browser. If the first browser is a legitimate browser and is in a browser set, the sharing module signs the data carried in the signature request using the account private key of the first website account to obtain a signature value. The sharing module feeds the signature value back to the first browser. The browser set is a browser set in which the first website account is allowed to share credentials without a password.

[0008] The first browser transmits the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. If the verification passes, it is determined that the first browser has successfully logged in to the website corresponding to the first website account.

[0009] Optionally, when the first website account is logged in in the first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module, including:

[0010] When logging into the first website account in the first browser, the first browser initiates user identity authentication;

[0011] When the user identity authentication is passed and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module.

[0012] Optionally, the data transmitted between the sharing module and the first browser is encrypted with a first symmetric key, and the first symmetric key is a symmetric key between the sharing module and the first browser;

[0013] Alternatively, the data transmitted between the sharing module and the first browser is encrypted using the other party's public key.

[0014] Optionally, before the first browser initiates a signature request to the sharing module, the method further includes:

[0015] When the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, wherein the second symmetric key is a symmetric key between the shared module and the second browser, and the second browser is any one of the N browsers, where N is an integer greater than or equal to 2;

[0016] The sharing module collects from the second browser a list of website accounts with registered password-free credentials held by the second browser;

[0017] The sharing module determines a set of browsers that a second website account is allowed to share, where the second website account is any one of a list of website accounts with registered password-free credentials held by the second browser;

[0018] The sharing module collects the account private key of the second website account from the second browser; wherein the data transmitted between the sharing module and the second browser is encrypted with the second symmetric key, or the data transmitted between the sharing module and the second browser is encrypted with the other party's public key.

[0019] Optionally, the sharing module determines a set of browsers that the second website account is allowed to share, including:

[0020] The sharing module displays a list of website accounts with registered password-free credentials held by the second browser;

[0021] For each website account in the website account list, a browser set selected by a user and allowed to be shared by each website account is received.

[0022] Optionally, the terminal device further includes a security module, and when the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, including:

[0023] When the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, and the security module verifies that the second browser is a secure browser, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value.

[0024] Optionally, after the sharing module collects the account private key of the second website account from the second browser, the method further includes:

[0025] The sharing module establishes a list of association relationships among the second website account, the second browser, the account private key of the second website account, and a set of browsers that the second website account is allowed to share.

[0026] Optionally, the method further includes:

[0027] When the account private key of the second website account is updated, the second browser sends the updated account private key of the second website account to the sharing module, so that the sharing module updates the association relationship list;

[0028] And / or, when the list of website accounts with registered password-free credentials held by the second browser is updated or the set of browsers allowed to be shared by the second website account is updated, the sharing module updates the association list and sends a change notification message to the updated browser.

[0029] Optionally, the sharing module performs key negotiation with the second browser to obtain a shared secret value, and derives a second symmetric key based on the shared secret value, including:

[0030] The sharing module and the second browser respectively generate a pair of public and private key pairs, exchange their respective public keys with the second browser, negotiate to generate a shared secret value based on the other party's public key and its own private key, and derive a second symmetric key based on the shared secret value.

[0031] A second aspect of an embodiment of the present application provides a terminal device, including a sharing module, an application management module, and N browsers;

[0032] a first browser, configured to log in to a first website account in the first browser and initiate a signature request to the sharing module when the first browser has not registered a password-free credential of the first website account, wherein the first browser is any one of the N browsers, and the signature request carries the first website account;

[0033] The sharing module is used to request the application management module to verify the identity of the first browser;

[0034] The sharing module is further configured to sign the data carried in the signature request using the account private key of the first website account to obtain a signature value when the first browser is a legitimate browser and the first browser is in a browser set, and the browser set is a browser set in which the first website account is allowed to share credentials without a password;

[0035] The sharing module is further used to feed back the signature value to the first browser;

[0036] The first browser is also used to pass the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. If the verification passes, it is determined that the first browser has successfully logged in to the website corresponding to the first website account.

[0037] A third aspect of an embodiment of the present application provides a terminal device, including a processor and a memory, the memory being used to store a computer program, the computer program including program instructions, and the processor being configured to call the program instructions to execute the step instructions in the first aspect of the embodiment of the present application.

[0038] The fourth aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the above-mentioned computer-readable storage medium stores a computer program for electronic data exchange, and the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the step instructions in the first aspect of the embodiment of the present application.

[0039] The fifth aspect of the embodiments of the present application provides a computer program product, wherein the above-mentioned computer program product includes a computer program, and the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the step instructions in the first aspect of the embodiments of the present application.

[0040] In the website login method of the embodiment of the present application, when logging in to the first website account in the first browser, if the first browser has not registered the password-free credentials of the first website account, the first browser can initiate a signature request to the sharing module, and the signature request carries the first website account. The sharing module verifies that the identity of the first browser is legal, and when the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the account private key of the first website account can be used to sign the data carried in the signature request to obtain a signature value. The first browser transmits the signature value to the website corresponding to the first website account, and the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. When the verification passes, it is determined that the first browser has successfully logged in to the website corresponding to the first website account. In the embodiment of the present application, when the first browser has not registered the password-free credentials of the first website account, if the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the first browser can log in to the website corresponding to the first website account through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the password-free credentials of the first website account). The first browser does not need to register the password-free credentials of the first website account, and can also log in to the website corresponding to the first website account based on the password-free credentials. There is no need to repeatedly register password-free credentials for the same website on different browsers, which improves the convenience of logging in to the same website between different browsers and reduces the complexity of logging in between browsers based on password-free credentials. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1It is a schematic diagram of the software architecture of a terminal device provided in an embodiment of the present application;

[0043] Figure 2 It is a flowchart of a website login method provided in an embodiment of the present application;

[0044] Figure 3 It is a flowchart of another website login method provided in an embodiment of the present application;

[0045] Figure 4 It is a structural diagram of a terminal device provided in an embodiment of the present application;

[0046] Figure 5 It is a structural diagram of another terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0049] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0050] The terminal devices involved in the embodiments of the present application may include portable computers (such as mobile phones), tablet computers, laptop computers, personal computers (PCs), wearable electronic devices (such as smart watches), augmented reality (AR) and virtual reality (VR) devices, in-vehicle computers, etc. The embodiments of the present application do not limit the specific form of the terminal devices.

[0051] In the embodiment of the present application, when the first browser has not registered the passwordless credentials of the first website account, if the first browser belongs to a browser set in which the first website account is allowed to share the passwordless credentials, the first browser can log in to the first website through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the passwordless credentials of the first website account), and the first browser does not need to register the passwordless credentials of the first website account, and can also log in to the first website based on the passwordless credentials, and does not need to repeatedly register the passwordless credentials for the same website on different browsers, thereby improving the convenience of logging in to the same website between different browsers and reducing the complexity of logging in between browsers based on passwordless credentials. The following is a detailed description.

[0052] At present, one of the mainstream passkey support solutions in the industry is: the browser holds the private key and the website holds the public key. The process is roughly as follows: when a user registers a passkey on a website, the current browser generates a public-private key pair for the user's website account on the website. The browser holds the private key and registers the corresponding public key with the website (the website holds the public key). The browser can then initiate user identity authentication operations such as biometric recognition and personal identification number (Pin) input to the user by calling the corresponding application programming interface (API) on the device, and after the user identity authentication is passed, use the private key to generate a signature value and send it to the website. The website uses the public key to verify the signature and confirm the user identity authentication result on the device. After the signature verification is passed, the user can log in to the website.

[0053] However, the private key data held by different browsers are not shared. Due to commercial interests and the industry promotion of the passkey solution, different browsers store their own private key data, and there is currently no passkey data sharing solution.

[0054] When the range of websites with registered passkeys on different browsers of the same device is inconsistent (for example, browser A, the websites with registered credentials are website 1, website 2, website 3, website 4, website 5, and the websites with registered credentials on browser B are website 2, website 3, website 4, website 5, website 6), the user experience of using the passkey function on the same device will be inconsistent. For example, for the same website (for example, website 1), you can log in quickly with passkey when using browser A, but you need to enter your account password when logging in with browser B. For another example, when different browsers on the same device are used, you need to repeatedly register passwordless credentials for the same website on different browsers, which is cumbersome and complex.

[0055] See also Figure 1 , Figure 1 Schematic diagram of the software architecture of a terminal device provided in an embodiment of the present application. Figure 1 As shown, the software architecture includes a sharing module, an application management module and N browsers.

[0056] First browser (for example, Figure 1 The browser A in the example is used to log in to the first website account in a first browser, and initiate a signature request to the sharing module when the first browser has not registered a password-free credential (passkey) of the first website account, and the first browser is any one of the N browsers;

[0057] The sharing module is used to request the application management module to verify the identity of the first browser;

[0058] The sharing module is further configured to sign the data carried in the signature request using the account private key of the first website account to obtain a signature value when the first browser is a legitimate browser and the first browser is in a browser set, and the browser set is a browser set in which the first website account is allowed to share password-free credentials;

[0059] The sharing module is further used to feed back the signature value to the first browser;

[0060] The first browser is also used to pass the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. If the verification passes, it is determined that the first browser has successfully logged in to the website corresponding to the first website account.

[0061] In the embodiment of the present application, the browser may be referred to as a browser application. The N browsers may be browsers installed on the terminal device. The N browsers may be all browsers installed on the terminal device, or may be some browsers installed on the terminal device (e.g., browsers commonly used by users), which is not limited in the embodiment of the present application.

[0062] N may be a positive integer greater than or equal to 2.

[0063] The application management module can manage the various applications installed on the terminal device. It can record the identity information of each application (for example, the application ID). The application module can record the ID of each browser and the ID of the shared module.

[0064] The sharing module can be a software module pre-installed in the operating system, and the security of the sharing module is relatively high. The sharing module can request the application management module on the terminal device to help verify the authenticity of the application identity of each browser on the terminal device. The application management module can record the identity information of each browser. The sharing module and the browser can communicate with each other, and the sharing module can store a list of website accounts with registered passwordless credentials (passkey) corresponding to each browser. The sharing module can also store a set of browsers that are allowed to share passwordless credentials corresponding to each registered passwordless credential (passkey) website account.

[0065] Please refer to Table 1, which is a correspondence table between various browsers and corresponding website account lists with registered passkeys stored in a sharing module provided in an embodiment of the present application.

[0066] Table 1

[0067]

[0068]

[0069] As can be seen from Table 1, website account 1 registered passkey on browser A, website account 2 registered passkey on browser A, website account 3 registered passkey on browser A and browser B, website account 4 registered passkey on browser A and browser B, website account 5 registered passkey on browser B, and website account 6 registered passkey on browser B.

[0070] Please refer to Table 2, which is a correspondence table between the website accounts of each browser that have registered passkeys and the corresponding browser sets that are allowed to share passkeys, stored in a sharing module provided in an embodiment of the present application.

[0071] Table 2

[0072] Passkey registered website account A set of browsers that are allowed to share passkeys Website Account 1 Browser B, Browser C Website Account 2 Browser B, Browser C, Browser D Website Account 3 Browser C Website Account 4 Browser C, Browser D Website Account 5 Browser A, Browser C, Browser D Website Account 6 Browser C, Browser D … …

[0073] Combining Table 1 and Table 2, it can be seen that website account 1 has registered a passkey on browser A. When website account 1 registers a passkey on browser A, browser A holds the account private key of website account 1, and the website corresponding to website account 1 holds the account public key of website account 1. The browser set that website account 1 is allowed to share passkey is: browser B, browser C. When logging in to website account 1 on browser B or browser C, a signature request can be sent to the sharing module. The sharing module verifies the legitimacy of the browser, and when it detects that the browser is in the browser set that website account 1 is allowed to share passkey, the account private key of website account 1 can be used to verify the data carried in the signature request to obtain the signature value, and the signature value is passed to the browser. The browser passes the signature value to the website corresponding to website account 1, and the website uses the account public key of website account 1 to verify the signature value. If the verification is successful, it is determined that the website corresponding to website account 1 is successfully logged in on the browser. If the verification fails, the website corresponding to website account 1 cannot be logged in on the browser based on passkey.

[0074] Website account 2 registered a passkey on browser A. The browsers that website account 2 is allowed to share passkey with are: browser B, browser C, and browser D. Website account 3 registered a passkey on browser A and browser B. The browsers that website account 3 is allowed to share passkey with are: browser C. Website account 4 registered a passkey on browser A and browser B. The browsers that website account 4 is allowed to share passkey with are: browser C and browser D. Website account 5 registered a passkey on browser B. The browsers that website account 5 is allowed to share passkey with are: browser A, browser C, and browser D. Website account 6 registered a passkey on browser B. The browsers that website account 6 is allowed to share passkey with are: browser C and browser D.

[0075] The sharing module may store the above Table 1 and Table 2 in a secure storage manner.

[0076] In the embodiment of the present application, when the first browser has not registered the password-free credentials of the first website account, if the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the first browser can log in to the website corresponding to the first website account through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the password-free credentials of the first website account). The first browser does not need to register the password-free credentials of the first website account, and can also log in to the website corresponding to the first website account based on the password-free credentials. There is no need to repeatedly register password-free credentials for the same website on different browsers, which improves the convenience of logging in to the same website between different browsers and reduces the complexity of logging in between browsers based on password-free credentials.

[0077] Optional, Figure 1 The software architecture may also include a security module.

[0078] The security module can manage the security of each application installed on the terminal device. It can record the access behavior information of each application (for example, the resource information accessed, the frequency of access, the time of access, etc.). The resources can be system resources, such as cameras, photo albums, microphones, etc.

[0079] The sharing module can verify the security of the browser through the security module to verify whether the browser is a malicious application, for example, maliciously accessing unauthorized system resources.

[0080] See also Figure 2 , Figure 2 It is a flowchart of a website login method provided in an embodiment of the present application. Figure 2 The method can be based on Figure 1 The software architecture implementation is as follows: Figure 2 As shown, the method may include the following steps.

[0081] 201, when logging in to a first website account in a first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to a sharing module, the first browser is any one of N browsers, and the signature request carries the first website account.

[0082] In the embodiment of the present application, the website account is an account registered by the user on the website. Among them, the first website account is the account registered by the user on the first website, the first website is the website where the first website account is registered, and the first website can also be called the website corresponding to the first website account. For example, the user logs in to website X on browser A, and the user login account registered on website X is the account registered on website X.

[0083] When a user uses browser A to register a user login account on website X, if a password-free credential authentication method is used, the specific process is as follows: Browser A generates a public-private key pair (account public key and account private key of the website account) for the user's website account on website X. The browser holds the account private key and registers the corresponding account public key with website X (the website holds the account public key). Browser A can subsequently initiate user identity authentication operations such as biometric identification and Pin input to the user by calling the corresponding application programming interface (API) on the device, and after the user identity authentication is passed, browser A uses the account private key to generate a signature value and send it to website X. Website X uses the account public key to verify the signature value. After the verification is passed, the website account can be used to log in to website X.

[0084] The first browser initiates a signature request to the sharing module, requesting the sharing module to sign the data carried in the signature request using the account private key of the first website account.

[0085] The signature request carries the first website account. The signature request may also carry login information related to the first website account. The login information related to the first website account may be the business information required for this website login, subject to the login policy of the specific website.

[0086] The signature request may also carry browser identification information (ID) of the first browser. The sharing module may determine the identity of the browser that sends the signature request according to the browser ID of the first browser.

[0087] Wherein, N can be a positive integer greater than or equal to 2.

[0088] 202. The sharing module requests the application management module to verify the identity of the first browser. If the first browser is a legitimate browser and is in a browser set, the sharing module uses the account private key of the first website account to sign the data carried in the signature request to obtain a signature value. The sharing module feeds the signature value back to the first browser. The browser set is a browser set in which the first website account is allowed to share credentials without a password.

[0089] In the embodiment of the present application, after receiving the signature request sent by the first browser, the sharing module will verify whether the identity of the first browser is legal. The application management module stores a set of browser IDs managed by it, and the sharing module can send the browser ID of the first browser to the application management module. If the browser ID of the first browser is in the set of browser IDs stored in the application management module, the application management module returns a first indication message to the sharing module, and the first indication message is used to indicate that the first browser is a legal browser; if the browser ID of the first browser is not in the set of browser IDs stored in the application management module, the application management module returns a second indication message to the sharing module, and the second indication message is used to indicate that the first browser is an illegal browser.

[0090] In the case that the first browser is a legitimate browser, the sharing module queries, based on the first website account carried in the signature request, from a correspondence table between website accounts with registered passwordless credentials and corresponding browser sets that are allowed to share passwordless credentials stored in the sharing module (such as Table 2 above), whether the first browser is in the browser set that is allowed to share passwordless credentials corresponding to the first website account; if so, the sharing module signs the data carried in the signature request using the account private key of the first website account to obtain a signature value, and the sharing module feeds the signature value back to the first browser.

[0091] In an embodiment of the present application, the sharing module requests the application management module to verify the identity of the first browser, and the sharing module queries whether the first browser is in the browser set corresponding to the first website account that is allowed to share credentials without a password. When the first browser is a legitimate browser and the first browser is in the browser set, the sharing module considers that the first browser is a browser corresponding to the first website account that is allowed to share credentials without a password, and can respond to the signature request initiated by the first browser, use the account private key of the first website account to sign the data carried in the signature request, obtain the signature value, and feed the signature value back to the first browser. The entire signing process is completed on the sharing module side, and the first browser does not need to hold the account private key of the first website account, and does not need to sign. The sharing module is a pre-installed module in the operating system, which can improve the security of the signature.

[0092] Optionally, if the first browser is an illegal browser, or the first browser is not in the browser set that allows passwordless credential sharing for the first website account, the sharing module feeds back a notification message of rejecting the signature request to the first browser, which can improve the security of logging into a website based on passwordless credentials.

[0093] 203, the first browser transmits the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. If the verification is successful, it is determined that the first browser has successfully logged into the website corresponding to the first website account.

[0094] In an embodiment of the present application, after the first browser receives the signature value fed back by the shared module, it can pass the signature value to the website corresponding to the first website account, and let the website corresponding to the first website account use the account public key of the first website account to verify the signature value. If the verification passes, it is determined that the first browser has successfully logged into the website corresponding to the first website account. The entire verification process is completed on the website side corresponding to the first website account. In the entire signing and verification process, the browser only plays the role of intermediate data transmission. The first browser does not need to hold the account private key of the first website account, which reduces the risk of the account private key of the first website account being leaked. The first browser does not need to sign, but the shared module pre-installed in the operating system is used to sign, which can improve the security of the signature.

[0095] If the signature verification fails, the website corresponding to the first website account cannot be logged in on the first browser based on the password-free credentials.

[0096] In the embodiment of the present application, when the first browser has not registered the password-free credentials of the first website account, if the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the first browser can log in to the website corresponding to the first website account through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the password-free credentials of the first website account). The first browser does not need to register the password-free credentials of the first website account, and can also log in to the website corresponding to the first website account based on the password-free credentials. There is no need to repeatedly register password-free credentials for the same website on different browsers, which improves the convenience of logging in to the same website between different browsers and reduces the complexity of logging in between browsers based on password-free credentials.

[0097] Optionally, in step 201, when the first website account is logged in in the first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module, which may specifically include the following steps (101) and (102).

[0098] (101) when logging into the first website account in a first browser, the first browser initiates user identity authentication;

[0099] (102) When the user identity authentication is passed and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module.

[0100] In the embodiment of the present application, when logging into the first website account in the first browser, the first browser initiates user identity authentication. The browser can subsequently initiate user identity authentication operations such as biometric identification or inputting a personal identification number (Pin) to the user by calling the corresponding application programming interface (API) on the device. Biometric identification can include any biometric identification method such as face recognition, fingerprint recognition, palm print recognition, iris recognition, etc.

[0101] After the user identity authentication is passed and the first browser has not registered the passwordless credentials of the first website account, the first browser can initiate a signature request to the sharing module, thereby improving the security of logging into the first website account based on the passwordless credentials.

[0102] Optionally, if the user identity verification fails, the first browser rejects the user's attempt to log in to the first website account based on the password-free credentials, which can improve the security of logging in to the website based on the password-free credentials.

[0103] Optionally, the data transmitted between the sharing module and the first browser is encrypted with a first symmetric key, and the first symmetric key is a symmetric key between the sharing module and the first browser;

[0104] Alternatively, the data transmitted between the sharing module and the first browser is encrypted using the other party's public key.

[0105] In the embodiment of the present application, all data transmitted between the sharing module and the first browser may be encrypted, thereby improving the security of data transmitted between the sharing module and each browser.

[0106] The security module may store the symmetric key derived between the security module and each browser, and each browser may store the symmetric key derived between itself and the security module.

[0107] In one embodiment, the data transmitted between the sharing module and the first browser may be encrypted using a symmetric key between the sharing module and the first browser.

[0108] In the embodiment of the present application, before executing step 201, the sharing module can perform key negotiation with each browser to obtain a shared secret value, and derive a symmetric key based on the shared secret value. For example, the sharing module can perform key negotiation with the first browser using a key negotiation algorithm to obtain a first shared secret value, and derive a first symmetric key based on the first shared secret value and the key derivation algorithm. When deriving a symmetric key based on the shared secret value, a different symmetric key can be derived each time, and the method of generating a symmetric key is more flexible and more secure.

[0109] In another embodiment, the data transmitted between the sharing module and the first browser may be encrypted using the other party's public key.

[0110] In the embodiment of the present application, before executing step 201, the sharing module can generate a pair of public-private key pairs with each browser, and the sharing module exchanges respective public keys with each browser. For example, the sharing module generates a pair of public-private key pairs with the first browser, and the sharing module exchanges respective public keys with the first browser. When transmitting data between the sharing module and the first browser, the public key of the other party can be used for encryption processing.

[0111] See also Figure 3 , Figure 3 It is a flowchart of another website login method provided in an embodiment of the present application. Figure 3 The method can be based on Figure 1 The software architecture implementation is as follows: Figure 3 As shown, the method may include the following steps.

[0112] 301. When the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the shared module and the second browser negotiate a key to obtain a shared secret value, and derive a second symmetric key based on the shared secret value. The second symmetric key is a symmetric key between the shared module and the second browser. The second browser is any one of N browsers, where N is an integer greater than or equal to 2.

[0113] In the embodiment of the present application, the sharing module can request the application management module to verify whether the identity of each browser in the N browsers is a legitimate identity, that is, to verify whether each browser is a legitimate browser. For details, please refer to the relevant description of the above step 202, which will not be repeated here.

[0114] The second browser may request the application management module to verify whether the shared module is a system preset application. The system preset application is a software module preset by the operating system of the terminal device.

[0115] The application management module stores the IDs of the applications it manages, including the IDs of the shared modules. If the application management module detects that the IDs of the applications it manages include the IDs of the shared modules, it considers that the shared modules are system preset applications and the identity of the shared modules is legal; if the application management module detects that the IDs of the applications it manages do not include the IDs of the shared modules, it considers that the shared modules are not system preset applications and the identity of the shared modules is illegal.

[0116] The sharing module and the second browser mutually authenticate each other's identities as legitimate through the application management module, indicating that the sharing module authenticates the second browser as a legitimate browser through the application management module, and the second browser authenticates the sharing module as a legitimate module through the application management module.

[0117] If the sharing module verifies that the second browser is an illegal browser through the application management module, or the second browser verifies that the sharing module is an illegal module through the application management module, this process ends.

[0118] The shared module can perform key negotiation with each browser to obtain a shared secret value, and derive a symmetric key between the shared module and each browser based on the shared secret value.

[0119] The sharing module may use a key negotiation algorithm to perform key negotiation with the second browser to obtain a shared secret value, and derive a second symmetric key based on the shared secret value and the key derivation algorithm. The key negotiation algorithm may include an internationally common key negotiation algorithm, for example, the key negotiation algorithm may be an elliptic curve Diffie-Hellman key exchange algorithm. The key derivation algorithm may be an internationally common key derivation algorithm. For example, the key derivation algorithm may be an HMAC-based key derivation function (HKDF) algorithm based on message authentication codes (HMAC).

[0120] The sharing module performs key negotiation with the second browser to obtain a shared secret value, and derives a second symmetric key based on the shared secret value, including:

[0121] The sharing module and the second browser respectively generate a pair of public and private key pairs, exchange their respective public keys with the second browser, negotiate to generate a shared secret value based on the other party's public key and its own private key, and derive a second symmetric key based on the shared secret value.

[0122] In an embodiment of the present application, the sharing module and the second browser can each generate a pair of public-private key pairs based on an asymmetric encryption algorithm (e.g., RSA algorithm). The sharing module holds its own private key and sends its own public key to the second browser. The second browser holds its own private key and sends its own public key to the sharing module. The sharing module generates a shared secret value based on the other party's public key and its own private key, or the second browser also generates a secret shared value based on the other party's public key and its own private key. After the secret shared value is generated, a second symmetric key is derived based on the shared secret value.

[0123] When the second symmetric key is derived based on the shared secret value, a different symmetric key can be derived each time, and the method of generating the symmetric key is more flexible and more secure. For example, after the sharing module and the second browser have negotiated once before, the shared secret value can be used for derivation. Each subsequent time the second symmetric key is generated, the relevant information of each session between the two (for example, session parameters) can be combined, and the relevant information of the session can be used as the derived parameters to generate the second symmetric key, so that the second symmetric key generated each time is different.

[0124] The second browser may be different from or the same as the first browser.

[0125] Optionally, in step 301, when the sharing module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the sharing module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, which may include the following steps:

[0126] When the sharing module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, and the security module verifies that the second browser is a secure browser, the sharing module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value.

[0127] In the embodiment of the present application, after the sharing module and the second browser mutually verify each other's identity as a legal identity through the application management module, the security module can also verify whether the second browser is a secure browser. If the second browser is a secure browser, key negotiation is performed between the sharing module and the second browser.

[0128] The security module can manage the security of each application installed on the terminal device. The access behavior information of each application can be recorded (for example, the resource information accessed, the frequency of access, the time of access, etc.). The security module can analyze the access behavior information of the second browser to determine whether the second browser is a safe browser. The security management module uses a security detection model to detect whether the second browser has malicious behavior based on the expected access capability information of the second browser and the access behavior information of the second browser. For example, the second browser does not originally have the ability to access the photo album, and the expected access capability information of the second browser does not include the ability to access the photo album. If the second browser accesses the photo album, it is considered that the second browser has malicious behavior and is an unsafe browser.

[0129] When the sharing module verifies through the security module that the second browser is not a secure browser, this process ends.

[0130] The embodiment of the present application can verify whether the second browser has malicious behavior through the security module, thereby avoiding the security module from negotiating a key with the browser with malicious behavior, and can improve the security of browser login.

[0131] 302, the sharing module collects from the second browser a list of website accounts with registered password-free credentials held by the second browser.

[0132] In the embodiment of the present application, the sharing module initiates a request to the second browser to collect a list of website accounts with registered passwordless credentials held by the second browser. After the second browser receives the request, the second browser can send all website accounts with registered passwordless credentials on the second browser as a list (such as a row in the above Table 1) to the sharing module. The second browser can also store a list of all website accounts with registered passwordless credentials on the second browser (such as a row in the above Table 1). After the second browser receives the request, it sends the list to the sharing module.

[0133] 303, the sharing module determines a browser set that the second website account is allowed to share, where the second website account is any one in the list of website accounts with registered password-free credentials held by the second browser.

[0134] In the embodiment of the present application, after receiving the above Table 1, the sharing module can know which browsers each website has registered the passwordless credentials (passkey). The sharing module can select by default that the browser set allowed to be shared by each website account is the browser that has not registered the passwordless credentials (passkey) of the website account among all browsers on the terminal device as the browser set allowed to be shared by the website account. The sharing module can also receive the user's selection to determine the browser set allowed to be shared by each website account.

[0135] It should be noted that the browser set that the second website account allows to be shared can be an empty set or a non-empty set. If the browser set that the second website account allows to be shared is an empty set, it indicates that the user does not allow the second website account to be shared with other browsers (browsers other than the second browser) to use the passkey.

[0136] Optionally, in step 303, the sharing module determines the browser set that the second website account is allowed to share, which may include the following steps (3031) and (3032).

[0137] (3031) the sharing module displays a list of website accounts with registered password-free credentials held by the second browser;

[0138] (3032) For each website account in the website account list, the sharing module receives a browser set selected by the user that is allowed to be shared by each website account.

[0139] In an embodiment of the present application, the sharing module displays a list of website accounts with registered password-free credentials held by the second browser (such as a row in Table 1 above). When the user selects each website account in the website account list, the user is prompted to manually select a set of browsers that the website account is allowed to be shared with, and all browsers that do not have password-free credentials for the website account registered are displayed for the user to choose from, and the user can select a set of browsers that the website account is allowed to be shared with.

[0140] After executing step 303, the sharing module can store a correspondence table (such as Table 2 above) between website accounts with registered password-free credentials and corresponding browser sets that are allowed to share password-free credentials. Each row of the table is a browser set that a website account is allowed to share.

[0141] 304, the sharing module collects the account private key of the second website account from the second browser; wherein the data transmitted between the sharing module and the second browser is encrypted with the second symmetric key, or the data transmitted between the sharing module and the second browser is encrypted with the other party's public key.

[0142] In an embodiment of the present application, the sharing module initiates a request to the second browser to collect the account private key of the second website account. After the second browser receives the request, the second browser can send the account private key of the second website account to the sharing module.

[0143] In one embodiment, the data transmitted between the sharing module and the second browser may be encrypted using a second symmetric key (a symmetric key between the sharing module and the second browser).

[0144] In the embodiment of the present application, before executing step 304, in step 301, the sharing module may perform key negotiation with each browser to obtain a shared secret value, and derive a symmetric key based on the shared secret value. For example, the sharing module may perform key negotiation with the second browser using a key negotiation algorithm to obtain a second shared secret value, and derive a second symmetric key based on the second shared secret value and the key derivation algorithm.

[0145] In another embodiment, the data transmitted between the sharing module and the second browser may be encrypted using the other party's public key.

[0146] In the embodiment of the present application, before executing step 304, in step 301, the sharing module can generate a pair of public-private key pairs with each browser, and the sharing module exchanges respective public keys with each browser. For example, the sharing module and the second browser generate a pair of public-private key pairs, and the sharing module and the second browser exchange respective public keys. When transmitting data between the sharing module and the second browser, the public key of the other party can be used for encryption processing.

[0147] Optionally, after executing step 304, the above steps 201 to 203 may also be executed.

[0148] In the embodiment of the present application, when the sharing module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the sharing module and the second browser perform key negotiation to obtain a shared secret value, derive a second symmetric key based on the shared secret value, and the sharing module collects the website account list of the second browser that has registered password-free credentials from the second browser. The sharing module determines the browser set that the second website account allows to be shared, and the second website account is any one of the website account list of the second browser that has registered password-free credentials. The sharing module collects the account private key of the second website account from the second browser. The sharing module can store the browser set that each website account allows to be shared, and the account private key of each website account. Prepare for the subsequent login of the browser without the password-free credentials of a certain website account, thereby improving the convenience of logging in to the same website between different browsers and reducing the complexity of logging in between browsers based on password-free credentials.

[0149] Optionally, after executing 304, the following step 305 may also be executed.

[0150] 305, the sharing module establishes a list of association relationships among the second website account, the second browser, the account private key of the second website account, and the browser set that the second website account is allowed to share.

[0151] Please refer to Table 3, which is a list of associations between various website accounts stored in a sharing module provided in an embodiment of the present application, a browser with password-free credentials registered for the website account, the account private key of the website account, and a set of browsers allowed to be shared by the website account.

[0152] Table 3

[0153]

[0154]

[0155] As can be seen from Table 3, website account 1 registered passkey on browser A, the account private key of website account 1 is priv1, and the browser set that website account 1 is allowed to share passkey is: browser B, browser C. Website account 2 registered passkey on browser A, the account private key of website account 2 is priv2, and the browser set that website account 2 is allowed to share passkey is: browser B, browser C, browser D. Website account 3 registered passkey on browser A and browser B, the account private key of website account 3 is priv3, and the browser set that website account 3 is allowed to share passkey is: browser C. Website account 4 registered passkey on browser A and browser B, the account private key of website account 4 is priv4, and the browser set that website account 4 is allowed to share passkey is: browser C, browser D. Website account 5 registered passkey on browser B, the account private key of website account 5 is priv5, and the browser set that website account 5 is allowed to share passkey is: browser A, browser C, browser D. Website account 6 has registered a passkey on browser B. The account private key of website account 6 is priv6. The set of browsers that website account 6 is allowed to share passkey with are: browser C and browser D.

[0156] After executing step 305, the sharing module stores a list of associations between the second website account, the second browser, the account private key of the second website account, and the browser set that the second website account allows to be shared. The sharing module can store the above association list in a secure storage manner.

[0157] Optionally, after executing step 305, the above steps 201 to 203 may also be executed.

[0158] After executing step 305, when executing step 202, it can be verified according to the above Table 3 whether the first browser is in the browser set that is allowed to share passwordless credentials for the first website account.

[0159] Optionally, after executing step 305, the following step 306 may also be executed.

[0160] 306, when the account private key of the second website account is updated, the second browser sends the updated account private key of the second website account to the sharing module, so that the sharing module updates the association relationship list;

[0161] And / or, when the list of website accounts with registered password-free credentials held by the second browser is updated or the set of browsers allowed to be shared by the second website account is updated, the sharing module updates the association list and sends a change notification message to the updated browser.

[0162] In the embodiment of the present application, the above Table 3 may change. When the account private key of the website account is updated (the key changes), the browser that has registered the passwordless credentials of the website account can send the updated account private key of the website account to the sharing module, and the sharing module can update the above Table 3. When the list of website accounts with registered passwordless credentials held by the browser is updated (the list of website accounts with registered password credentials held by the browser is updated, such as the above Table 1 changes), the sharing module can update the above Table 3. When the set of browsers that the website account allows to be shared is updated, the sharing module can update the above Table 3.

[0163] Optionally, after executing step 306, the above steps 201 to 203 may also be executed.

[0164] In an embodiment of the present application, when the list of website accounts with registered password-free credentials held by the second browser is updated or the set of browsers allowed to be shared by the second website account is updated, a change notification message can also be sent to the updated browser to notify the browser in a timely manner.

[0165] The embodiment of the present application proposes a method for sharing passkey data between browsers based on a shared module, which is summarized as follows.

[0166] The sharing module on the terminal device requests the application management module on the terminal device to help verify the authenticity of the application identity of each browser on the terminal device and record the identity information of each browser; then the sharing module requests the security module on the terminal device to help confirm the security of each browser application.

[0167] When the sharing module on the terminal device initiates a request to collect information from each browser, each browser respectively requests the application management module on the terminal device to help verify that the application identity of the sharing module is a preset system application.

[0168] The shared module and each browser randomly generate and store a pair of public and private key pairs. When the shared module and each browser mutually confirm the authenticity of each other's application identity, the shared module and a single browser exchange public keys and negotiate to obtain a shared secret value for deriving a symmetric key.

[0169] When the shared module and each browser subsequently transmit data between applications, the derived symmetric key is used to encrypt and decrypt the transmitted data.

[0170] The sharing module obtains a list of website accounts with registered passkeys held by each browser from the browser, and allows the user to select a shared passkey account scope, and each shared passkey account is allowed to obtain a shared browser scope.

[0171] The sharing module collects the account passkey private key information from the corresponding browser according to the shared passkey account range selected by the user. The sharing module allows the browsers in the range to call the shared passkey data according to the browser range selected by the user. The sharing module verifies the identity of the current browser and uses the private key of the website account of the shared passkey to generate a signature value for the current browser, so that the browser can use the passkey to conveniently log in to the website account of the shared passkey.

[0172] The passkey data sharing method between browsers based on the shared module may specifically include the following seven parts.

[0173] The first part, the shared module (share_manager) and each browser verify each other's identity. The first part may include the following steps (11) to (15).

[0174] (11) The terminal device OEM manufacturer pre-installs a shared module (denoted as share_manager) in the device operating system.

[0175] (12) share_manager requests the application management module on the terminal device to help verify the application identities of different browsers on the terminal device (supporting two or more browsers, taking two browsers as an example below, respectively denoted as browserA and browserB) and record the identity information of browserA and browserB (respectively denoted as browserA_ID and browserB_ID).

[0176] (13) share_manager requests the security module on the terminal device to help confirm the security of browserA and browserB and whether browserA and browserB are malicious applications.

[0177] (14) When the identities of browserA and browserB applications are genuine and no security risks are detected (they are not malicious applications), share_manager initiates a key negotiation request to browserA and browserB.

[0178] (15) BrowserA and browserB respectively request the application management module on the device to help verify whether the application identity of share_manager is a pre-installed system application.

[0179] The second part, the key negotiation between the sharing module (share_manager) and each browser. The second part may include the following steps (21) to (23).

[0180] (21) After the authenticity of each other's application identity is mutually confirmed between share_manager and browserA and browserB, and there is no security risk, share_manager, browserA, and browserB randomly generate and store a pair of public and private key pairs respectively.

[0181] The public-private key pair generated by share_manager is denoted as share_pub and the private key as share_priv. The public-private key pair generated by browserA is denoted as A_pub and the private key as A_priv. The public-private key pair generated by browserB is denoted as B_pub and the private key as B_priv.

[0182] (22) share_manager exchanges public keys with browserA and browserB on the terminal device respectively, performs key negotiation, and derives a symmetric key.

[0183] Among them, the symmetric key derived between share_manager and browserA is recorded as A_DEK, and the symmetric key derived between share_manager and browserB is recorded as B_DEK.

[0184] (23) share_manager securely stores the symmetric keys between itself and each browser, and each browser stores the symmetric keys derived between itself and share_manager.

[0185] The third part, the sharing module (share_manager) collects the passkey account list from the browser. The third part may include the following steps (31) to (35).

[0186] (31) share_manager initiates a request to the corresponding browsers browserA and browserB based on the browser application information browserA_ID and browserB_ID on the terminal device recorded in step (12) to collect the website account information of the registered passkey held by browserA and browserB.

[0187] (32) BrowserA and browserB respectively request the application management module on the device to verify whether the received request comes from the real share_manager.

[0188] (33) After the identity of share_manager is verified, browserA and browserB respectively organize the website accounts with registered passkeys held by them to form lists (the information lists formed by browserA and browserB are respectively recorded as listA and listB). listA and listB can contain website accounts or website accounts and account IDs corresponding to website accounts.

[0189] (34) BrowserA and browserB use A_DEK and B_DEK to encrypt listA and listB respectively, and pass the ciphertext of listA and listB to share_manager respectively.

[0190] (35) share_manager uses A_DEK and B_DEK to decrypt the received ciphertext and obtain the plaintext data of listA and listB.

[0191] In the fourth part, the user selects the shared passkey scope and the target shared browser scope. The fourth part may include the following steps (41) to (44).

[0192] (41) share_manager calls the relevant API on the terminal device to verify the user's identity through biometrics and other methods.

[0193] (42) After the user identity verification is passed, share_manager displays listA, listB, and the list of all browsers on the terminal device (i.e., browserA, browserB) to the user.

[0194] (43) The user selects the passkey website account that he wishes to share from the account information contained in listA and listB (referred to as share_accounts), and selects the browser range that is allowed to share the use of share_accounts from the list of all verified browsers on the terminal device (referred to as share_browsers).

[0195] (44) After the user confirms the share_browsers range, share_manager requests the security module on the terminal device to confirm the security of the browser applications in share_browsers and whether they do not contain malicious software.

[0196] If there is malware in share_browsers, remove the malware from share_browsers and notify the user in time. If there is no malware in share_browsers, no action will be taken.

[0197] In the fifth part, the sharing module (share_manager) collects the shared passkey account private key. The fifth part may include the following steps (51) to (56).

[0198] (51) Based on share_accounts, share_manager requests the passkey private key (referred to as shared_priv) of share_accounts from the corresponding browsers (referred to as source_browsers) that hold the passkey private key of share_accounts.

[0199] (52) source_browsers Each browser calls the relevant APIs of biometrics and other methods to verify the user's identity and confirm the scope of the share_accounts that the user is about to share.

[0200] (53) After the user identity is authenticated and the passkey sharing scope is confirmed to the user, source_browsers use the derived symmetric key to encrypt the shared_priv of share_accounts and send the ciphertext to share_manager.

[0201] (54) share_manager uses the derived symmetric key to decrypt and store shared_priv respectively.

[0202] (55) share_manager keeps records and maintains a list of associations between share_accounts, source_browsers, shared_priv, and share_browsers (referred to as share_list).

[0203] (56) Based on the user's choice, share_manager notifies share_browsers of the range of share_accounts that it is allowed to use.

[0204] In the sixth part, the sharing module (share_manager) provides the share_accounts private key signature for the share_browsers. The sixth part may include the following steps (61) to (66).

[0205] (61) When a user logs into share_accounts in share_browsers, share_browsers initiates biometric verification and other methods to verify the user's identity.

[0206] (62) After the user identity is verified, share_browsers initiates a signature request to share_manager, passing the share_accounts to be logged in and other relevant information for this login.

[0207] (63) share_manager requests the application management module on the device to help verify that the login request comes from real share_browsers.

[0208] (64) After the share_browsers are authenticated, the share_manager determines whether the share_browsers are allowed to share the shared_priv of the share_accounts to be logged in based on the maintained share_list.

[0209] If not allowed, share_manager will reject the signature request from share_browsers.

[0210] If allowed, proceed to step (65)

[0211] (65) share_manager uses shared_priv to sign the data passed to share_browsers and feeds the signature value back to share_browsers.

[0212] (66) share_browsers sends the signature value to the website corresponding to share_accounts. The website will use the public key corresponding to shared_priv to verify the signature. If the signature verification is successful, it confirms that the login is successful.

[0213] Part 7: Refreshing shared data of the shared module (share_manager). Part 7 may include the following steps (71) to (72).

[0214] (71) When the shared_priv shared by source_browsers is refreshed, source_browsers sends the updated data to share_manager.

[0215] (72) When the user changes the shared account scope and shared browser, source_browsers collects new data from the corresponding browser or deletes the shared data it maintains based on the user's selection, refreshes share_list, and notifies the corresponding browser of the changes.

[0216] The encryption algorithm in the embodiment of the present application can be flexibly selected, for example, the international standard AES algorithm is adopted. The key negotiation algorithm in the present application can be flexibly selected, for example, the international standard ECDH algorithm is adopted.

[0217] The embodiments of the present application support users to share the passkeys of some website accounts between different browsers, thereby improving the user experience of the passkey function on different browsers, reducing the tedious operation of repeatedly registering passkeys for the same website on different browsers, and improving the device's support for the passkey function and the ease of use of the passkey function.

[0218] In the embodiment of the present application, the user independently selects the scope of the shared passkey and the scope of the browsers that are allowed to share the passkey, flexibly supports the user's own configuration, and improves flexibility.

[0219] The embodiment of the present application provides a shared module on the device to uniformly manage data, rather than requiring browsers to provide data to each other, thereby avoiding direct interaction between different browsers and modification of browser functional modules, improving the compatibility of the solution, and facilitating the promotion of the solution among many browsers.

[0220] The embodiments of the present application avoid browsers providing data to each other, avoid the possibility of data pollution between different browsers, and avoid potential negative impact on the commercial interests of browsers due to data interaction between browsers.

[0221] The embodiment of the present application adopts a key negotiation method to negotiate and derive encryption keys for encrypting data transmitted between applications, thereby improving data confidentiality during data transmission and improving security.

[0222] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that in order to realize the above functions, the terminal device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiment provided in this article, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0223] The embodiment of the present application can divide the terminal device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0224] See also Figure 4 , Figure 4 4 is a schematic diagram of a terminal device provided in an embodiment of the present application. The terminal device 400 may include a sharing module 410, an application management module 420, and N browsers; the N browsers include a first browser 431 and a second browser 432. The first browser 431 and the second browser 432 may be the same browser or different browsers.

[0225] A first browser 431 is used to log in to a first website account in the first browser 431, and when the first browser 431 has not registered the password-free credentials of the first website account, initiate a signature request to the sharing module 410, the first browser 431 is any one of the N browsers, and the signature request carries the first website account;

[0226] The sharing module 410 is used to request the application management module 420 to verify the identity of the first browser 431;

[0227] The sharing module 410 is further configured to sign the data carried in the signature request using the account private key of the first website account to obtain a signature value when the first browser 431 is a legitimate browser and the first browser 431 is in a browser set, and the browser set is a browser set in which the first website account is allowed to share passwordless credentials;

[0228] The sharing module 410 is further used to feed back the signature value to the first browser 431;

[0229] The first browser 431 is also used to pass the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. When the verification passes, it is determined that the first browser 431 has successfully logged in to the website corresponding to the first website account.

[0230] Optionally, the first browser 431 is further used to initiate user identity authentication when logging into the first website account in the first browser 431;

[0231] The first browser 431 is further configured to initiate a signature request to the sharing module 410 when the user identity authentication is passed and the first browser 431 has not registered the password-free credentials of the first website account.

[0232] Optionally, the signature request carries the first website account and login information related to the first website account.

[0233] Optionally, the data transmitted between the sharing module 410 and the first browser 431 is encrypted with a first symmetric key, and the first symmetric key is a symmetric key between the sharing module 410 and the first browser 431;

[0234] Alternatively, the data transmitted between the sharing module 410 and the first browser 431 is encrypted by the public key of the other party.

[0235] Optionally, the sharing module 410 is further configured to perform key negotiation with the second browser 432 to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, when the sharing module 410 and the second browser 432 mutually verify each other's identity as a legal identity through the application management module 420, wherein the second symmetric key is a symmetric key between the sharing module 410 and the second browser 432, and the second browser 432 is any one of the N browsers, where N is an integer greater than or equal to 2;

[0236] The sharing module 410 is further used to collect from the second browser 432 a list of website accounts with registered password-free credentials held by the second browser 432;

[0237] The sharing module 410 is further used to determine a set of browsers that the second website account is allowed to share, where the second website account is any one of the website accounts in the list of registered password-free credentials held by the second browser 432;

[0238] The sharing module 410 is also used to collect the account private key of the second website account from the second browser 432; wherein, the data transmitted between the sharing module 410 and the second browser 432 is encrypted by the second symmetric key, or the data transmitted between the sharing module 410 and the second browser 432 is encrypted by the other party's public key.

[0239] Optionally, the sharing module 410 is further used to display a list of website accounts with registered password-free credentials held by the second browser 432;

[0240] The sharing module 410 is further configured to receive, for each website account in the website account list, a browser set selected by a user that is allowed to be shared by each website account.

[0241] Optionally, the sharing module 410 is further used to generate a pair of public and private key pairs with the second browser 432 respectively;

[0242] The sharing module 410 is further configured to exchange respective public keys with the second browser 432, generate a shared secret value based on the other party's public key and its own private key, and derive a second symmetric key based on the shared secret value.

[0243] Optionally, the terminal device further includes a security module 440;

[0244] The sharing module 410 is also used to mutually verify the identity of the other party as a legal identity between the sharing module 410 and the second browser 432 through the application management module 420, and when the security module 440 verifies that the second browser 432 is a secure browser, perform key negotiation with the second browser 432 to obtain a shared secret value, and derive a second symmetric key based on the shared secret value.

[0245] Optionally, the sharing module 410 is further used to establish a list of association relationships among the second website account, the second browser 432, the account private key of the second website account, and the browser set that the second website account is allowed to share.

[0246] Optionally, the second browser 432 is used to send the updated account private key of the second website account to the sharing module 410 when the account private key of the second website account is updated, so that the sharing module 410 updates the association relationship list;

[0247] The sharing module 410 is also used to update the association list and send a change notification message to the updated browser when the list of website accounts with registered password-free credentials held by the second browser 432 is updated or the set of browsers allowed to be shared by the second website account is updated.

[0248] The sharing module 410, the application management module 420 and the security module 440 in the embodiment of the present application may be processors in the terminal device. The first browser 431 and the second browser 432 may be browser applications installed on the terminal device.

[0249] Figure 4 The specific implementation of the terminal device 400 shown can be found in Figures 2 to 3 The method embodiment shown will not be described in detail here.

[0250] In the embodiment of the present application, when the first browser has not registered the password-free credentials of the first website account, if the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the first browser can log in to the website corresponding to the first website account through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the password-free credentials of the first website account). The first browser does not need to register the password-free credentials of the first website account, and can also log in to the website corresponding to the first website account based on the password-free credentials. There is no need to repeatedly register password-free credentials for the same website on different browsers, which improves the convenience of logging in to the same website between different browsers and reduces the complexity of logging in between browsers based on password-free credentials.

[0251] See also Figure 5 , Figure 5 is a schematic diagram of the structure of another terminal device provided in an embodiment of the present application, such as Figure 5 As shown, the terminal device 500 includes a processor 501 and a memory 502, and the processor 501 and the memory 502 can be connected to each other via a communication bus 503. The communication bus 503 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 503 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5The memory 502 is used to store computer programs, which include program instructions. The processor 501 is configured to call the program instructions. The program includes instructions for executing Figures 2 to 3 Some or all of the steps in the method shown.

[0252] The memory 502 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a bus. The memory may also be integrated with the processor.

[0253] The terminal device 500 may further include a communication module, which may include a communication chip, a radio frequency transceiver, a radio frequency front-end module, an antenna, and the like.

[0254] The terminal device 500 may also include a display module.

[0255] In the embodiment of the present application, when the first browser has not registered the password-free credentials of the first website account, if the first browser belongs to a set of browsers in which the first website account is allowed to share password-free credentials, the first browser can log in to the website corresponding to the first website account through the signature value signed by the account private key of the first website account shared by other browsers (browsers that registered the password-free credentials of the first website account). The first browser does not need to register the password-free credentials of the first website account, and can also log in to the website corresponding to the first website account based on the password-free credentials. There is no need to repeatedly register password-free credentials for the same website on different browsers, which improves the convenience of logging in to the same website between different browsers and reduces the complexity of logging in between browsers based on password-free credentials.

[0256] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any website login method recorded in the above method embodiments.

[0257] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0258] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0259] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical or other forms.

[0260] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0261] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0262] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, terminal device or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program codes.

[0263] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc.

[0264] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A website login method, characterized in that: The method is applied to a terminal device, the terminal device includes a sharing module, an application management module and N browsers, and the method includes: When a first website account is logged in in a first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module, the first browser is any one of the N browsers, and the signature request carries the first website account; The sharing module requests the application management module to verify the identity of the first browser. If the first browser is a legitimate browser and is in a browser set, the sharing module signs the data carried in the signature request using the account private key of the first website account to obtain a signature value. The sharing module feeds the signature value back to the first browser. The browser set is a browser set in which the first website account is allowed to share credentials without a password. The first browser transmits the signature value to the website corresponding to the first website account, so that the website corresponding to the first website account uses the account public key of the first website account to verify the signature value. If the verification passes, it is determined that the first browser has successfully logged in to the website corresponding to the first website account.

2. The method according to claim 1, characterized in that: When the first website account is logged in in the first browser and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module, including: When logging into the first website account in the first browser, the first browser initiates user identity authentication; When the user identity authentication is passed and the first browser has not registered the password-free credentials of the first website account, the first browser initiates a signature request to the sharing module.

3. The method according to claim 1, characterized in that: The data transmitted between the sharing module and the first browser is encrypted with a first symmetric key, and the first symmetric key is a symmetric key between the sharing module and the first browser; Alternatively, the data transmitted between the sharing module and the first browser is encrypted using the other party's public key.

4. The method according to any one of claims 1 to 3, characterized in that: Before the first browser initiates a signature request to the shared module, the method further includes: When the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, wherein the second symmetric key is a symmetric key between the shared module and the second browser, and the second browser is any one of the N browsers, where N is an integer greater than or equal to 2; The sharing module collects from the second browser a list of website accounts with registered password-free credentials held by the second browser; The sharing module determines a set of browsers that a second website account is allowed to share, where the second website account is any one of a list of website accounts with registered password-free credentials held by the second browser; The sharing module collects the account private key of the second website account from the second browser; wherein the data transmitted between the sharing module and the second browser is encrypted with the second symmetric key, or the data transmitted between the sharing module and the second browser is encrypted with the other party's public key.

5. The method according to claim 4, characterized in that The sharing module determines a browser set that the second website account is allowed to share, including: The sharing module displays a list of website accounts with registered password-free credentials held by the second browser; For each website account in the website account list, a browser set selected by a user and allowed to be shared by each website account is received.

6. The method according to claim 4, characterized in that The terminal device further includes a security module, and when the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value, including: When the shared module and the second browser mutually verify each other's identity as a legitimate identity through the application management module, and the security module verifies that the second browser is a secure browser, the shared module and the second browser perform key negotiation to obtain a shared secret value, and derive a second symmetric key based on the shared secret value.

7. The method according to claim 4, characterized in that After the sharing module collects the account private key of the second website account from the second browser, the method further includes: The sharing module establishes a list of association relationships among the second website account, the second browser, the account private key of the second website account, and a set of browsers that the second website account is allowed to share.

8. The method according to claim 7, characterized in that The method further comprises: When the account private key of the second website account is updated, the second browser sends the updated account private key of the second website account to the sharing module, so that the sharing module updates the association relationship list; And / or, when the list of website accounts with registered password-free credentials held by the second browser is updated or the set of browsers allowed to be shared by the second website account is updated, the sharing module updates the association list and sends a change notification message to the updated browser.

9. A terminal device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is enabled to perform the method according to any one of claims 1 to 8.

Images