Login credential processing method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a login credential processing method and device, equipment and a storage medium, and the method comprises the steps: responding to a deletion operation for a target credential, and generating a credential deletion request for the target credential, the credential deletion request comprising ciphertext data corresponding to the target credential, signature data and a target credential deletion command; the ciphertext data comprises an encrypted user account and an encrypted registration credential identity; the signature data is used for indicating the server to perform signature verification; the target credential deletion command is used for instructing the server to delete the target credential; and sending a credential deletion request to the server. The security of personal information of a user can be improved, and the storage space of a server is saved.

Description

Technical Field

[0001] The embodiments of the present application relate to information security technology, and relate to but are not limited to a method and apparatus, device, and storage medium for processing login credentials. Background Art

[0002] The user's account and other related information usually need to be deleted from the server when the user no longer needs to use it or actively logs out.

[0003] In the prior art, in the process of implementing credential deletion, it is usually determined by the server based on the usage activity of the credential. For example, when a credential has not been used for login for more than a preset time, the credential can be deleted.

[0004] However, if the preset time is long, it provides an attack time window for attacks such as authenticator cloning attacks that forge user identities, which may result in attackers successfully forging and deceiving the server and maliciously logging into the user account, thereby resulting in lower security of user personal information; and, if the preset time is long, it will also lead to a waste of server storage resources. Summary of the invention

[0005] In view of this, the login credential processing method, device, equipment, and storage medium provided in the embodiments of the present application can improve the security of user personal information and save storage space on the server. The login credential processing method, device, equipment, and storage medium provided in the embodiments of the present application are implemented as follows:

[0006] An embodiment of the present application provides a method for processing login credentials, which is applied to a terminal device and includes:

[0007] In response to a deletion operation on a target credential, a credential deletion request for the target credential is generated, the credential deletion request including: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential;

[0008] Sends a credential deletion request to the server.

[0009] In another embodiment, the present application further provides a method for processing login credentials, which is applied to a server and includes:

[0010] Receive a credential deletion request for a target credential sent by a terminal device, the credential deletion request including: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification;

[0011] Validate the credential deletion request and delete the target credential after successful validation.

[0012] The login credential processing device provided in the embodiment of the present application is applied to a terminal device, and the device includes: a response module and a sending module;

[0013] A response module, configured to generate a credential deletion request for the target credential in response to a deletion operation for the target credential, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential;

[0014] The sending module is used to send a credential deletion request to the server.

[0015] In another embodiment, the present application further provides a login credential processing device, which is applied to a server and includes: a receiving module and a processing module;

[0016] A receiving module, configured to receive a credential deletion request for a target credential sent by a terminal device, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification;

[0017] The processing module is used to verify the credential deletion request and delete the target credential after successful verification.

[0018] The computer device provided in the embodiment of the present application includes a memory and a processor. The memory stores a computer program that can be run on the processor. When the processor executes the program, the method of the embodiment of the present application is implemented.

[0019] The computer-readable storage medium provided in the embodiment of the present application has a computer program stored thereon, and when the computer program is executed by a processor, the method provided in the embodiment of the present application is implemented.

[0020] The login credential processing method, apparatus, device, and storage medium provided in the embodiments of the present application can generate a credential deletion request for the target credential in response to a deletion operation on the target credential, and send the credential deletion request to the server. Among them, the credential deletion request includes: ciphertext data, signature data, and target credential deletion command corresponding to the target credential; the ciphertext data includes: the encrypted user account and the encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential. When the target credential needs to be deleted, the server can be asked to delete the target credential stored therein by sending a credential deletion request to the server, thereby avoiding the leakage of personal information after the user logs out of the account, improving the security of the user's personal information, and deleting the target credentials in the server in a timely manner, which can also save the server's storage space. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0022] Figure 1 A schematic diagram of an application scenario of the method for processing login credentials provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of a method for processing login credentials applied to a terminal device provided in an embodiment of the present application;

[0024] Figure 3 Another flowchart of a method for processing login credentials applied to a terminal device provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of a process for obtaining a credential deletion request provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of the interface of a terminal device provided in an embodiment of the present application;

[0027] Figure 6 Another schematic diagram of an interface of a terminal device provided in an embodiment of the present application;

[0028] Figure 7 A flowchart of a method for processing login credentials applied to a server provided in an embodiment of the present application;

[0029] Figure 8 A schematic diagram of the flow of interaction between a terminal device and a server provided in an embodiment of the present application;

[0030] Fig. 9A schematic diagram of the structure of a login credential processing device provided in an embodiment of the present application;

[0031] Fig.10 Another structural schematic diagram of a device for processing login credentials provided in an embodiment of the present application;

[0032] Fig.11 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the specific technical solution of the present application will be further described in detail below in conjunction with the drawings in the embodiments of the present application. The following embodiments are used to illustrate the present application, but are not used to limit the scope of the present application.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0035] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0036] It should be pointed out that the terms "first\second\third" involved in the embodiments of the present application are used to distinguish similar or different objects, and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0037] In the prior art, when a user needs to delete or log out of a personal account, the solution usually adopted is to delete the relevant credentials in the authenticator, and the relevant credentials stored on the server are usually maintained by the server itself. For example: if the server does not receive a login request for a certain credential within a preset time, it can be determined that the credential is an inactive credential, and these credentials can be deleted during the self-maintenance process.

[0038] That is to say, in the prior art, the user only deletes the credentials in the authenticator and does not delete the server's credentials, which may result in the server's credentials being deleted untimely, providing an attack time window for attacks such as authenticator cloning attacks that impersonate user identities, which may result in the attacker successfully impersonating and deceiving the server and maliciously logging into the user account, thereby resulting in lower security of the user's personal information; and, if the preset time is long, it will also lead to a waste of server storage resources.

[0039] In order to solve the above problems existing in the prior art, a method for processing login credentials is provided in an embodiment of the present application. The application scenario of the method for processing login credentials provided in the embodiment of the present application and the contents included in the scenario are explained in detail below.

[0040] Figure 1 For an application scenario diagram of the method for processing login credentials provided in the embodiment of the present application, please refer to Figure 1 , the scenario may include: a terminal device 110 and a server 120, wherein the terminal device 110 may include an authenticator.

[0041] The terminal device 110 can be a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), a wearable device, a virtual reality (VR) device, an augmented reality (AR) device, a smart screen, an artificial intelligence (AI) speaker, a headset, a terminal in industrial control, a terminal in self-driving, a terminal in remote medical surgery, a terminal in a smart grid, a terminal in transportation safety, a terminal in a smart city, a terminal in a smart home, a personal digital assistant (PDA), etc., without specific limitation herein.

[0042] The authenticator may be a software for login authentication. When a user registers account-related credentials, the authenticator may generate a public-private key pair for the user's account. The server holds the public key and the authenticator holds the private key.

[0043] When a user logs in to a server account, the server requests the authenticator to perform biometric authentication on the user. After the authenticator authenticates the user, it uses the private key to sign the result of the authentication success or failure, and sends the authentication result and signature value to the server.

[0044] After receiving the authentication result and signature value sent by the authenticator, the server uses the public key to verify the signature. If the signature verification is successful, the server trusts the authentication result of the authenticator on the user, and then determines whether to allow the user account to log in based on the authentication result.

[0045] Optionally, server 120 may be a cloud server installed in the cloud. When performing user account registration, login, and other operations based on server 120, server 120 may be the cloud server corresponding to the website or mobile application. Different websites or mobile applications may have different corresponding servers 120.

[0046] In this scenario, the server 120 can communicate with the terminal device 110. In view of this, an embodiment of the present application provides a method for processing login credentials, which is applied to the above-mentioned terminal device. The function implemented by the method can be implemented by calling the program code by the processor in the terminal device. Of course, the program code can be stored in a computer storage medium. It can be seen that the terminal device at least includes a processor and a storage medium.

[0047] The following is an explanation of the implementation process of the method for processing login credentials applied to a terminal device in an embodiment of the present application in conjunction with the above application scenario.

[0048] Figure 2 For a flow chart of a method for processing login credentials applied to a terminal device provided in an embodiment of the present application, please refer to Figure 2 , the method comprising:

[0049] S210: In response to a deletion operation on a target credential, a credential deletion request is generated for the target credential.

[0050] Among them, the credential deletion request includes: the ciphertext data corresponding to the target credential, the signature data and the target credential deletion command; the ciphertext data includes: the encrypted user account and the encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential.

[0051] Optionally, the method can be applied to the above-mentioned terminal device, and the deletion operation for the target credential can be, for example, an account cancellation or account deletion operation performed by a user on an application or website in the terminal device, and is not specifically limited here. Among them, the target credential can be the credential information corresponding to the account that needs to be cancelled or deleted.

[0052] The user account may refer to the account used by the user when logging in, which may usually be composed of numbers, letters, symbols, etc.; the registration credential identity may specifically be the relevant identity information filled in by the user when registering the corresponding account, for example: if it is a password login, then the registration credential identity may be the corresponding password; if it is a biometric authentication login, then the registration credential identity may be the corresponding biometric authentication information, such as: fingerprint, iris, voice, facial information, etc.

[0053] The signature data may be data obtained by signing the ciphertext data through the authenticator. The server may determine the source of the ciphertext data through the signature data, for example, which authenticator the ciphertext data comes from.

[0054] A target credential deletion command may be an instruction sent to a server, which may instruct the server to delete the target credential.

[0055] After obtaining the above-mentioned ciphertext data, signature data and target credential deletion command respectively, they can be combined to obtain a credential deletion request for the target credential.

[0056] S220: Send a credential deletion request to the server.

[0057] Optionally, after receiving a credential deletion request for the target credential, the credential deletion request can be sent to a corresponding server. After receiving the credential deletion request, the server can determine the target credential to be deleted based on the target credential deletion command, and then verify it based on the ciphertext data and signature data. After the verification is successful, the target credential stored in the server can be deleted.

[0058] For example, when a user needs to log out of an account, the user can perform a deletion operation on the target credentials on the terminal device. The terminal device can generate a credential deletion request for the target credentials in response to the deletion operation on the target credentials. The terminal device can then send the credential deletion request to the server, so that the server deletes the target credentials stored in the server according to the credential deletion request, thereby realizing the logout of the corresponding account.

[0059] In the login credential processing method provided in the embodiment of the present application, a credential deletion request for the target credential can be generated in response to a deletion operation for the target credential, and the credential deletion request can be sent to the server. Among them, the credential deletion request includes: ciphertext data corresponding to the target credential, signature data and target credential deletion command; the ciphertext data includes: the encrypted user account and the encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential. When the target credential needs to be deleted, the server can be asked to delete the target credential stored therein by sending a credential deletion request to the server, thereby avoiding the leakage of personal information after the user logs out of the account, improving the security of the user's personal information, and deleting the target credentials in the server in a timely manner can also save the server's storage space.

[0060] The following explains the implementation process of generating a credential deletion request in the login credential processing method provided in the embodiment of the present application.

[0061] Figure 3 For another flowchart of a method for processing login credentials applied to a terminal device provided in an embodiment of the present application, please refer to Figure 3 , generates a credential removal request for the target credential, including:

[0062] S310: Encrypt the user account and registration identity credentials corresponding to the target credentials to obtain ciphertext data.

[0063] Optionally, the user account and registration identity credentials may be input by the user, for example, a login interface is displayed on a web page or an application program interface of the terminal device, and the user may input the user account and registration identity credentials based on the login interface.

[0064] After the user enters the user account and registration identity credentials, the authenticator of the terminal device can perform encryption processing, so that the ciphertext data is obtained after the encryption is completed.

[0065] S320: Perform signature processing on the ciphertext data to obtain signature data.

[0066] Optionally, after obtaining the ciphertext data, the authenticator may perform a signature process on the ciphertext data, thereby obtaining signature data corresponding to the ciphertext data.

[0067] It should be noted that the signature data corresponds to the ciphertext data. If the user needs to cancel multiple accounts, the multiple sets of ciphertext data generated need to be signed separately, and each set of ciphertext data can correspond to one signature data.

[0068] S330: Generate a credential deletion request for the target credential based on the ciphertext data, signature data and the target credential deletion command.

[0069] Among them, the target credential deletion command can be an instruction pre-stored in the authenticator, and the instruction can be called after the user performs a deletion operation on the target credential.

[0070] Optionally, after respectively obtaining the above-mentioned ciphertext data, signature data and target credential deletion command, they may be packaged and combined into a credential deletion request for the target credential.

[0071] In the login credential processing method provided in the embodiment of the present application, the user account and registered identity credentials corresponding to the target credential can be encrypted to obtain ciphertext data; the ciphertext data can be signed to obtain signature data; and a credential deletion request for the target credential can be generated according to the ciphertext data, signature data, and target credential deletion command. Among them, by sequentially obtaining the ciphertext data, signature data, and determining the target credential deletion command, a credential deletion request for the target credential can be obtained more accurately, quickly, and securely, and then the server can delete the corresponding target credential more securely and quickly, thereby improving the efficiency and security of deleting the target credential.

[0072] The following is a detailed explanation of the schematic process relationship of obtaining a credential deletion request in the login credential processing method provided in the embodiment of the present application.

[0073] Figure 4 For a flowchart of obtaining a credential deletion request provided in an embodiment of the present application, please refer to Figure 4 , Figure 4 It is specifically shown that the credential deletion request is obtained after corresponding processing of multiple data.

[0074] The process of obtaining ciphertext data is as follows:

[0075] Optionally, the user account and registration identity credentials corresponding to the target credentials are encrypted to obtain ciphertext data, including: determining the user account and registration credential identity corresponding to the target credentials; encrypting the user account and registration credential identity based on the data transmission encryption public key to obtain ciphertext data.

[0076] Among them, the user account and registration credential identity corresponding to the target credential can be determined based on the user's input, and then the user account and registration credential identity can be encrypted.

[0077] During the encryption process, a data transmission encryption public key may be used. The public key may be a public key pre-set in an authenticator in the terminal device, and a private key corresponding to the public key may be set in the server for decryption.

[0078] It should be noted that the data encrypted based on the data transmission encryption public key can be decrypted by the data transmission decryption private key. That is to say, the ciphertext data encrypted by the above method can be decrypted by the data transmission decryption private key in the server to obtain the user account and registration credential identity corresponding to the target credential.

[0079] The encryption algorithm may be, for example, an Advanced Encryption Standard (AES) algorithm.

[0080] The process of obtaining signature data is as follows:

[0081] Optionally, the credential deletion request also includes: an authenticator certificate, which is used to indicate the correspondence between the authenticator used by the terminal device and the server; signing the ciphertext data to obtain signature data, including: signing the ciphertext data based on the authentication private key corresponding to the authenticator certificate to obtain signature data.

[0082] The authenticator certificate may specifically be data used to characterize the identity of the authenticator. For example, if the server receives data transmitted by multiple authenticators, the source authenticator of the transmitted data may be determined based on the authenticator certificate in the transmitted data. The authenticator certificate may be used to determine whether the authenticator used by the terminal device has a corresponding relationship with the server. For example, if the server pre-stores multiple authenticator certificates with corresponding relationships, it may be determined based on the authenticator certificate whether the source authenticator is pre-stored in the server. If so, it may be determined that there is a corresponding relationship between the authenticator and the server; correspondingly, if not, it may be determined that there is no corresponding relationship between the authenticator and the server.

[0083] When performing signature processing, the signature can be performed based on the authenticator. For example, the ciphertext data can be signed according to the authentication private key corresponding to the authenticator certificate.

[0084] It should be noted that the authentication private key can specifically be a private key used to sign encrypted data, and its corresponding authentication public key can be stored in the server. The server can verify the signed data through the authentication public key to determine whether the signature is signed by the authentication private key.

[0085] The algorithm used for the signature may be, for example, the Elliptic Curve Digital Signature Algorithm (ECDSA).

[0086] The process for determining credential removal requests is as follows:

[0087] Optionally, a credential deletion request for the target credential is generated based on the ciphertext data, signature data and the target credential deletion command, including: generating a credential deletion request for the target credential based on the ciphertext data, signature data, the target credential deletion command and the authenticator certificate.

[0088] It should be noted that after obtaining the ciphertext data and signature data respectively in the above manner, the target credential deletion command generated according to the deletion operation on the target credential and the authenticator certificate of the authenticator in the terminal device can be combined to obtain a credential deletion request for the target credential. After obtaining the credential deletion request, the credential deletion request can be sent to the corresponding server.

[0089] In the login credential processing method provided in the embodiment of the present application, the user account and registration credential identity corresponding to the target credential can be determined; the user account and registration credential identity are encrypted based on the data transmission encryption public key to obtain ciphertext data; the ciphertext data is signed based on the authentication private key corresponding to the authenticator certificate to obtain signature data; and a credential deletion request for the target credential is generated according to the ciphertext data, signature data, target credential deletion command and authenticator certificate. Among them, by respectively obtaining the ciphertext data, signature data and determining the target credential deletion command and authenticator certificate, the credential deletion request for the target credential can be obtained more accurately, quickly and securely, and then the server can delete the corresponding target credential more safely and quickly, thereby improving the efficiency and security of deleting the target credential.

[0090] The following explains what the terminal device can display during the process of implementing credential deletion in an embodiment of the present application.

[0091] Figure 5 For the interface diagram of the terminal device provided in the embodiment of the present application, please refer to Figure 5 , Figure 5 The display interface of the terminal device is shown. The interface can be an account logout interface in a website or an account logout interface in an application, etc., and is not specifically limited here.

[0092] Optionally, sending a credential deletion request to the server includes: sending a credential deletion request to the server in response to a synchronization determination operation.

[0093] Among them, whether it is necessary to send the credential deletion request to the server can be determined based on the user's synchronous determination operation.

[0094] It should be noted that after the terminal device responds to the deletion operation on the target credentials, the terminal device can delete the relevant data of the target credentials stored in the terminal device, and the user can choose whether to delete the target credentials synchronously on the server side according to actual needs.

[0095] If synchronous deletion is required, a credential deletion request can be sent to the server in response to the synchronous confirmation operation, thereby deleting the target credentials in the server; if synchronous deletion is not required, only the target credentials in the terminal device can be deleted.

[0096] In other words, the solution provided by the present application can be flexibly compatible with the solutions in the prior art. For example, after the server receives the credential deletion information, it can delete it according to its own policy, facilitating smooth business upgrades.

[0097] In the login credential processing method provided in the embodiment of the present application, a credential deletion request can be sent to the server in response to a synchronous determination operation. In which, it can be determined based on the user's synchronous determination operation whether to delete only the target credential in the terminal device or to synchronously delete the target credential in the server, and then the corresponding deletion step can be performed based on the actual selection requirements, thereby increasing the applicability of login credential processing.

[0098] The following explains another content that the terminal device can display during the process of implementing credential deletion in an embodiment of the present application.

[0099] Figure 6 For another interface diagram of the terminal device provided in the embodiment of the present application, please refer to Figure 6 , Figure 6 The display interface of the terminal device is shown. The interface can be an account logout interface in a website or an account logout interface in an application, etc., and is not specifically limited here.

[0100] Optionally, sending a credential deletion request to the server includes: in response to an association deletion operation, sending a credential deletion request and an association deletion request to the server, wherein the association deletion request is used to instruct the server to delete data that is associated with the target credential.

[0101] It should be noted that when sending the credential deletion request to the server, it can also be determined whether to send the association deletion request based on the user's association deletion operation on the terminal device.

[0102] For example: a switch control for selection can be set in the display interface. The user can perform an association deletion operation by selecting the switch control, and enable the terminal device to generate an association deletion request in response to the association deletion operation. The association deletion request can be sent together in the process of sending the credential deletion request.

[0103] For another example: when the terminal device is about to send a credential deletion request to the server, a pop-up window can be displayed on the display interface of the terminal device to remind the user whether to delete the association. If the user selects yes, the association deletion operation can be determined to be executed, and the terminal device can generate an association deletion request in response to the association deletion operation.

[0104] It should be noted that after the server receives the association deletion request, if it determines to delete the target credential based on the credential deletion request, it can also delete the data that is associated with the target credential. The data that is associated with the target credential can be, for example, the browsing history of the account, the login history of the account, etc. There is no specific restriction here. Any data that can be associated with the target credential can be deleted using the above method.

[0105] In the login credential processing method provided in the embodiment of the present application, a credential deletion request and an associated deletion request can be sent to the server in response to an associated deletion operation, so that the server deletes the data associated with the target credential according to the associated deletion request, thereby achieving a more thorough and comprehensive deletion of the target credential and its related data, thereby improving the security of user personal information.

[0106] The following explains the implementation process of the method for processing login credentials applied to the server in the embodiment of the present application.

[0107] Figure 7 For a flow chart of a method for processing login credentials applied to a server provided in an embodiment of the present application, please refer to Figure 7 , the method comprising:

[0108] S710: Receive a credential deletion request for a target credential sent by a terminal device.

[0109] Among them, the credential deletion request includes: the ciphertext data corresponding to the target credential, the signature data and the target credential deletion command; the ciphertext data includes: the encrypted user account and the encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification.

[0110] Optionally, the method may be applied to the above-mentioned server, and the server may receive a credential deletion request for a target credential and determine whether to delete the target credential.

[0111] S720: Verify the credential deletion request and delete the target credential after successful verification.

[0112] Optionally, after receiving the credential deletion request, corresponding verification processing can be performed according to the specific content of the credential deletion request. If the verification is successful, the target credential can be deleted; if the verification fails, the deletion failure result can be fed back to the terminal device.

[0113] It should be noted that, during the verification process, it is specifically possible to verify the source of the request, whether the corresponding source has the corresponding authentication authority, whether there is a corresponding signature, etc. After all verifications are performed, if the verification is successful, the target credential can be deleted; accordingly, if a credential deletion request is received at the same time as an associated deletion request, the data that is associated with the target credential can be deleted.

[0114] In the login credential processing method provided in the embodiment of the present application, a credential deletion request for the target credential sent by the terminal device can be received; the credential deletion request is verified and processed, and the target credential is deleted after the verification is successful. Among them, the credential deletion request includes: ciphertext data corresponding to the target credential, signature data and target credential deletion command; the ciphertext data includes: the encrypted user account and the encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification. In the case where the target credential needs to be deleted, the server can receive the credential deletion request to allow the server to delete the target credential stored therein, thereby avoiding the leakage of personal information after the user cancels the account, improving the security of the user's personal information, and timely deleting the target credentials in the server can also save the server's storage space.

[0115] The following explains the implementation process of the verification process performed by the server during the execution of the login credential processing method.

[0116] Optionally, the credential deletion request is verified, including: decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and registration credential identity; determining whether there is an association between the user account and the registration credential identity based on the server maintenance records; if there is an association, determining that the verification is successful.

[0117] The data transmission decryption private key can be used to decrypt the ciphertext data encrypted by the data transmission encryption public key. After the server obtains the ciphertext data, it can decrypt the ciphertext data based on the data transmission decryption private key to obtain the unencrypted user account and registration credential identity.

[0118] After obtaining the user account and registration credential identity, it is possible to determine whether there is an association between the user account and the registration credential identity based on the server's own maintenance records, that is, to determine whether the user's account matches the relevant authentication information. If there is an association, it can be determined that the verification is successful; accordingly, if there is no association, the verification fails.

[0119] In addition to performing the above verification, the server also performs other verification work:

[0120] Optionally, the credential deletion request also includes: an authenticator certificate, the authenticator certificate is used to indicate the correspondence between the authenticator used by the terminal device and the server; before decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity, the method also includes: determining whether the authenticator certificate is a stored authenticator certificate; if the authenticator certificate is a stored authenticator certificate, verifying the signature data based on the authentication public key corresponding to the authenticator certificate; decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity, including: if the signature data verification is successful, decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity.

[0121] After receiving the authenticator certificate, the server can first determine whether the authenticator certificate is an authenticator certificate already stored in the server. If so, subsequent signature authentication can be performed; if not, it can be determined that the authenticator does not fall within the verification scope of the server and subsequent verification is not performed.

[0122] During the signature verification process, the authentication public key can be used to verify the signature data. If the signature data is signed using the authentication private key, the authentication public key can be successfully verified; conversely, if the signature data is not signed using the authentication private key, the authentication public key can fail to verify.

[0123] In case of successful verification, the ciphertext data can be decrypted to obtain the above-mentioned user account and registration credential identity.

[0124] In addition, after receiving the target credential deletion command, the server can determine that the received data, that is, the credential deletion request, is used to delete the target credential.

[0125] Optionally, determining whether there is an association relationship between the user account and the registration credential identity based on the server maintenance record includes: determining whether there is an association relationship between the user account, the registration credential identity and the authenticator certificate based on the server maintenance record.

[0126] It should be noted that, in the process of the server determining whether there is an association between the user account and the registration credential identity, it can also be further determined whether there is an association between the authenticator certificate and the user account and the registration credential identity. When the user registers a user account, the server will record the corresponding authenticator certificate during the registration process. When deleting the target credential, it can be further checked whether there is a corresponding relationship between the authenticator certificate, the user account and the registration credential identity.

[0127] In order to more clearly explain the interaction process between the terminal device and the server in the login credential processing method provided in this application, the flow of interaction between the terminal device and the server is described below.

[0128] Figure 8 For a flow chart of the interaction between the terminal device and the server provided in the embodiment of the present application, please refer to Figure 8 , the method comprising:

[0129] S810: The terminal device generates a credential deletion request for the target credential in response to the deletion operation for the target credential.

[0130] S820: The terminal device sends a credential deletion request to the server.

[0131] S830: The server verifies the credential deletion request and deletes the target credential after successful verification.

[0132] It should be noted that the server and the application in the terminal device can have a corresponding relationship. For example, when a user uses application A in the terminal device and needs to delete the account corresponding to application A, the server that application A can interact with can be fixed, such as server a.

[0133] For example, when a user needs to delete or cancel an account, the terminal device can generate a credential deletion request for the target credential in response to the deletion operation on the target credential. The credential deletion request may include an encrypted user account, an encrypted registered credential identity, signature data, a target credential deletion command, and an authenticator certificate, etc. The terminal device can send the credential deletion request consisting of these data to the server. After verification by the server, the target credential will be deleted if the verification passes, thereby completing the processing of the login credential.

[0134] It should be noted that in this application, the terminal device sends a credential deletion request to the server, so that the server can receive the corresponding deletion information in time and clear the deleted credentials, shortening the attack time window of the invalid credentials and improving the security of the solution. In addition, the authenticator in the terminal device uses its own certificate to sign the data and uses the website server public key to encrypt the data to ensure the confidentiality and integrity of the data during transmission, thus improving the security of the solution.

[0135] In the login credential processing method provided in the embodiment of the present application, a credential deletion request for the target credential can be generated by the terminal device in response to the deletion operation for the target credential; the terminal device sends the credential deletion request to the server; the server verifies the credential deletion request and deletes the target credential after the verification is successful. Among them, when the target credential needs to be deleted, the server can delete the target credential stored therein by receiving the credential deletion request sent by the terminal device, thereby avoiding the leakage of personal information after the user logs out of the account, improving the security of the user's personal information, and timely deleting the target credential in the server can also save the storage space of the server.

[0136] It should be understood that, although the steps in the above-mentioned flowcharts are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flowcharts may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0137] Based on the foregoing embodiments, an embodiment of the present application provides a login credential processing device, which includes the modules included and the units included in the modules, and can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0138] Fig. 9 For a structural diagram of a login credential processing device provided in an embodiment of the present application, please refer to Fig. 9 , a login credential processing device provided in an embodiment of the present application is applied to a terminal device, and the device includes: a response module 910 and a sending module 920;

[0139] The response module 910 is used to generate a credential deletion request for the target credential in response to the deletion operation for the target credential, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential;

[0140] The sending module 920 is used to send a credential deletion request to the server.

[0141] Optionally, the response module 910 is specifically used to encrypt the user account and registration identity credentials corresponding to the target credentials to obtain ciphertext data; sign the ciphertext data to obtain signature data; and generate a credential deletion request for the target credentials based on the ciphertext data, signature data and the target credential deletion command.

[0142] Optionally, the response module 910 is specifically used to determine the user account and registration credential identity corresponding to the target credential; encrypt the user account and registration credential identity based on the data transmission encryption public key to obtain ciphertext data.

[0143] Optionally, the credential deletion request also includes: an authenticator certificate, which is used to indicate the correspondence between the authenticator used by the terminal device and the server; a response module 910, which is specifically used to sign the ciphertext data based on the authentication private key corresponding to the authenticator certificate to obtain signature data.

[0144] Optionally, the response module 910 is specifically used to generate a credential deletion request for the target credential based on the ciphertext data, signature data, the target credential deletion command and the authenticator certificate.

[0145] Optionally, the sending module 920 is specifically configured to send a credential deletion request to the server in response to a synchronization determination operation.

[0146] Optionally, the sending module 920 is further used to send a credential deletion request and an association deletion request to the server in response to an association deletion operation, where the association deletion request is used to instruct the server to delete data that is associated with the target credential.

[0147] Fig.10 For another structural diagram of the login credential processing device provided in the embodiment of the present application, please refer to Fig.10 , the present application also provides a login credential processing device, the device is applied to a server, the device includes: a receiving module 930 and a processing module 940;

[0148] The receiving module 930 is used to receive a credential deletion request for a target credential sent by a terminal device, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registration credential identity; the signature data is used to instruct the server to perform signature verification;

[0149] The processing module 940 is used to verify the credential deletion request and delete the target credential after successful verification.

[0150] Optionally, processing module 940 is specifically used to decrypt the ciphertext data according to the data transmission decryption private key to obtain the user account and registration credential identity; determine whether there is an association between the user account and the registration credential identity based on the server maintenance record; if there is an association, determine that the verification is successful.

[0151] Optionally, the processing module 940 is also used to determine whether the authenticator certificate is a stored authenticator certificate; if the authenticator certificate is a stored authenticator certificate, the signature data is verified based on the authentication public key corresponding to the authenticator certificate; if the signature data is successfully verified, the ciphertext data is decrypted according to the data transmission decryption private key to obtain the user account and registration credential identity.

[0152] Optionally, the processing module 940 is further used to determine whether there is an association relationship between the user account, the registration credential identity and the authenticator certificate based on the server maintenance record.

[0153] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the device embodiment of the present application, please refer to the description of the method embodiment of the present application for understanding.

[0154] It should be noted that in the embodiments of this application Fig. 9 The division of modules in the processing device of the login credentials shown is schematic and is only a logical functional division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or it can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It can also be implemented in the form of a combination of software and hardware.

[0155] It should be noted that in the embodiment of the present application, if the above method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application can be essentially or partly embodied in the form of a software product that contributes to the relevant technology. The computer software product is stored in a storage medium, including several instructions to enable an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0156] Fig.11For a schematic diagram of the structure of the computer device provided in the embodiment of the present application, please refer to Fig.11 , the embodiment of the present application provides a computer device, which can be the above-mentioned terminal device or the above-mentioned server, and its internal structure diagram can be as follows Fig.11 As shown. The computer device includes a processor 140, a memory and a network interface 160 connected via a system bus 130. Among them, the processor 140 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium 151 and an internal memory 152. The non-volatile storage medium 151 stores an operating system, a computer program and a database. The internal memory 152 provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The network interface 160 of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor 140, the above method is implemented.

[0157] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the method provided in the above embodiment are implemented.

[0158] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the steps of the method provided in the above method embodiment.

[0159] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0160] In one embodiment, the login credential processing device provided by the present application can be implemented in the form of a computer program, and the computer program can be used in Fig.11 The computer device shown in the figure is run. The memory of the computer device can store various program modules constituting the above-mentioned device. The computer program composed of various program modules enables the processor to execute the steps in the method of each embodiment of the present application described in this specification.

[0161] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium, storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0162] It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. For the sake of brevity, this article will not repeat them.

[0163] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, object A and / or object B can represent three situations: object A exists alone, object A and object B exist at the same time, and object B exists alone.

[0164] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0165] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as: multiple modules or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0166] The modules described above as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules; they may be located in one place or distributed on multiple network units; some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0167] In addition, all functional modules in the embodiments of the present application may be integrated into one processing unit, or each module may be a separate unit, or two or more modules may be integrated into one unit; the above-mentioned integrated modules may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0168] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0169] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling an electronic device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0170] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0171] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0172] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0173] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing login credentials, characterized in that: The method is applied to a terminal device, and the method comprises: In response to a deletion operation on a target credential, a credential deletion request for the target credential is generated, the credential deletion request including: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct a server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential; The credential deletion request is sent to the server.

2. The method for processing login credentials according to claim 1, characterized in that: The generating a credential deletion request for the target credential includes: Encrypting the user account and registration identity credentials corresponding to the target credentials to obtain the ciphertext data; Performing signature processing on the ciphertext data to obtain the signature data; A credential deletion request for the target credential is generated based on the ciphertext data, the signature data and the target credential deletion command.

3. The method for processing login credentials according to claim 2, characterized in that: The encrypting the user account and the registration identity credentials corresponding to the target credentials to obtain the ciphertext data includes: Determine the user account and registration credential identity corresponding to the target credential; The user account and the registration credential identity are encrypted based on the data transmission encryption public key to obtain the ciphertext data.

4. The method for processing login credentials according to claim 2, characterized in that: The credential deletion request further includes: an authenticator certificate, the authenticator certificate being used to indicate a corresponding relationship between an authenticator used by the terminal device and the server; The step of performing signature processing on the ciphertext data to obtain the signature data includes: The ciphertext data is signed based on the authentication private key corresponding to the authenticator certificate to obtain the signature data.

5. The method for processing login credentials according to claim 4, characterized in that: The generating a credential deletion request for the target credential according to the ciphertext data, the signature data and the target credential deletion command comprises: A credential deletion request for the target credential is generated based on the ciphertext data, the signature data, the target credential deletion command, and the authenticator certificate.

6. The method for processing login credentials according to claim 1, characterized in that: The sending the credential deletion request to the server includes: In response to a synchronization determination operation, the credential deletion request is sent to the server.

7. The method for processing login credentials according to claim 1, characterized in that: The sending the credential deletion request to the server includes: In response to the association deletion operation, the credential deletion request and the association deletion request are sent to the server, wherein the association deletion request is used to instruct the server to delete the data that is associated with the target credential.

8. A method for processing login credentials, characterized in that: The method is applied to a server, and the method comprises: Receive a credential deletion request for a target credential sent by a terminal device, the credential deletion request including: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct the server to perform signature verification; The credential deletion request is verified and the target credential is deleted after successful verification.

9. The login credential processing method according to claim 8, characterized in that: The verifying and processing the credential deletion request includes: Decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity; Determining whether there is an association relationship between the user account and the registration credential identity based on the server maintenance record; If there is an association, the verification is successful.

10. The login credential processing method according to claim 9, characterized in that: The credential deletion request further includes: an authenticator certificate, the authenticator certificate being used to indicate a corresponding relationship between an authenticator used by the terminal device and the server; Before decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity, the method further includes: determining whether the authenticator certificate is a stored authenticator certificate; If the authenticator certificate is a stored authenticator certificate, verifying the signature data based on the authentication public key corresponding to the authenticator certificate; Decrypting the ciphertext data according to the data transmission decryption private key to obtain the user account and the registration credential identity includes: If the signature data is successfully verified, the ciphertext data is decrypted according to the data transmission decryption private key to obtain the user account and the registration credential identity.

11. The login credential processing method according to claim 10, characterized in that: The determining whether there is an association relationship between the user account and the registration credential identity based on the server maintenance record includes: Determine whether there is an association relationship between the user account, the registration credential identity, and the authenticator certificate based on the server maintenance record.

12. A device for processing login credentials, characterized in that: The device is applied to a terminal device, and comprises: a response module and a sending module; The response module is used to generate a credential deletion request for the target credential in response to a deletion operation for the target credential, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct the server to perform signature verification; the target credential deletion command is used to instruct the server to delete the target credential; The sending module is used to send the credential deletion request to the server.

13. A device for processing login credentials, characterized in that: The device is applied to a server, and comprises: a receiving module and a processing module; The receiving module is used to receive a credential deletion request for a target credential sent by a terminal device, wherein the credential deletion request includes: ciphertext data corresponding to the target credential, signature data, and a target credential deletion command; the ciphertext data includes: an encrypted user account and an encrypted registered credential identity; the signature data is used to instruct the server to perform signature verification; The processing module is used to verify the credential deletion request and delete the target credential after successful verification.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 7 or 8 to 11 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 or 8 to 11 is implemented.

Images