Password resetting method and device, equipment and storage medium

Abstract

The invention discloses a password resetting method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the steps that after a password reset response sent by a server is received, the password reset response is analyzed to obtain a reset verification code, and the password reset response is determined after the server receives a password reset request sent by a user terminal; sending a current verification code input by the user based on the reset verification code to a server, so that the server determines a verification result according to the current verification code and the reset verification code; and after receiving a reset agreement response sent by the server after determining that the verification result is successful, determining a password input by the user based on the password reset page as a target password. Through the technical scheme of the embodiment of the invention, the real-time performance of password resetting can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a password resetting method, apparatus, device and storage medium. Background Art

[0002] With the rapid development of information technology, various network services and applications have sprung up. When users enjoy these services, they usually need to set up account passwords to protect the security of personal information and the exclusive use of their accounts. However, in actual use, users often face the need to reset their passwords due to problems such as forgotten passwords or password leaks.

[0003] At present, the existing password reset method is usually that the server generates an encrypted verification code after receiving the reset request and sends it to the terminal. The terminal decrypts and displays it, and sends the verification code entered by the user back to the server. The server authorizes the reset after verification. After that, the user submits the new password through the terminal, and the server sends a reset success response after confirmation. However, this method has the problem of low real-time performance.

[0004] Therefore, it is urgent to propose a new method to solve the above problems. Summary of the invention

[0005] The present invention provides a password resetting method, device, equipment and storage medium, which can improve the real-time performance of password resetting.

[0006] In a first aspect, an embodiment of the present invention provides a password resetting method, comprising:

[0007] After receiving the password reset response sent by the server, parsing the password reset response to obtain a reset verification code, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal;

[0008] Sending the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code;

[0009] After receiving the reset consent response sent by the server after determining that the verification result is passed, the password input by the user based on the password reset page is determined as the target password.

[0010] The technical solution of the present invention, after receiving the password reset response sent by the server, parses the password reset response to obtain the reset verification code, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal; sends the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code; after receiving the consent reset response sent by the server after determining that the verification result is passed, the password input by the user based on the password reset page is determined as the target password. The above technical solution, after receiving the password reset response sent by the server, parses the password reset response to obtain the reset verification code, avoids the delay caused by decrypting the encrypted verification code, significantly reduces the waiting time of the user in the entire password reset process, improves the response speed of the entire password reset process, thereby ensuring the real-time nature of the password reset, and then ensures that the user can see the verification code immediately, enhancing the user experience. Then the current verification code input by the user based on the reset verification code is sent to the server, so that the server determines the verification result according to the current verification code and the reset verification code, effectively preventing unauthorized access and malicious attacks, and ensuring account security. Secondly, the fast verification code verification process can significantly shorten the waiting time of users in the password reset process, so that users can know the verification results and continue the subsequent operations in a short time, thereby improving the user experience and improving the overall efficiency of the system. In addition, the implementation of verification code verification is relatively simple, does not require complex hardware or software support, and reduces the cost of the system. Finally, after receiving the consent reset response sent by the server after determining that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password, ensuring that only users who have passed the verification code verification can perform the password reset operation, effectively preventing malicious attackers from arbitrarily tampering with user passwords without authorization, protecting various sensitive information in the account, and maintaining the privacy rights of users. And after receiving the consent reset response, the password entered by the user is directly determined as the target password, so that the user can complete the password reset in a relatively short time without performing additional complex operations or waiting for a long confirmation process, and quickly restore the normal use of the account, ensuring the real-time nature of password reset, improving user experience, and solving the problem of low real-time nature of the existing password reset method.

[0011] In a second aspect, an embodiment of the present invention further provides a password resetting device, the device comprising:

[0012] a parsing module, configured to parse the password reset response to obtain a reset verification code after receiving the password reset response sent by the server, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal;

[0013] A sending module, configured to send the current verification code input by the user based on the reset verification code to the server, so that the server determines a verification result according to the current verification code and the reset verification code;

[0014] The reset module is used to determine the password input by the user based on the password reset page as the target password after receiving the reset consent response sent by the server after determining that the verification result is passed.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0016] at least one processor; and a memory communicatively coupled to the at least one processor;

[0017] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can implement any password resetting method described in the first aspect.

[0018] In a fourth aspect, an embodiment of the present invention further provides a storage medium including computer executable instructions,

[0019] The computer executable instructions, when executed by a computer processor, implement any password resetting method described in the first aspect.

[0020] It should be noted that the above computer instructions may be stored in whole or in part on a computer-readable storage medium, wherein the computer-readable storage medium may be packaged together with the processor of the password reset device, or may be packaged separately from the processor of the password reset device, which is not limited in this application.

[0021] The description of the second, third and fourth aspects in this application can refer to the detailed description of the first aspect; and the beneficial effects of the description of the second, third and fourth aspects can refer to the beneficial effect analysis of the first aspect, which will not be repeated here.

[0022] In this application, the name of the password reset device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of this application, they fall within the scope of the claims of this application and their equivalent technologies.

[0023] These and other aspects of the present application will become more apparent from the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flowchart of a password resetting method provided by an embodiment of the present invention;

[0026] Figure 2 A flowchart of another password resetting method provided by an embodiment of the present invention;

[0027] Figure 3 A schematic diagram of the structure of a password resetting device provided by an embodiment of the present invention;

[0028] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0030] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0031] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0032] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0033] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0034] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0035] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0036] Figure 1 A flowchart of a password resetting method provided in an embodiment of the present invention. This embodiment is applicable to situations where a password needs to be reset. The method can be performed by a password resetting device and specifically includes the following steps:

[0037] Step 110: After receiving the password reset response sent by the server, parse the password reset response to obtain a reset verification code.

[0038] Among them, the password reset response is determined by the server after receiving the password reset request sent by the user terminal. The user terminal refers to the device used by the user to initiate a password reset request, receive relevant responses from the server, and perform corresponding operations (such as entering a verification code or entering a new password). For example, the user terminal can be a tablet or a smart phone. A password reset request refers to an application information initiated by a user to the server through a user terminal to reset the account password, indicating that the user has a need to change the current password. The reset verification code refers to a string of specific codes or character combinations determined by the server when generating a password reset response, which is used to ensure the security of the password reset process.

[0039] Specifically, the user can first send a password reset request to the server through the user terminal. This request contains the user's unique identification information (such as a mobile phone number or a user name). After receiving the password reset request, the server will verify the unique identification information contained therein (such as verifying whether the mobile phone number has been registered and bound to the corresponding account). If the verification fails, an error message is returned to the user terminal, clearly indicating the reason for the verification failure (such as the user name does not exist or the mobile phone number is not bound to the account). If the verification passes, the server randomly generates a reset verification code, associates it with the user's unique identification information, and stores it in the database at the same time. Then the server returns the password reset response containing the reset verification code to the user terminal. After receiving the password reset response sent by the server, the user terminal determines the data format (such as JSON format or XML format) adopted by the password reset response, parses the password reset response according to the response format, and obtains the reset verification code. For example: if the data format adopted by the password reset response is XML format, you can use XML parsing tools or libraries to first load and process the response text in XML format, and construct a corresponding document object model or element tree structure to represent the hierarchical relationship of the entire XML document. Afterwards, according to the tag name of the reset verification code defined in the XML document, the text content therein is obtained from the XML document, that is, the reset verification code.

[0040] After obtaining the reset verification code, it can be displayed to the user through the front end for the user to view and record.

[0041] In this embodiment, by automatically parsing the password reset response and extracting the reset verification code, the delay caused by decrypting the encrypted verification code is avoided, the waiting time of the user in the entire password reset process is significantly reduced, and the response speed of the entire password reset process is improved, thereby ensuring the real-time nature of the password reset, and further ensuring that the user can see the verification code immediately, thereby enhancing the user experience.

[0042] Step 120: Send the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code.

[0043] The current verification code refers to the verification code content manually entered by the user on the corresponding operation page (such as the verification code input page) based on the reset verification code obtained from the password reset response sent by the server. The verification result refers to the conclusion drawn by the server after comparing the current verification code sent by the user terminal with the reset verification code saved by itself.

[0044] Specifically, on the front-end page of the user terminal (such as the corresponding verification interface of the mobile terminal application), there will be an input box specifically for entering the verification code. The user can manually enter the corresponding current verification code content in the input box accurately based on the reset verification code obtained before. When the user completes the verification code input, the corresponding button (such as "Submit", "Verify" or "Confirm" button) can be clicked to trigger the operation of sending the current verification code to the server. After detecting that the aforementioned button is clicked, the user terminal will capture the user's input, obtain the current verification code, and encapsulate it with the user's unique identification information into a request and send it to the server. After receiving the request, the server will extract the current verification code and the user's unique identification information, and find the corresponding user's reset verification code from the database where the reset verification code is stored based on the user's unique identification information. After that, the server compares the current verification code with the reset verification code to obtain a comparison result, and determines the verification result based on the comparison result. Specifically, if the current verification code is completely consistent with the reset verification code, the server will determine that the verification result is a pass. If the current verification code is not completely consistent with the reset verification code, the server will determine that the verification result is a failure. After determining that the verification result is a successful verification, the server can send a response to the user terminal to agree to reset. After determining that the verification result is a failed verification, the server can return an error message to the user terminal, indicating that the entered verification code is incorrect.

[0045] In this embodiment, the current verification code input by the user based on the reset verification code is sent to the server, so that the server determines the verification result based on the current verification code and the reset verification code, which can effectively prevent unauthorized access and malicious attacks and ensure account security. Secondly, the fast verification code verification process can significantly shorten the waiting time of the user in the password reset process, so that the user can know the verification result in a short time and continue the subsequent operation, thereby improving the user experience and improving the overall efficiency of the system. In addition, the implementation of verification code verification is relatively simple, does not require complex hardware or software support, and reduces the cost of the system.

[0046] Step 130: After receiving the reset consent response sent by the server after determining that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password.

[0047] Among them, the reset consent response refers to a confirmation message sent by the server to the user terminal after determining that the verification result is passed, which indicates that the server has agreed to the user's password reset operation. The password reset page refers to a specific page presented on the user terminal, which is specifically used for users to reset their passwords. The password reset page includes an input box for users to enter a new password. The target password refers to the password used to replace the original old password and become the password used by subsequent users to log in to their accounts or perform other operations that require password verification.

[0048] Specifically, after receiving the reset consent response sent by the server, it is determined whether the page currently displayed by the user terminal is a password reset page. If not, the corresponding password reset page is called up and displayed on the screen. The user will then enter the new password he wants to set in the password input box of the password reset page. When the user completes entering the new password, he can click the corresponding button (such as the "Password Confirmation" button) to trigger the operation of sending the new password to the server. After detecting that the aforementioned button is clicked, the user terminal will capture the password content entered by the user, obtain the target password, and encapsulate it with the user's unique identification information into a request and send it to the server. After receiving the request, the server will extract the target password and the user's unique identification information, and based on the user's unique identification information, find the corresponding user's record from the database where the user's password is stored, and then update the new password entered by the user to the password field of the record, thereby completing the password reset operation. Finally, the server will construct a response message about the password reset result. This response message includes information about whether the password reset is successful. Then the server returns this response message to the user terminal. After receiving this response, the user terminal will display it accordingly according to the password reset result. For example, if the password reset result is successful, a prompt box will pop up on the password reset page to inform the user that the password has been successfully updated.

[0049] In this embodiment, after receiving the reset consent response sent by the server after determining that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password, ensuring that only users who have passed the verification code verification can perform the password reset operation, effectively preventing malicious attackers from arbitrarily tampering with user passwords without authorization, ensuring the security of various sensitive information in the account (such as personal information, transaction records, communication records, etc.), and maintaining the privacy rights of users. And after receiving the reset consent response, the password entered by the user is directly determined as the target password, so that the user does not need to perform additional complex operations or wait for a long confirmation process, and can complete the password reset in a relatively short time, quickly restore the normal use of the account, ensure the real-time nature of password reset, and improve the user experience.

[0050] In an embodiment of the present invention, after receiving the password reset response sent by the server, the password reset response is parsed to obtain the reset verification code, thereby avoiding the delay caused by decrypting the encrypted verification code, significantly reducing the waiting time of the user in the entire password reset process, and improving the response speed of the entire password reset process, thereby ensuring the real-time nature of the password reset, and further ensuring that the user can immediately see the verification code, thereby enhancing the user experience. Then, the current verification code input by the user based on the reset verification code is sent to the server, so that the server determines the verification result based on the current verification code and the reset verification code, effectively preventing unauthorized access and malicious attacks, and ensuring account security. Secondly, the fast verification code verification process can significantly shorten the user's waiting time in the password reset process, allowing the user to know the verification result in a short time and continue subsequent operations, thereby improving the user experience and improving the overall efficiency of the system. In addition, the implementation of verification code verification is relatively simple, does not require complex hardware or software support, and reduces the cost of the system. Finally, after receiving the reset consent response sent by the server after confirming that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password, ensuring that only users who have passed the verification code can perform password reset operations, effectively preventing malicious attackers from arbitrarily tampering with user passwords without authorization, protecting various sensitive information in the account, and maintaining the privacy rights of users. And after receiving the reset consent response, the password entered by the user is directly determined as the target password, so that the user can complete the password reset in a relatively short time without performing additional complex operations or waiting for a long confirmation process, and quickly resume normal use of the account, ensuring the real-time nature of password reset, improving user experience, and solving the problem of low real-time nature of existing password reset methods.

[0051] Figure 2 A flowchart of another password reset method provided by an embodiment of the present invention, which is specific based on the above embodiment. In this embodiment, the method may also include:

[0052] Step 210: After receiving the password reset response sent by the server, parse the password reset response to obtain a reset verification code and a user key.

[0053] The user key refers to the key generated by the server based on user information.

[0054] Specifically, the user can first send a password reset request to the server through the user terminal. This request contains the user's unique identification information. After receiving the password reset request, the server will verify the unique identification information contained therein (such as verifying whether the mobile phone number has been registered and bound to the corresponding account). If the verification fails, an error message is returned to the user terminal, clearly indicating the reason for the verification failure (such as the user name does not exist or the mobile phone number is not bound to the account). If the verification passes, the server randomly generates a reset verification code and associates it with the user's unique identification information. At the same time, a user key is generated based on the user's unique identification information and a preset symmetric encryption algorithm (such as SMS4-ECB block cipher algorithm or data encryption standard algorithm), and the aforementioned information is stored in a database. Then the server returns a password reset response containing the reset verification code and the user key to the user terminal. After receiving the password reset response sent by the server, the user terminal determines the data format adopted by the password reset response, parses the password reset response according to the response format, and obtains the reset verification code and the user key.

[0055] In this embodiment, after receiving the password reset response sent by the server, the password reset response is parsed to obtain the reset verification code and the user key, which increases the complexity and security of the password reset process.

[0056] Furthermore, before receiving the password reset response sent by the server, it also includes: obtaining the user's identity information; verifying the user's identity information to obtain an identity authentication result; if the identity authentication result is failed, determining that the user is an illegal user and clearing the user's password reset permission.

[0057] Among them, identity information is various data used to identify and confirm the identity of the user, including the user's unique identification information and the Internet Protocol Address (IP) address of the user's terminal. The authentication result refers to the conclusion drawn by the server after verifying the user's identity information. For example, the authentication result can be passed or failed. An illegal user refers to a user who has not passed the authentication. Password reset permission refers to the operation permission that a user can initiate and participate in the password reset process.

[0058] Specifically, before receiving the password reset response sent by the server, when the user sends a password reset request to the server through the user terminal, the user terminal can first determine the user's unique identification information through the user's input, and determine the current IP address of the user terminal through the built-in network module, and then use the current IP address and the user's unique identification information to verify the user's identity information. Specifically, first determine the user's commonly used IP address from the correspondence table between user identification information and commonly used IP addresses based on the user's unique identification information, and then compare whether the current IP address is consistent with the commonly used IP address. If they are consistent, it is determined that the identity authentication result is passed, and a password reset request can be sent to the server at this time. If they are inconsistent, the user is determined to be an illegal user, and the user's password reset authority is cleared. In addition, if the user's commonly used IP address cannot be found from the correspondence table between user identification information and commonly used IP addresses based on the user's unique identification information, the user is directly determined to be an illegal user, and the user's password reset authority is cleared.

[0059] It should be noted that the corresponding relationship table between user identification information and commonly used IP addresses is determined based on the historical login information of each user, and records the IP addresses used by each user when logging in in the past.

[0060] In this embodiment, through the above steps, the account security can be protected and unauthorized password reset can be avoided.

[0061] Step 220: Encrypt the current verification code input by the user based on the reset verification code according to the user key to obtain an encrypted verification code, and send the encrypted verification code to the server, so that the server determines the verification result according to the encrypted verification code and the reset verification code.

[0062] The encrypted verification code refers to information obtained by encrypting the current verification code input based on the reset verification code according to the user key.

[0063] Specifically, after obtaining the current verification code through the front end, the current verification code can be preprocessed first so that its format conforms to the format of the aforementioned preset symmetric encryption algorithm, and then the preprocessed current verification code is encrypted based on the encryption rule of the aforementioned preset symmetric encryption algorithm and the user key to obtain the encrypted verification code, and the encrypted verification code is encapsulated into a request with the user's unique identification information and sent to the server. After receiving the request, the server will extract the encrypted verification code and the user's unique identification information, and then use the user key and the decryption rule of the aforementioned preset symmetric encryption algorithm to decrypt the encrypted verification code to obtain the current verification code, and based on the user's unique identification information, find the corresponding user's reset verification code from the database storing the reset verification code, and then the server compares the current verification code with the reset verification code to obtain the comparison result, and determines the verification result according to the comparison result. Specifically, if the current verification code is completely consistent with the reset verification code, the server will determine that the verification result is verification passed. If the current verification code is not completely consistent with the reset verification code, the server will determine that the verification result is verification failed. After determining that the verification result is verification passed, the server can send a response to agree to reset to the user terminal. After determining that the verification result is a verification failure, the server may return an error message to the user terminal, indicating that the entered verification code is incorrect.

[0064] In this embodiment, the current verification code input by the user based on the reset verification code is encrypted according to the user key to obtain an encrypted verification code, and the encrypted verification code is sent to the server, so that the server determines the verification result according to the encrypted verification code and the reset verification code, thereby protecting the security of the verification code transmission and avoiding the risk of user information being abused or stolen due to the leakage of the verification code, thereby improving the level of user privacy protection.

[0065] Furthermore, before sending the current verification code input by the user based on the reset verification code to the server, the method further includes: when it is determined that the reception time of the current verification code is not within a preset time range, determining that the current verification code is invalid.

[0066] The preset time range refers to the valid time range of the verification code determined based on actual conditions.

[0067] For example, if the current verification code is received at 14:08:31 on November 28, 2024, and the preset time range is from 14:07:00 on November 28, 2024 to 14:08:00 on November 28, 2024, the current verification code is determined to be invalid, and an error message is displayed to the user, indicating that the verification code has expired, and the user is allowed to request the verification code again, that is, to resend a password reset request to the server through the user terminal. In addition, the user terminal can record this failed attempt and take additional security measures (such as locking the account) after the user's consecutive failed attempts reach a preset number (such as 5 times).

[0068] In this embodiment, through the above steps, the validity of the verification code is ensured and the verification code is prevented from being abused or stolen.

[0069] Step 230: After receiving the reset consent response sent by the server after determining that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password.

[0070] Furthermore, when the user inputs a password based on the password reset page, it also includes: when it is determined that the input current password does not conform to a preset password format, determining that the current password is an abnormal password.

[0071] The current password refers to the password manually entered by the user on the password reset page. The preset password format refers to the requirements for password composition rules that are pre-set according to actual conditions or needs. The abnormal password refers to the current password that does not conform to the preset password format.

[0072] For example, if the preset password format is: the password length is at least 8 characters, the characters contain uppercase and lowercase letters, numbers and special characters, and the current password is 12345678, then it can be determined that the current password is an abnormal password, and a format exception message is displayed to the user, prompting that the password format is incorrect, and the user is allowed to modify the current password to make it conform to the preset password format.

[0073] For example, if the preset password format is: the password length is at least 8 characters, the characters include uppercase and lowercase letters, numbers and special characters, and the current password is 123Aa! 78, then it can be determined that the current password is the target password.

[0074] In this embodiment, through the above steps, it can be ensured that the target password finally set meets the security and regulatory requirements, and the password is prevented from being easily cracked due to being too simple, thereby ensuring the security of the account.

[0075] Furthermore, determining the password input by the user based on the password reset page as the target password includes: matching the first password and the second password input by the user based on the password reset page to obtain a matching result; if the matching result is successful, determining the first password or the second password as the target password.

[0076] The first password refers to the first password entered by the user on the password reset page for resetting the password. The second password refers to the password entered again for confirmation after the user enters the first password on the password reset page. Its function is to compare with the first password to prevent the user from making mistakes when entering the password for the first time (such as entering the wrong characters). The password format of the second password must be the same as that of the first password. The matching result refers to the conclusion obtained after comparing the first password and the second password.

[0077] Specifically, after obtaining the first password and the second password through the password reset page, the first password and the second password input by the user based on the password reset page can be matched to obtain a matching result. Specifically, it is determined whether the first password and the second password are completely consistent in content. If they are completely consistent, the matching result is determined to be successful, and the first password or the second password is determined as the target password. If they are not completely consistent, the matching result is determined to be a failure, and a message of a failed match is displayed to the user, prompting the user that the passwords entered twice are inconsistent, and the user is allowed to modify the first password and the second password so that the first password and the second password are the same.

[0078] In this embodiment, through the above steps, password input errors caused by user negligence (such as fingers accidentally touching the keyboard) can be effectively reduced.

[0079] Step 240: Encrypt the target password according to the preset encryption public key to obtain the encrypted target password.

[0080] The preset encryption public key refers to a public key that is preset and saved in advance and is used to encrypt a password. The encrypted target password refers to a password obtained by encrypting the target password with the preset encryption public key.

[0081] Specifically, after obtaining the target password, the target password may be encrypted according to a preset asymmetric encryption algorithm (such as the Rivest-Shamir-Adleman encryption algorithm) and a preset encryption public key to obtain the encrypted target password.

[0082] In this embodiment, the target password is encrypted according to a preset encryption public key to obtain an encrypted target password, thereby ensuring the security of the subsequent target password during transmission.

[0083] Step 250: Send the encrypted target password to the server, so that the server determines the password reset result according to the encrypted target password and then sends the password reset result to the user terminal.

[0084] The password reset result refers to the conclusion sent to the user terminal indicating whether the password reset is successful.

[0085] Specifically, after obtaining the encrypted target password, it is sent to the server so that the server decrypts the encrypted target password according to the aforementioned preset asymmetric encryption algorithm and the preset decryption private key to obtain the target password, and then finds the original password of the user from the database storing the user password according to the user's unique identification information, and compares it with the target password to obtain the comparison result, and determines the password reset result according to the comparison result. Specifically, if the target password is completely consistent with the original password, the password reset result is determined to be a failure. If the target password is not completely consistent with the original password, the original password is replaced with the target password, and the password reset result is determined to be successful. After obtaining the password reset result, the server sends it to the user terminal. After receiving it, the user terminal determines whether the password reset result is successful. If the password reset result is successful, a message of successful password reset is displayed, prompting the user that the password has been successfully updated, and the target password can be used to log in and other operations. If the password reset result is not successful, a message of failed password reset is displayed, prompting the user that the newly set password is consistent with the original password and needs to re-enter the target password.

[0086] In this embodiment, through the above steps, the accuracy and reliability of password resetting are ensured, and security vulnerabilities caused by misjudgment are avoided.

[0087] In the embodiment of the present invention, after receiving the password reset response sent by the server, the password reset response is parsed to obtain the reset verification code and the user key, avoiding the delay caused by decrypting the encrypted verification code, significantly reducing the waiting time of the user in the entire password reset process, and improving the response speed of the entire password reset process, thereby ensuring the real-time nature of the password reset, and then ensuring that the user can immediately see the verification code, and enhancing the user experience. Then, the current verification code input by the user based on the reset verification code is encrypted according to the user key to obtain the encrypted verification code, and the encrypted verification code is sent to the server, so that the server determines the verification result according to the encrypted verification code and the reset verification code, protecting the security of the verification code transmission, avoiding the risk of user information being abused or misused due to the leakage of the verification code, thereby improving the level of user privacy protection. Then, after receiving the consent reset response sent by the server after determining that the verification result is passed, the password entered by the user based on the password reset page is determined as the target password, ensuring that only users who have passed the verification code verification can perform the password reset operation, effectively preventing malicious attackers from arbitrarily tampering with user passwords without authorization, protecting various sensitive information in the account, and maintaining the privacy rights and interests of users. And after receiving the reset consent response, the password entered by the user is directly determined as the target password, so that the user can complete the password reset in a relatively short time without performing additional complex operations or waiting for a long confirmation process, and quickly resume normal use of the account, ensuring the real-time nature of the password reset and improving the user experience. Afterwards, the target password is encrypted according to the preset encryption public key to obtain an encrypted target password, thereby ensuring the security of the subsequent target password during transmission. Finally, the encrypted target password is sent to the server, so that the server determines the password reset result according to the encrypted target password and then sends the password reset result to the user terminal, thereby ensuring the accuracy and reliability of the password reset and avoiding security vulnerabilities caused by misjudgment. Therefore, the technical solution of the present invention can solve the problem of low real-time performance in the existing password reset method.

[0088] In addition, before receiving the password reset response sent by the server, the user's identity information is obtained; the user's identity information is verified to obtain the identity authentication result; if the identity authentication result is failed, the user is determined to be an illegal user and the user's password reset permission is cleared, thereby protecting the account security and avoiding unauthorized password reset behavior.

[0089] Moreover, before sending the current verification code input by the user based on the reset verification code to the server, when it is determined that the reception time of the current verification code is not within the preset time range, the current verification code is determined to be invalid, thereby ensuring the validity of the verification code and preventing the verification code from being abused or stolen.

[0090] On the other hand, when the user inputs a password based on the password reset page and determines that the current password input does not conform to the preset password format, the current password is determined to be an abnormal password, which can ensure that the target password set in the end meets the security and specification requirements, avoids the password being easily cracked due to being too simple, and ensures the security of the account. And the first password and the second password input by the user based on the password reset page are matched to obtain a matching result; if the matching result is successful, the first password or the second password is determined as the target password, which can effectively reduce password input errors caused by user negligence (such as fingers accidentally touching the keyboard).

[0091] Figure 3 A schematic diagram of the structure of a password resetting device provided in an embodiment of the present invention. The device and the password resetting methods of the above-mentioned embodiments belong to the same inventive concept. For details not fully described in the embodiments of the password resetting device, reference can be made to the embodiments of the above-mentioned password resetting methods.

[0092] like Figure 3 As shown, the device comprises:

[0093] The parsing module 310 is configured to parse the password reset response to obtain a reset verification code after receiving the password reset response sent by the server, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal;

[0094] A sending module 320, configured to send the current verification code input by the user based on the reset verification code to the server, so that the server determines a verification result according to the current verification code and the reset verification code;

[0095] The reset module 330 is used to determine the password input by the user based on the password reset page as the target password after receiving the reset consent response sent by the server after determining that the verification result is passed.

[0096] Based on the above embodiment, the device further includes:

[0097] The first encryption module is used to parse the password reset response after receiving the password reset response sent by the server to obtain the reset verification code and the user key; accordingly, the current verification code input by the user based on the reset verification code is sent to the server, including: encrypting the current verification code input by the user based on the reset verification code according to the user key to obtain the encrypted verification code, and sending the encrypted verification code to the server.

[0098] Based on the above embodiment, the device further includes:

[0099] The invalidation module is used to determine that the current verification code is invalid when it is determined that the reception time of the current verification code is not within a preset time range before the current verification code input by the user based on the reset verification code is sent to the server.

[0100] Based on the above embodiment, the device further includes:

[0101] The identity authentication module is used to obtain the identity information of the user before receiving the password reset response sent by the server; verify the identity information of the user to obtain the identity authentication result; if the identity authentication result is failed, determine that the user is an illegal user and clear the password reset permission of the user.

[0102] Based on the above embodiment, the device further includes:

[0103] The second encryption module is used to encrypt the target password according to a preset encryption public key after the password entered by the user based on the password reset page is determined as the target password to obtain an encrypted target password; and send the encrypted target password to the server, so that the server determines the password reset result according to the encrypted target password and then sends the password reset result to the user terminal.

[0104] Based on the above embodiment, the device further includes:

[0105] The format checking module is used to determine that the current password is an abnormal password when the user inputs a password based on the password reset page and determines that the input current password does not conform to a preset password format.

[0106] Based on the above embodiment, determining the password input by the user based on the password reset page as the target password includes:

[0107] Matching the first password and the second password input by the user based on the password reset page to obtain a matching result;

[0108] When the matching result is successful, the first password or the second password is determined as the target password.

[0109] The password resetting device provided in the embodiment of the present invention can execute the password resetting method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0110] It is worth noting that in the embodiment of the above-mentioned password resetting device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the protection scope of the present invention.

[0111] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 4 A block diagram of an exemplary electronic device 4 suitable for implementing embodiments of the present invention is shown. Figure 4 The electronic device 4 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0112] like Figure 4 As shown, the electronic device 4 is in the form of a general purpose computing electronic device. The components of the electronic device 4 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 connecting different system components (including the system memory 28 and the processing unit 16).

[0113] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0114] The electronic device 4 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 4, including volatile and non-volatile media, removable and non-removable media.

[0115] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 4 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4Not shown in the figure, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0116] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0117] The electronic device 4 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), one or more devices that enable a user to interact with the electronic device 4, and / or any device that enables the electronic device 4 to communicate with one or more other computing devices (e.g., network cards, modems, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 4 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. Figure 4 As shown, the network adapter 20 communicates with other modules of the electronic device 4 via the bus 18. It should be understood that although Figure 4 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 4, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0118] The processing unit 16 executes various functional applications and page displays by running the program stored in the system memory 28, for example, implementing the password reset method provided in the embodiment of the present invention, which includes:

[0119] After receiving the password reset response sent by the server, parsing the password reset response to obtain a reset verification code, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal;

[0120] Sending the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code;

[0121] After receiving the reset consent response sent by the server after determining that the verification result is passed, the password input by the user based on the password reset page is determined as the target password.

[0122] Of course, those skilled in the art can understand that the processor can also implement the technical solution of the password resetting method provided by any embodiment of the present invention.

[0123] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, a password resetting method provided by an embodiment of the present invention is implemented, for example, and the method includes:

[0124] After receiving the password reset response sent by the server, parsing the password reset response to obtain a reset verification code, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal;

[0125] Sending the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code;

[0126] After receiving the reset consent response sent by the server after determining that the verification result is passed, the password input by the user based on the password reset page is determined as the target password.

[0127] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0128] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0129] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0130] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0131] It should be understood by those skilled in the art that the modules or steps of the present invention described above can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0132] In addition, the acquisition, storage, use, and processing of data in the technical solution of the present invention are in compliance with the relevant provisions of national laws and regulations.

[0133] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A password resetting method, characterized in that: The method comprises: After receiving the password reset response sent by the server, parsing the password reset response to obtain a reset verification code, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal; Sending the current verification code input by the user based on the reset verification code to the server, so that the server determines the verification result according to the current verification code and the reset verification code; After receiving the reset consent response sent by the server after determining that the verification result is passed, the password input by the user based on the password reset page is determined as the target password.

2. The password resetting method according to claim 1, characterized in that: After receiving the password reset response from the server, it also includes: Parsing the password reset response to obtain the reset verification code and the user key; Accordingly, sending the current verification code input by the user based on the reset verification code to the server includes: The current verification code input by the user based on the reset verification code is encrypted according to the user key to obtain an encrypted verification code, and the encrypted verification code is sent to the server.

3. The password resetting method according to claim 1, characterized in that: Before sending the current verification code input by the user based on the reset verification code to the server, the method further includes: When it is determined that the reception time of the current verification code is not within the preset time range, it is determined that the current verification code is invalid.

4. The password resetting method according to claim 1, characterized in that: Before receiving the password reset response from the server, it also includes: Obtaining identity information of the user; Verifying the identity information of the user to obtain an identity authentication result; When the identity authentication result is failure, the user is determined to be an illegal user, and the user's password reset permission is cleared.

5. The password resetting method according to claim 1, characterized in that: After determining the password input by the user based on the password reset page as the target password, the method further includes: Encrypting the target password according to a preset encryption public key to obtain an encrypted target password; The encrypted target password is sent to the server, so that the server determines a password reset result according to the encrypted target password and then sends the password reset result to the user terminal.

6. The password resetting method according to claim 1, characterized in that: When the user enters a password based on the password reset page, the method further includes: When it is determined that the input current password does not conform to the preset password format, the current password is determined to be an abnormal password.

7. The password resetting method according to claim 1, characterized in that: Determining the password input by the user based on the password reset page as the target password includes: Matching the first password and the second password input by the user based on the password reset page to obtain a matching result; When the matching result is successful, the first password or the second password is determined as the target password.

8. A password resetting device, characterized in that: The device comprises: a parsing module, configured to parse the password reset response to obtain a reset verification code after receiving the password reset response sent by the server, wherein the password reset response is determined by the server after receiving the password reset request sent by the user terminal; A sending module, configured to send the current verification code input by the user based on the reset verification code to the server, so that the server determines a verification result according to the current verification code and the reset verification code; The reset module is used to determine the password input by the user based on the password reset page as the target password after receiving the reset consent response sent by the server after determining that the verification result is passed.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the password resetting method described in any one of claims 1-7.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, implement the password resetting method described in any one of claims 1 to 7.

Images