Method for retrieving lost iTunes backup password

Abstract

The invention discloses a method for retrieving a lost i Tunes backup password, which comprises the following steps of: reading an i Tunes backup key packet, and judging whether the reading is successful or not; a user inputs password features to generate a password dictionary; executing a distributed decryption process, and if decryption succeeds, completing password matching; and if decryption fails, regenerating the dictionary. According to the method, the password dictionary is generated through the password features input by the user, and the system can help the user recover the lost i Tunes backup password by matching and cracking the backup password. According to the method disclosed by the invention, the user is allowed to generate the dictionary according to self memory and characteristics instead of depending on a fixed password list, so that the cracking process is more flexible, and the success rate of password matching can be improved.

Description

Technical Field

[0001] The invention belongs to the technical field of information security, and in particular is a method for retrieving a lost iTunes backup password. Background Art

[0002] Users can back up data from iOS devices such as iPhone to PC through iTunes and other software, and restore it to the device when needed. On this basis, the iOS operating system also provides an encrypted backup function (that is, users can specify a set of passwords, and use the password to encrypt the backup file during backup), which can protect privacy from being leaked. At the same time, some sensitive data must be backed up with backup encryption for security reasons.

[0003] Therefore, some users forget the backup password after setting it for various reasons, resulting in the inability to restore the backed-up content. In response to this situation, Apple only provides a way to clear the encryption status of the iOS device, but cannot retrieve the forgotten password, resulting in the inability to restore the encrypted backup, which in turn leads to data loss. Summary of the invention

[0004] The purpose of the present invention is to provide a method for retrieving a lost iTunes backup password, so as to solve the problem in the background art that after a user forgets the backup password, the backed-up content cannot be restored and the data is lost.

[0005] In order to solve the above technical problems, the technology adopted by the present invention is:

[0006] A method to recover a lost iTunes backup password, including the following steps:

[0007] Step S1, read the iTunes backup key package and determine whether the reading is successful. If successful, proceed to step S2. If the reading fails, end directly;

[0008] Step S2, the user inputs password features to generate a password dictionary;

[0009] Step S3, execute the distributed decryption process. If the decryption is successful, the password matching is completed; if the decryption fails, return to step S2 to regenerate the dictionary.

[0010] According to the above technology and the present invention, in step S1, reading the iTunes backup key package specifically includes: reading the BackupKeyBag field from the manifest file manifest.plist of the iTunes backup as the backup key package.

[0011] According to the above technology and the present invention, in step S2, the password dictionary required for brute force cracking is generated using the crunch tool based on the password features input by the user.

[0012] According to the above technology of the present invention, in step S3, to execute the distributed decryption process, it is necessary to first build a distributed decryption end, which includes a decryption server and multiple decryption clients.

[0013] According to the above technology and the present invention, the distributed decryption process is specifically as follows:

[0014] Step S301, the decryption client connects to the decryption server;

[0015] Step S302, the decryption client requests the decryption server to send the backup key package to be decrypted. If the backup key package is successfully sent, the process proceeds to step S303. If the backup key package is not successfully sent, the process ends directly.

[0016] Step S303, read attribute values ​​from the backup key package: DPSL, DPIC, SALT, ITER;

[0017] Step S304, reading any encryption key from the backup key package as a ciphertext sample;

[0018] Step S305, requesting the decryption server to send a batch of passwords to be matched as password samples;

[0019] Step S306, executing a cracking process for each given password.

[0020] According to the above technical invention, in step S306, executing the cracking process includes:

[0021] Step S3061, using the fastpbkdf2 algorithm, with the given password, DPSL, and DPIC as the password, salt value, and number of iterations respectively, execute the fastpbkdf2_hmac_sha256 operation to obtain the secret key α;

[0022] Step S3062, using the fastpbkdf2 algorithm, with the secret key α, SALT, and ITER as the password, salt value, and number of iterations respectively, perform the fastpbkdf2_hmac_sha1 operation to obtain the secret key β;

[0023] Step S3063, performing an AES decryption operation using the secret key β and the ciphertext sample to obtain a final secret key;

[0024] Step S3064, the final key is judged. If the final key meets the conditions, the remaining decryption steps are terminated, and the successfully matched password sample and the matching success event are reported to the decryption server; if the final key does not meet the conditions, the next password sample is matched until a password sample that meets the conditions is found or all password samples are matched.

[0025] According to the above technical present invention, in step S3064, the judgment condition of the final key is: determine whether the final key is prefixed with the constant 0xa6a6a6a6a6a6a6a6a6. If not, it means that the given password in plain text does not match the actual password, and continue to execute step S306 to try to match the next given password.

[0026] The present invention has the following beneficial effects:

[0027] In the present invention, a password dictionary is generated by the password characteristics input by the user, and the system can help the user recover the lost iTunes backup password by matching and cracking the backup password. The method in the present invention allows the user to generate a dictionary based on their own memory and characteristics, rather than relying on a fixed password list, making the cracking process more flexible and improving the success rate of password matching. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The overall flow chart of retrieving iTunes password of the present invention;

[0029] Figure 2 This is a workflow diagram of the distributed decryption client of the present invention;

[0030] Figure 3 This is the organizational structure diagram of the distributed decryption service / decryption client of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical invention in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0032] Embodiment 1

[0033] like Figure 1 As shown, a method for retrieving a lost iTunes backup password includes the following steps:

[0034] Step S1, read the iTunes backup key package and determine whether the reading is successful. If successful, proceed to step S2. If the reading fails, end directly;

[0035] Step S2, the user inputs password features to generate a password dictionary;

[0036] Step S3, execute the distributed decryption process. If the decryption is successful, the password matching is completed; if the decryption fails, return to step S2 to regenerate the dictionary.

[0037] In the present invention, a password dictionary is generated by the password characteristics input by the user, and the system can help the user recover the lost iTunes backup password by matching and cracking the backup password. The method in the present invention allows the user to generate a dictionary based on their own memory and characteristics, rather than relying on a fixed password list, making the cracking process more flexible and improving the success rate of password matching.

[0038] Through the distributed decryption process, the present invention can utilize multiple computers or multiple processing units for parallel processing, thereby significantly improving the efficiency and speed of password cracking.

[0039] If the decryption fails, the present invention will automatically return to step S2 to regenerate the dictionary. This feedback mechanism ensures that the user can keep trying until the correct password is found, thereby improving the success rate of the entire password retrieval process.

[0040] The simplified steps and processes make password recovery more convenient for users without the need for in-depth technical knowledge.

[0041] The present invention in the present invention enhances the possibility and efficiency of retrieving iTunes backup passwords by combining user input, flexible dictionary generation and efficient decryption process.

[0042] Embodiment 2

[0043] This embodiment provides a specific implementation method.

[0044] A method to recover lost iTunes backup password. The main technical principles are as follows:

[0045] iTunes backup mainly uses the AES (Advanced Encryption Standard) algorithm to encrypt each file in the backup. The encryption keys for different protection types of files are different, and these encryption keys are stored in the backup key bag (BackupKeyBag).

[0046] The keys in the backup key package are prefixed with the constant 0xa6a6a6a6a6a6a6a6 when stored, and are encrypted and stored in the backup list file after 5 AES iterations. The encryption key of the backup key package is generated from the plaintext password entered by the user through 2 rounds of PBKDF2 algorithm.

[0047] like Figure 2 As shown, the present invention extracts the backup key package in the backup list file as the ciphertext sample to be decrypted, takes any character string as the given password, exports it as the encryption key of the backup key package through the PBKDF2-HMAC-{SHA1, SHA256} algorithm, and then performs 5 iterations of the reverse AES decryption process (hereinafter referred to as the decryption process). If the decrypted ciphertext sample contains the prefix constant 0xa6a6a6a6a6a6a6a6, it can be determined that the given password is the encryption password of the iTunes backup.

[0048] PBKDF2-HMAC-{SHA1, SHA256} is a password derivation algorithm that introduces computationally intensive operations to ensure algorithm strength. Its characteristics make the time cost required for brute force cracking quite high. Therefore, the present invention reduces the time cost of password retrieval through the following two points:

[0049] 1. Generate the password dictionary required for brute force cracking through dictionary generation tools such as crunch based on the features that the user may include in the password, such as the password length range, the character list and character priority that the password may include, and the pattern that the password may include. The more accurate the password features given by the user, the smaller the generated dictionary set, or the higher the final password is in the dictionary set.

[0050] 2. Submit the distributed decryption server / decryption client program through the generated password dictionary and the backup key package of the target iTunes backup. The decryption server is used to send the data required by the decryption client to match the password, and summarize the password matching results and running status reported by the decryption client. The number of decryption clients and the CPU or GPU performance of the computer where they are located will determine the time taken to match the dictionary set.

[0051] The time required to retrieve a lost password using the present invention mainly depends on the accuracy of the password characteristics provided by the user, and secondly depends on the number of added decryption client programs.

[0052] The technical problem to be solved by the present invention comprises the following steps:

[0053] Step 1: Generate the password dictionary required for brute force cracking using tools such as crunch based on the password features entered by the user:

[0054] Example 1: The password is 6 characters long, starts with `1q, and the rest is composed of lowercase letters and numbers. Execute the following command in the command line to generate the dictionary file wordlist.txt:

[0055] crunch 6 6abcdefghijklmnopqrstuvwxyz0123456789-t\`1q@@@-owordlist.txt.

[0056] Example 2: The password is 6 characters long and starts with two of QMZC. The remaining part may be composed of the character set akiztvh43896\$@. The characters do not appear repeatedly. Execute the following command in the command line to generate the dictionary file wordlist.txt:

[0057] crunch 6 6QMZC akiztvh43896\$@-t@@,,,,|python-c"while True:var=input();print(var)if all(var.count(c)==1for c in var)else None">wordlist.txt.

[0058] Step 2: Read the BackupKeyBag field from the manifest.plist file of the iTunes backup as the backup key bag.

[0059] Step 3: Use any programming language to build a distributed decryption server and decryption client program. The organizational structure is as follows: Figure 3 As shown:

[0060] Step 4: Submit the password dictionary and backup password package output in steps 1 and 2 to the distributed decryption server and decryption client program. The decryption steps of the decryption client are as follows:

[0061] 1) The decryption client connects to the decryption server.

[0062] 2) The decryption client requests the decryption server to send the backup key package to be decrypted.

[0063] 3) Read attribute values ​​from the backup key package: DPSL, DPIC, SALT, ITER. The two sets of values ​​DPSL, DPIC and SALT, ITER are the salt value and iteration number of the two operations fastpbkdf2_hmac_sha256 and fastpbkdf2_hmac_sha1 (step S3061) respectively.

[0064] 4) Read any encryption key from the backup key package as a ciphertext sample.

[0065] 5) Request the decryption server to send a batch of passwords to be matched as password samples.

[0066] 6) For each password (hereinafter referred to as the given password), perform the following steps: Use the fastpbkdf2 algorithm to perform the fastpbkdf2_hmac_sha256 operation with the given password, DPSL, and DPIC as the password, salt value, and number of iterations respectively to obtain the secret key α.

[0067] Through fastpbkdf2 (a fast implementation of PBKDF2-HMAC-{SHA1, SHA256} algorithm, that is, a password derivation algorithm that ensures the strength of the derived key by introducing random "salt value" and "number of iterations"), the fastpbkdf2_hmac_sha1 operation is performed with the secret keys α, SALT, and ITER as the password, salt value, and iteration number respectively to obtain the secret key β.

[0068] Perform five AES decryption operations using the secret key β and the ciphertext sample to obtain the final secret key.

[0069] If the final key is prefixed with the constant 0xa6a6a6a6a6a6a6a6, terminate the remaining decryption steps, and report the successfully matched password sample and the matching success event to the decryption server.

[0070] If the final key is not prefixed with the constant 0xa6a6a6a6a6a6a6a6, continue matching the next password sample.

[0071] 7) Report the decryption server, match the failure event, and jump to step e.

[0072] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0073] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical invention described in the aforementioned embodiments or replace some of the technical features therein with equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for retrieving a lost iTunes backup password, characterized by: The following steps are involved: Step S1, read the iTunes backup key package and determine whether the reading is successful. If successful, proceed to step S2. If the reading fails, end directly; Step S2, the user inputs password features to generate a password dictionary; Step S3, execute the distributed decryption process. If the decryption is successful, the password matching is completed; if the decryption fails, return to step S2 to regenerate the dictionary.

2. A method for retrieving a lost iTunes backup password according to claim 1, characterized in that: In step S1, reading the iTunes backup key package specifically includes: reading the BackupKeyBag field from the manifest file manifest.plist of the iTunes backup as the backup key package.

3. The method for retrieving a lost iTunes backup password according to claim 2, characterized in that: In step S2, the password dictionary required for brute force cracking is generated using the crunch tool based on the password features input by the user.

4. The method for retrieving a lost iTunes backup password according to claim 3, characterized in that: In step S3, to execute the distributed decryption process, it is necessary to first build a distributed decryption end, which includes a decryption server and multiple decryption clients.

5. The method for retrieving a lost iTunes backup password according to claim 4, characterized in that: The specific distributed decryption process is as follows: Step S301, the decryption client connects to the decryption server; Step S302, the decryption client requests the decryption server to send the backup key package to be decrypted. If the backup key package is successfully sent, the process proceeds to step S303. If the backup key package is not successfully sent, the process ends directly. Step S303, read attribute values ​​from the backup key package: DPSL, DPIC, SALT, ITER; Step S304, reading any encryption key from the backup key package as a ciphertext sample; Step S305, requesting the decryption server to send a batch of passwords to be matched as password samples; Step S306, executing a cracking process for each given password.

6. The method for retrieving a lost iTunes backup password according to claim 5, characterized in that: In step S306, the cracking process includes: Step S3061, using fastpbkdf2 to use the given password, DPSL, and DPIC as the password, salt value, and number of iterations, respectively, to perform the fastpbkdf2_hmac_sha256 operation, process the plaintext given password into an encryption key, and obtain the key α; Step S3062, through fastpbkdf2, with secret key α, SALT, and ITER as the password, salt value, and number of iterations respectively, perform fastpbkdf2_hmac_sha1 operation to obtain secret key β; Step S3063, performing an AES decryption operation using the secret key β and the ciphertext sample to obtain a final secret key; Step S3064, the final key is judged. If the final key meets the conditions, the remaining decryption steps are terminated, and the successfully matched password sample and the matching success event are reported to the decryption server; if the final key does not meet the conditions, the next password sample is matched until a password sample that meets the conditions is found or all password samples are matched.

7. The method for retrieving a lost iTunes backup password according to claim 6, characterized in that: In step S3064, the judgment condition of the final key is: determine whether the final key is prefixed with the constant 0xa6a6a6a6a6a6a6a6. If not, it means that the given password in plain text does not match the actual password, and continue to execute step S306 to try to match the next given password.

Images