Account sharing methods and related equipment

Abstract

This application discloses an account sharing method and related equipment, belonging to the field of data processing technology. The method includes: upon detecting a login operation for a target account shared by an account holder, obtaining first encrypted information shared by the account holder and a login private key identifier corresponding to the first encrypted information; obtaining a first device public key in the account holder and a device private key in the account user, and determining a first common key based on the first device public key and the device private key; obtaining a first random number from the account holder based on the login private key identifier, and decrypting the first encrypted information based on the first common key to obtain a first encrypted login private key for the target account, wherein the first encrypted login private key is obtained by encrypting the login private key with the first random number; decrypting the first encrypted login private key based on the first random number to obtain a login private key, and logging into the target account on the account user based on the login private key.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, specifically relating to an account sharing method and related equipment. Background Technology

[0002] In daily life, we often encounter scenarios where we need to share account passwords. For example, user A shares their account password with user B, who then uses that password to log into user A's account on their own device. When user B obtains the account password, it can easily compromise the security of user A's account.

[0003] In the exemplary technology, when user B needs to log in to user A's account, user B enters the mobile phone number associated with user A's account and requests a verification code generated by the entered mobile phone number from user A to log in to user A's account.

[0004] Although the above-mentioned shared account login method does not require the account holder's account password, the login process for shared accounts is complicated, making it cumbersome for non-account holders to log in to the account holder's account. Summary of the Invention

[0005] The purpose of this application is to provide an account sharing method and related equipment to solve the problem of cumbersome process for non-account holders to log in to the account holder's account.

[0006] In a first aspect, embodiments of this application provide an account sharing method, including:

[0007] When the account user detects a login operation for a target account shared by the account holder, it obtains the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information. The login private key identifier is used to indicate the identifier of the login private key of the target account.

[0008] The account user obtains the first device public key and the device private key of the account holder, and determines the first common key based on the first device public key and the device private key;

[0009] The account user obtains a first random number based on the login private key identifier, and decrypts the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number.

[0010] The account user terminal decrypts the first encrypted login private key according to the random number to obtain the login private key, and logs into the target account on the account user terminal according to the login private key.

[0011] Secondly, this application provides a method for sharing accounts, including:

[0012] When the account holder detects a sharing operation targeting a target account in the account holder, it determines the account user specified by the sharing operation and generates a random number;

[0013] The account holder obtains the login private key of the target account and the login private key identifier corresponding to the login private key from the account holder, and encrypts the login private key according to the random number to obtain the encrypted login private key;

[0014] The account holder obtains the device public key and the device private key of the account user, and determines the target common key based on the device public key and the device private key;

[0015] The account holder encrypts the encrypted login private key using the target common key to obtain ciphertext information, and sends the ciphertext information, the target account, and the login private key identifier to the account user.

[0016] Thirdly, embodiments of this application provide an account user terminal, the device comprising:

[0017] The first acquisition module is used to acquire, upon detecting a login operation for a target account shared by an account holder, the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information, wherein the login private key identifier is used to indicate the identifier of the login private key of the target account.

[0018] The second acquisition module is used to acquire the first device public key of the account holder and the device private key of the account user, and determine the first common key based on the first device public key and the device private key;

[0019] The third acquisition module is used to acquire a first random number based on the login private key identifier, and decrypt the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number.

[0020] The decryption module is used to decrypt the first encrypted login private key according to the random number to obtain the login private key, and to log in to the target account on the account user terminal according to the login private key.

[0021] Fourthly, embodiments of this application provide an account holder, the device comprising:

[0022] The determination module is used to determine the account user specified by the sharing operation and generate a random number when a sharing operation for a target account in the account holder is detected.

[0023] The fourth acquisition module is used to acquire the login private key of the target account in the account holder terminal and the login private key identifier corresponding to the login private key, and to encrypt the login private key according to the random number to obtain the encrypted login private key;

[0024] The fifth acquisition module is used to acquire the device public key of the account user and the device private key of the account holder, and determine the target common key based on the device public key and the device private key;

[0025] The encryption module is used to encrypt the encrypted login private key according to the target common key to obtain ciphertext information, and send the ciphertext information, the target account, and the login private key identifier to the account user terminal.

[0026] Fifthly, embodiments of this application provide an electronic device including a processor and a memory, the memory storing programs or instructions executable on the processor, the programs or instructions, when executed by the processor, implementing the steps of the method described in the first or second aspect.

[0027] In a sixth aspect, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first or second aspect.

[0028] In a seventh aspect, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the methods described in the first or second aspect.

[0029] Eighthly, embodiments of this application provide a computer program product stored in a storage medium, which is executed by at least one processor to implement the method as described in the first or second aspect.

[0030] In this embodiment, when logging into the target account shared by the account holder on the account user's end, the encrypted information of the account holder is decrypted using the device private key of the account user's end, the device public key of the account holder's end, and a random number generated by the account holder's end. This yields the login private key for the target account, allowing login to the target account on the account user's end. Users only need to perform one login operation on the account user's end to log into the target account shared by the account holder. This reduces the process of logging into the shared account and simplifies the process for non-account holders to log into the account holder's account, provided that the user cannot obtain the login password of the target account based on the login private key. Attached Figure Description

[0031] Figure 1 This is a schematic diagram illustrating a scenario of an account sharing method according to an exemplary embodiment;

[0032] Figure 2 This is a flowchart illustrating one of the account sharing methods according to an exemplary embodiment of the account user terminal;

[0033] Figure 3 This is a second flowchart illustrating an account sharing method according to an exemplary embodiment;

[0034] Figure 4 This is a schematic diagram illustrating the interaction between an account holder and an account user according to an exemplary embodiment.

[0035] Figure 5 This is the third flowchart illustrating an account sharing method based on an exemplary embodiment of the account user terminal;

[0036] Figure 6 This is a fourth flowchart illustrating an account sharing method based on an exemplary embodiment of the account user terminal;

[0037] Figure 7 This is one of the flowcharts illustrating an account sharing method according to an exemplary embodiment of the account holder;

[0038] Figure 8 This is a structural block diagram illustrating an account user terminal according to an exemplary embodiment;

[0039] Figure 9 This is a structural block diagram of an account holder according to an exemplary embodiment;

[0040] Figure 10 This is a structural block diagram of an electronic device according to an exemplary embodiment;

[0041] Figure 11A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application. Detailed Implementation

[0042] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0043] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0044] In daily life, we often encounter scenarios where we need to share account passwords. For example, user A shares their account password with user B, who then uses that password to log into user A's account on their own device. When user B obtains the account password, it can easily compromise the security of user A's account.

[0045] In the exemplary technology, when user B needs to log in to user A's account, user B enters the mobile phone number associated with user A's account and requests a verification code generated by the entered mobile phone number from user A to log in to user A's account.

[0046] Although the above-mentioned shared account login method does not require the account holder's account password, the login process for shared accounts is complicated, making it cumbersome for non-account holders to log in to the account holder's account.

[0047] To address the cumbersome process of non-account holders logging into the accounts of account holders, the inventors of this application devised a method to decrypt the encrypted information on the account holder's device using the account user's device private key, the account holder's device public key, and a random number generated by the account holder. This decryption yields the login private key for the target account, allowing login to the target account on the account user's device. Users only need to perform a single login operation on the account user's device to access the shared target account. This reduces the process of logging into shared accounts and simplifies the process for non-account holders to access the account holder's account, especially when the user cannot obtain the password based on the login private key.

[0048] Reference Figure 1 This application provides a scenario illustration illustrating the account sharing method provided in this application. For example... Figure 1 As shown, account holder 100 is the terminal bound to the target account, and account holder 100 can share the target account. The terminal receiving the shared target account is account user 200. Account holder 100 obtains the login private key of the target account, encrypts the login private key to obtain ciphertext information, and sends the login private key identifier corresponding to the login private key, the target account, and the ciphertext information to account user 200. When account user 200 needs to log in to the target account, account user 200 uses the device public key of account holder 100, the login private key identifier, and its own device private key to decrypt the ciphertext information to obtain the login private key. Account user 200 sends signature data to authentication server 300 based on the login key. After authentication is successful based on the signature data, authentication server 300 sends the target account's running interface back to account user 200, that is, account user 200 successfully logged into the target account.

[0049] The following is a combination of... Figure 1 The accompanying drawings illustrate in detail the account sharing method and related devices provided in this application through specific embodiments and application scenarios.

[0050] The account sharing method provided in this application embodiment can be applied to account sharing application scenarios.

[0051] The following is combined Figure 1 The account sharing method provided in the embodiments of this application will be described in detail.

[0052] Reference Figure 2 , Figure 2 This is one of the flowcharts illustrating the account sharing method on the client side provided in this application, such as... Figure 2 As shown, the account sharing method includes the following steps:

[0053] Step S201: When a login operation is detected for the target account shared by the account holder, the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information are obtained. The login private key identifier is used to indicate the identifier of the login private key of the target account.

[0054] In this embodiment, the executing entity is the account user terminal. The account user terminal refers to the terminal that logs into the target account shared by the account holder terminal; this terminal can be a mobile phone, computer, or tablet, etc. The account holder terminal refers to the terminal that the target account is bound to or frequently logged into.

[0055] The account user terminal has an account list, which includes accounts bound to the account user terminal and target accounts shared by the account holder terminal. User B can select a target account shared by the account holder terminal from the account list to log in. When the account user terminal detects a login attempt targeting a target account, it confirms that User B has selected the target account shared by the account holder terminal. The target account can be an account on a video website, a game, a social media platform, etc. User A shares their target account with the account user terminal associated with User B, allowing User B to log in to the target account through the account user terminal.

[0056] When a login operation of the target account is detected, the account user obtains the stored first encrypted information and the corresponding login private key identifier. The first encrypted information and the login private key identifier are sent to the account user by the account holder when sharing the target account. The first encrypted information contains the login private key required to log in to the target account, and it is an encrypted version of the login private key. The first encrypted information is used by the account user to obtain the encrypted login private key. The login private key identifier is used to decrypt the first encrypted information by the account user; the specific decryption process is described below.

[0057] The first encrypted information and the login private key identifier are stored on the account user's end, but they can also be stored on the account server. For example, the account user has account B. The account holder sends the first encrypted information, account B, account A (the target account), and the login private key identifier to the account server for associated storage. When the account user needs to retrieve the first encrypted information, it generates a retrieval request based on account B and sends the request to the account server. The account server parses the retrieval request to obtain account B, and then sends the first encrypted information associated with account B and the login private key identifier back to the account user.

[0058] Step S202: Obtain the first device public key of the account holder and the device private key of the account user, and determine the first common key based on the first device public key and the device private key.

[0059] After obtaining the first encrypted information, the account user needs to decrypt it. For example, the account user obtains the device public key of the account holder, which is defined as the first device public key. It should be noted that the device public key involved in this application refers to a publicly disclosed key of the device; other devices can obtain data from the device containing the device public key through it. For example, the first device public key of the account holder is stored on the server. The account holder generates a public key retrieval request based on the device identifier of the account holder and sends the request to the server. The server parses the public key retrieval request to obtain the device identifier. The device public key stored on the server is associated with the corresponding device identifier, allowing the server to obtain the associated first device public key through the device identifier and send it to the account user.

[0060] The account user terminal has a device private key set up, and the account user terminal obtains the stored device private key. It should be noted that the device private key involved in this application is a key that the device does not publicly disclose. The function of the device private key is that the device containing the device private key encrypts data. The first ciphertext information is obtained by the account holder terminal based on the device public key and the device private key of the account user terminal. Therefore, the account user terminal can decrypt the first ciphertext information based on the first device public key and the device private key of the account holder terminal. Specifically, the decryption method is as follows: the account holder terminal generates a common key based on the first device public key and the device private key. For example, the generation method is to concatenate the first device public key and the device private key to obtain the common key, which is defined as the first common key. The account holder terminal then uses the first common key to decrypt the first ciphertext information to obtain the encrypted login private key.

[0061] Step S203: Obtain a first random number based on the login private key identifier, and decrypt the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number.

[0062] The account holder can obtain the encrypted login private key by decrypting the first ciphertext information using the first common key. This encrypted login private key is defined as the first encrypted login private key. The first encrypted login private key is generated by the account holder based on its own first random number and login private key; therefore, the account user needs to decrypt the first encrypted login private key based on the first random number. In one example, the account user stores the first random number sent by the account holder, which is associated with a login private key identifier. The account user retrieves the first random number associated with the login private key identifier. In another example, the account user generates a target login request for the target account based on the login private key identifier and sends the target login request to the account holder. The account holder parses the target login request to obtain the login private key identifier and sends the first random number associated with the login private key identifier to the account user.

[0063] Step S204: Decrypt the first encrypted login private key according to the first random number to obtain the login private key, and log in to the target account on the account user terminal according to the login private key.

[0064] The first encrypted login private key is obtained by encrypting the login private key based on a first random number on the account holder's end. For example, if the login private key is `passkey_pri_1` and the first random number is `rand_1`, then the first encrypted login private key `sub_passkey_pri_1` = `passkey_pri_1⊕rand_1`, where `⊕` represents the XOR operation. After obtaining the first random number, the account user decrypts the first encrypted login private key based on it, i.e., performs the operation `sub_passkey_pri_1⊕rand_1`. Since `sub_passkey_pri_1` = `passkey_pri_1⊕rand_1`, therefore `sub_passkey_pri_1⊕rand_1` = `passkey_pri_1`, thus obtaining the login private key.

[0065] After obtaining the login private key, the client can log in to the target account based on the login private key. For example, the client generates a login request based on the login private key identifier and sends the login request to the authentication server. The server parses the login request to obtain the login private key identifier, obtains the login public key associated with the login private key identifier, and sends a challenge value to the client. The authentication server then performs a signing operation on the login public key passkey_pub_1 based on the challenge to obtain the first signature data Sign(passkey_pub_1, challenge). After obtaining the challenge, the account user signs the login private key based on the challenge to obtain the second signature data Sign(passkey_pri_1, challenge). The account user sends the second signature data Sign(passkey_pri_1, challenge) to the authentication server. The authentication server compares the second signature data Sign(passkey_pri_1, challenge) with the first signature data Sign(passkey_pub_1, challenge). If the two match, the authentication is successful, and the authentication server sends the target account's interface to the account user, allowing the account user to log in to the target account.

[0066] It should be noted that after the account user obtains the login private key, its special structure prevents it from being stored. For example, the login private key may contain script code. When the script code detects a write operation from a non-account holder, it shuffles the order of the fields in the login private key, thus preventing the account user from storing it and avoiding the account user from using the stored login private key for long-term login to the target account.

[0067] In this embodiment, when logging into the target account shared by the account holder on the account user's end, the encrypted information of the account holder is decrypted using the device private key of the account user's end, the device public key of the account holder's end, and a random number generated by the account holder's end. This yields the login private key for the target account, allowing the user to log in to the target account using the login private key. The user only needs to perform one login operation on the account user's end to log in to the target account shared by the account holder. This reduces the process of logging into the shared account and simplifies the process for non-account holders to log into the account holder's account, provided that the user cannot obtain the login password of the target account based on the login private key.

[0068] Reference Figure 3 , Figure 3 This is the second flowchart illustrating the account sharing method on the client side provided in this application, based on... Figure 2In the embodiment shown, prior to step S201, the method further includes:

[0069] Step S301: Receive the first encrypted information, login private key identifier, and target account sent by the account holder, and construct a sharing list based on the login private key identifier and target account.

[0070] Step S302: The sharing list is associated with and stored with the first encrypted information.

[0071] In this embodiment, user A can select the terminal for sharing the target account on the account holder's device. That is, the account holder detects a sharing operation for the target account and obtains the terminal used by the account specified in the sharing operation. For example, the user can specify that user B of account B can use the target account. The terminal where account B is located is the terminal used by the account. Furthermore, the target account has multiple login private keys, each of which can be used to log in to the target account. User A can select the login private key identified as passkey_id_1 as the login private key for the terminal used to log in to the target account. The specified terminal used by the account can be determined by scanning a QR code or using a friend / family list. In one example, the account holder scans a shared QR code on another terminal; after scanning, the other terminal becomes the terminal used by the account. In another example, user A clicks on the friend / family list on the account holder's device. The friend / family list contains multiple accounts. User A selects an account from the friend / family list; that is, the account holder displays the friend / family list and, after detecting the selection operation, designates the terminal containing the selected account as the terminal used by the account. After determining the account user, the account holder obtains the target account's login private key passkey_pri_1 and login private key identifier passkey_id_1, and generates a random number rand_1, which is defined as the first random number and has the same length as passkey_pri_1.

[0072] The account holder encrypts the login private key using a first random number to obtain an encrypted login private key. For example, the first encrypted login private key is sub_passkey_pri_1 = passkey_pri_1 ⊕ rand_1. The account holder stores the target account (account_A), the account of the user (account_B), the login private key identifier, and the random number rand_1 in the sharing list of account_A. The sharing list is as follows:

[0073] Receiver Login private key source passkey id random numbers account_B account_A passkey_id_1 rand_1

[0074] The account holder has a trusted list set up. For example, the trusted list is as follows:

[0075]

[0076] When the identifier of the account user selected by the account holder needs to be in the trusted list, the account holder retrieves the device public key `device_B_trust_pub` from the trusted list based on the identifier of the account user. The account holder stores the device private key `device_A_trust_pri`. The account holder generates a common key `shared_AB_key = SHARE(device_B_trust_pub, device_A_trust_pri)` using the device public key and the device private key of the account user, where A refers to the account holder and B refers to the account user.

[0077] The account holder encrypts the first encrypted login private key using the target shared key to obtain the first ciphertext information Enc(shared_AB_key, sub_passkey_pri_1). The account holder then sends the first ciphertext information, the target account, and the login private key identifier to the account user. In other words, the account user receives the first ciphertext information, the login private key identifier, and the target account from the account holder. The account user constructs a sharing list based on the login private key identifier and the target account. For example, the sharing list might look like this:

[0078] Target account Login private key identifier account_A passkey_id_1

[0079] The account user will associate and store the shared list with the first encrypted information.

[0080] Step S303: If a login operation is detected targeting the account shared by the account holder, the login private key identifier is obtained from the sharing list based on the target account, and the first encrypted information associated with the sharing list is obtained.

[0081] When the client detects a login attempt targeting a specific account, it determines the target account's share list, retrieves the login private key identifier from the share list, and obtains the first encrypted information associated with the share list. By setting up a share list, the client can quickly obtain the login private key identifier, accelerating the process of acquiring the target account's login private key and thus enabling faster login to the target account, thereby improving the user experience.

[0082] Furthermore, the account holder sets a first valid time period (time1) for the first encrypted login private key and sends the first ciphertext information, the target account, the first valid time period information, and the login private key identifier to the account user. By setting the first valid time period information for the first encrypted login private key, the account user can only use the target account during the specified valid time period, satisfying the user's need to limit the sharing time of the target account and improving the user experience.

[0083] The account user receives the first encrypted information, the login private key identifying the target account, and the first valid time period information sent by the account holder. Based on the target account and the first valid time period information, a sharing list is constructed. The constructed sharing list is as follows:

[0084]

[0085] The client first determines the sharing list where the target account is located, and obtains the first valid time period information time1 from the sharing list. If the current time point is within the first valid time period information, it can be determined that the target account can continue to log in on the client. The client then obtains the login private key identifier from the sharing list to obtain the subsequent login private key.

[0086] If the current time exceeds the first valid time period, the target account cannot log in on the client application, and the client application will output a message indicating that the target account has expired. Specifically, the login private key is set based on the first valid time period information in the script code. The script code calculates the storage duration of the first encrypted information in the client application. If the storage duration reaches the duration of the first valid time period information, the script code shuffles the field order in the login private key, preventing the client application from obtaining the real login private key to log in to the target account.

[0087] Based on this embodiment, refer to Figure 4 The interaction between the account holder and the account user is briefly explained below:

[0088] 401. The account holder obtains the login private key passkey_pri_1 corresponding to the login private key identifier passkey_id_1, and generates a random number rand_1;

[0089] 402. Generate sub_passkey_pri_1 = passkey_pri_1 ⊕ rand_1 based on the random number rand_1 and passkey_pri_1, and configure the valid time period time1 of sub_passkey_pri_1;

[0090] 403. The account holder obtains the device public key device_B_trust_pub from the account user.

[0091] 404. The account holder generates a common key shared_AB_key = SHARE(device_B_trust_pub, device_A_trust_pri) based on its own device private key device_A_trust_pri and device public key device_B_trust_pub.

[0092] 405. The account holder uses the shared key shared_AB_key to encrypt sub_passkey_pri_1 to obtain the ciphertext sub_passkey_cipher=Enc(shared_AB_key,sub_passkey_pri_1);

[0093] 406. The account holder sends the encrypted message, account accouA, login private key identifier passkey_id_1, and valid time period time1 to the account user.

[0094] 407. The account user obtains the device public key device_A_trust_pub from the account holder;

[0095] 408. Generate a common key shared_BA_key = SHARE(device_A_trust_pub, device_B_trust_pri) based on device_A_trust_pub and its own device private key device_B_trust_pri;

[0096] 409. The account user decrypts the ciphertext sub_passkey_cipher using shared_BA_key to obtain the encrypted login private key sub_passkey_pri_1;

[0097] 410. The account user sends a request {req, passkey_id_1} to the account holder.

[0098] 411. The account holder returns a random number rand_1 based on the request;

[0099] 412. The account user decrypts the encrypted login private key based on a random number to obtain a temporary login private key passkey_pri_1 = sub_passkey_pri_1 ⊕ rand_1;

[0100] 413. The account user logs in to account acountA based on passkey_pri_1.

[0101] In this embodiment, users can securely share a target account with other users through the account holder without worrying about the login password of the target account being leaked, thus improving the security of sharing the target account.

[0102] Reference Figure 5 , Figure 5 This is the third flowchart illustrating the account sharing method on the client side provided in this application, based on... Figure 2 or Figure 3In the embodiment shown, step S202 includes:

[0103] Step S501: Determine the sharing terminal of the target account.

[0104] In this embodiment, the target account can be shared multiple times. For example, the target account belongs to user A, user A shares the target account with user B, and user B can share the target account with user C, thus forming a long-link sharing of the target account. Due to the existence of long-link sharing, the account user terminal can be a secondary sharing terminal of the target account or a multi-level sharing terminal. A secondary sharing terminal refers to a terminal where the account holder directly shares the target account; a multi-level sharing terminal refers to a terminal where other terminals, with the consent of the account holder, authorize the target account to log in. A multi-level sharing terminal is, for example, the terminal device associated with user C mentioned above.

[0105] The sharing terminal above the account user encrypts the encrypted login private key using its device private key. Therefore, the account user needs to identify the sharing terminal to obtain the accurate device public key. For example, if device A shares a target account with device B, device B shares the target account with device C, and device C shares the target account with device D, the sharing link for the target account is device A → device B → device C → device D. If device C needs to log in to the target account, then device B is the upstream sharing terminal of device C. Therefore, the account user determines the terminal that sent the first encrypted information; this terminal is defined as the sharing terminal.

[0106] Step S502: If the sharing terminal is the account holder, obtain the first device public key of the account holder and the device private key of the account user.

[0107] When the sharing terminal is the account holder, the account user obtains the first device public key of the account holder and the device private key of the account user, decrypts the first encrypted information to obtain the first encrypted login private key, and then decrypts the first encrypted login private key based on the first random number to obtain the login private key.

[0108] When the sharing terminal is not the account holder, the account user obtains the device public key of the sharing terminal. This device public key is defined as the second device public key and the device private key of the account user. Based on the second device public key and the device private key, a second common key is determined. Then, the first encrypted information is decrypted using the second common key to obtain the second encrypted login private key of the target account.

[0109] The second encrypted login private key is a login private key encrypted with random numbers from all upstream terminals of the account user. For example, device A shares the target account with device B, device B shares the target account with device C, and device C shares the target account with device D. The sharing link of the target account is device A → device B → device C → device D. If device C needs to log in to the target account, the upstream terminals include device B and device A. That is, it needs to obtain the random numbers generated by device A and device B. These random numbers are used to encrypt the login private key.

[0110] In response, the account user obtains a first random number generated by the account holder based on the login private key identifier, and also obtains a second random number generated by the sharing terminal based on the login private key identifier. For example, if the upstream terminals include device B and device A, the account user sends a random number retrieval request to device B (the sharing terminal) based on the login private key identifier, and device B obtains the second random number. Furthermore, if device B discovers that the login private key identifier was sent by device A, then device B sends a random number retrieval request to device A based on the login private key identifier, causing device A to return the first random number to device B, and device B then returns both the first and second random numbers to the account user.

[0111] The account user decrypts the second encrypted login private key using a first random number and a second random number to obtain the login private key, which is then used to log in to the target account on the account user's end. For example, the second encrypted login private key is encrypted using a first random number rand_1 from device A and a second random number rand_2 from device B. The second encrypted login private key is represented as: passkey_pri_1⊕rand_1⊕rand_2. The account user decrypts it using the first random number rand_1 and the second random number rand_2. The decryption process is: passkey_pri_1⊕rand_1⊕rand_2⊕rand_1⊕rand_2, thus obtaining the login private key passkey_pri_1.

[0112] In this embodiment, the sharing of the target account can support long-link sharing. The account user terminal accurately obtains the device public key based on its own sharing terminal in the long link, ensuring that the correct login private key is obtained.

[0113] Reference Figure 6 , Figure 6 This is the fourth flowchart illustrating the account sharing method on the client side provided in this application, based on... Figure 2 , Figure 3 or Figure 5 In the embodiment shown, after step S204, the method further includes:

[0114] Step S601: If a sharing operation targeting a target account is detected, determine the target terminal specified by the sharing operation and generate a third random number.

[0115] In this embodiment, the account user terminal can share the target account a second time. Specifically, user B can share the target account on the account user terminal; that is, when the account user terminal detects a sharing operation for the target account, it determines the target terminal specified by the sharing operation. For example, user B long-presses the control of the target account on the account user terminal, and the account user terminal pops up a sharing option box. If user B clicks the sharing option box, the account user terminal outputs a list of friends and family members, allowing user B to select the account to share from the list. The terminal where this account is located is defined as the target terminal.

[0116] Furthermore, for an account-using terminal to share a target account, it needs the consent of the account holder. To this end, after determining the account of the terminal corresponding to the sharing operation, the account-using terminal generates a sharing request based on the account and sends the request to the account holder. The account holder displays the account of the aforementioned terminal, which includes the name of the user associated with that terminal. If user A agrees to share the target account with the user associated with the account, they click the "Agree to Share" button on the account holder. The account holder then sends consent information to the account-using terminal, which designates the terminal corresponding to the sharing operation as the target terminal.

[0117] Before sharing a target account, the client needs to encrypt the first encrypted login private key. To do this, the client generates a random number, which is defined as the third random number.

[0118] Step S602: Encrypt the first encrypted login private key according to the third random number to obtain the third encrypted login private key.

[0119] After obtaining the third random number, the account user encrypts the first encrypted login private key using the third random number to obtain the third encrypted login private key. For example, if the third random number is rand_3, then the third encrypted login private key is sub_passkey_pri_1⊕rand_3.

[0120] Step S603: Obtain the second device public key of the target terminal, and determine the third common key based on the second device public key and the device private key.

[0121] After obtaining the third encrypted login private key, the account user needs to further encrypt it. For example, the account user stores a trusted list containing the target terminal's device public key. The account user retrieves the target terminal's device public key from the trusted list, and this device public key is defined as the second device public key. The account user then generates a shared key based on the second device public key and its own device private key, and this shared key is defined as the third shared key. For example, if the second device public key is device_C_trust_pub and the device private key is device_B_trust_pri, then the third shared key shared_BC_key = SHARE(device_C_trust_pub, device_B_trust_pri), where B represents the account user and C represents the target terminal.

[0122] Step S604: Encrypt the third encrypted login private key according to the third common key to obtain the second ciphertext information, and send the second ciphertext information, the target account, and the login private key identifier to the target terminal.

[0123] After obtaining the third common key, the account user encrypts the third encrypted login private key based on the third common key to obtain the second ciphertext information sub_sub_passkeys_cipher, and then sends the second ciphertext information, the target account, and the login private key identifier to the target terminal.

[0124] Furthermore, the account user can set a valid time period information, time2, for the third encrypted login private key. This valid time period information is defined as the second valid time period information. The account user sends the second encrypted information, the target account, and the second valid time period information to the target terminal, which means that the target terminal can log in to the target account within the second valid time period information.

[0125] When a target terminal needs to log in to a target account, it generates a fourth common key using the third device public key of the account user and the target terminal's device private key. The fourth common key is then used to decrypt the second encrypted information to obtain a third encrypted login private key. The target terminal then sends a first login request for the target account to the target user. The target user parses the first login request to obtain a login private key identifier, and then obtains a third random number based on the login private key identifier. The target user generates a second login request for the target account based on the login private key identifier and sends it to the account holder. The account holder then returns a first random number. The account user receives the first random number and sends both the first and third random numbers to the target terminal, allowing the target terminal to obtain the login private key and log in to the target account. The process by which the target account obtains the login private key based on the first and third random numbers is the same as the process by which the account user obtains the login private key based on the first and second random numbers, and will not be described again here.

[0126] It should be noted that each time the target account shares, the account holder generates a sub-link. The account holder can merge these sub-links to obtain the complete sharing link. For example, if device A shares an account with account B, the corresponding sub-link is Device A → Device B; if device B shares an account with account C, the corresponding sub-link is Device B → Device C; the combined sharing link of the two sub-links is: A → Device B → Device C.

[0127] In this embodiment, the account can support long-link sharing, that is, other terminals that log in to the target account can share the target account with other people, so that multiple users can share the account, which improves the user experience.

[0128] In one embodiment, user A, who holds the account, can cancel the sharing of the target account.

[0129] Specifically, when the account holder revokes the login permission of the user client for the target account, the authentication server sends a login interface to the user client. In other words, the authentication server forces the user client to log out of the target account, switching the user client from the target account's running interface to the login interface. Essentially, the user client displays the login interface sent by the authentication server. For example, the account holder displays a user client that can log in to the target account. When user A clicks the control represented on the account holder's interface, a "Cancel Sharing" button pops up. If user A clicks this button, it's considered that the account holder has detected the revocation of the user client's login permission for the target account. The account holder then sends a logout command for the target account to the authentication server, which in turn sends a login interface to the user client based on the logout command. In other words, the authentication server forcibly switches the user client's running interface for the target account to the login interface, thus forcibly logging the target account out of the user client.

[0130] In this embodiment, the user holding the account can cancel sharing of the target account, and the recipient will no longer be able to log in to the target account using the login private key, thus ensuring the target account owner's control over sharing the target account.

[0131] Reference Figure 7 , Figure 7 This is one of the flowcharts illustrating the account sharing method on the account holder side provided in this application. The account sharing method includes:

[0132] Step S701: If a sharing operation is detected targeting a target account in the account holder, determine the account user specified by the sharing operation and generate a random number.

[0133] In this embodiment, the executing entity is the account holder.

[0134] In this embodiment, user A can select the terminal for sharing the target account on the account holder's device. That is, the account holder detects a sharing operation for the target account and obtains the terminal used by the account specified in the sharing operation. For example, the user can specify that user B of account B can use the target account. The terminal where account B is located is the terminal used by the account. Furthermore, the target account has multiple login private keys, each of which can be used to log in to the target account. User A can select the login private key identified as passkey_id_1 as the login private key for the terminal used to log in to the target account. The specified terminal used by the account can be determined by scanning a QR code or using a friend / family list. In one example, the account holder scans a shared QR code on another terminal; after scanning, the other terminal becomes the terminal used by the account. In another example, user A clicks on the friend / family list on the account holder's device. The friend / family list contains multiple accounts. User A selects an account from the friend / family list; that is, the account holder displays the friend / family list and, after detecting the selection operation, designates the terminal containing the selected account as the terminal used by the account. After determining the account user, the account holder obtains the target account's login private key passkey_pri_1 and login private key identifier passkey_id_1, and generates a random number rand_1 with the same length as passkey_pri_1.

[0135] Step S702: Obtain the login private key of the target account and the login private key identifier corresponding to the login private key in the account holder terminal, and encrypt the login private key according to the random number to obtain the encrypted login private key.

[0136] Step S703: Obtain the device public key of the account user and the device private key of the account holder, and determine the target common key based on the device public key and the device private key.

[0137] The account holder encrypts the login private key using a random number to obtain an encrypted login private key. For example, the encrypted login private key `sub_passkey_pri_1` = `passkey_pri_1` ⊕ `rand_1`. The account holder stores the target account `account_A`, the account of the user account `account_B`, the login private key identifier, and the random number `rand_1` in the sharing list of `account_A`. The sharing list is as follows:

[0138] Receiver Login private key source passkey id random numbers account_B account_A passkey_id_1 rand_1

[0139] The account holder has a trusted list set up. For example, the trusted list is as follows:

[0140]

[0141] When the identifier of the account user selected by the account holder needs to be in the trusted list, the account holder retrieves the device public key `device_B_trust_pub` from the trusted list based on the identifier of the account user. The account holder stores the device private key `device_A_trust_pri`. The account holder generates a common key `shared_AB_key = SHARE(device_B_trust_pub, device_A_trust_pri)` using the device public key and the device private key of the account user, where A refers to the account holder and B refers to the account user.

[0142] Step S704: Encrypt the encrypted login private key according to the target common key to obtain ciphertext information, and send the ciphertext information, the target account, and the login private key identifier to the account user terminal.

[0143] The account holder encrypts the encrypted login private key using the target shared key to obtain ciphertext information Enc(shared_AB_key, sub_passkey_pri_1). The account holder then sends the ciphertext information, the target account, and the login private key identifier to the account user. In other words, the account user receives the ciphertext information, login private key identifier, and target account from the account holder. The account user constructs a sharing list based on the login private key identifier and the target account. For example, the sharing list might look like this:

[0144] Target account Login private key identifier account_A passkey_id_1

[0145] The account user associates and stores the shared list with the encrypted information. The account user uses the encrypted information to obtain the login private key to log in to the target account, as detailed in the above embodiment, which will not be repeated here.

[0146] Furthermore, the account holder sets a valid time period (time1) for the encrypted login private key and sends the encrypted information, target account, valid time period information, and login private key identifier to the account user.

[0147] The account user receives encrypted information, a login private key identifying the target account, and a valid time period from the account holder. Based on this information, a sharing list is constructed, as follows:

[0148]

[0149] The client first determines the sharing list where the target account is located, and obtains the valid time period information time1 from the sharing list. If the current time point is within the valid time period information, it can be determined that the target account can continue to log in on the client. The client then obtains the login private key identifier from the sharing list to obtain the login private key in the subsequent process.

[0150] If the current time exceeds the valid time period, the target account cannot log in on the client application, and the client application will output a message indicating that the target account has expired. Specifically, the login private key is set by script code based on the valid time period information. The script code calculates the storage duration of the encrypted information on the client application. If the storage duration reaches the valid time period, the script code shuffles the order of fields in the login private key, preventing the client application from obtaining the real login private key to log in to the target account.

[0151] In this embodiment, the account holder encrypts the login private key using a random number, the device private key, and the device public key of the account user. This prevents the account user from knowing the login password of the target account when logging in, thus improving the login security of the target account. Furthermore, the account user only needs to perform the login operation of the target account once to complete the login, simplifying the process for non-account holders to log in to the account holder's account.

[0152] In one embodiment, after the account holder sends the encrypted information, the target account, and the login private key identifier to the account user, if the account user needs to log in to the target account, it needs to obtain a random number from the account holder to encrypt the login private key. Specifically, the account user generates a target login request for the target account based on the login private key identifier and sends the target login request to the account holder. Upon receiving the target login request from the account user, the account holder parses the target login request to obtain the login private key identifier, retrieves the login private key identifier according to the target login request, obtains the random number corresponding to the login private key identifier, and sends the random number to the account user.

[0153] In this embodiment, when the account user needs to log in to the target account, a random number used to encrypt the login private key is sent to the account user to ensure that the account user can obtain the correct login private key to log in to the target account.

[0154] In one embodiment, user A, who holds the account, can cancel the sharing of the target account.

[0155] Specifically, when the account holder revokes the login permission of the user client for the target account, the authentication server sends a login interface to the user client. In other words, the authentication server forces the user client to log out of the target account, switching the user client from the target account's running interface to the login interface. Essentially, the user client displays the login interface sent by the authentication server. For example, the account holder displays a user client that can log in to the target account. When user A clicks the control represented on the account holder's interface, a "Cancel Sharing" button pops up. If user A clicks this button, it's considered that the account holder has detected the revocation of the user client's login permission for the target account. The account holder then sends a logout command for the target account to the authentication server, which in turn sends a login interface to the user client based on the logout command. In other words, the authentication server forcibly switches the user client's running interface for the target account to the login interface, thus forcibly logging the target account out of the user client.

[0156] In this embodiment, the user holding the account can cancel sharing of the target account, and the recipient will no longer be able to log in to the target account using the login private key, thus ensuring the target account owner's control over sharing the target account.

[0157] Based on the same inventive concept, this application also provides an account user terminal. The following is in conjunction with... Figure 8 The account application provided in this application will be described in detail.

[0158] Figure 8 This is a structural block diagram of an account holder according to an exemplary embodiment.

[0159] like Figure 8 As shown, 800 can be an electronic device for account login, and the account user 800 may include:

[0160] The first acquisition module 810 is used to acquire the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information when a login operation for the target account shared by the account holder is detected. The login private key identifier is used to indicate the identifier of the login private key of the target account.

[0161] The second acquisition module 820 is used to acquire the first device public key of the account holder and the device private key of the account user, and determine the first common key based on the first device public key and the device private key;

[0162] The third acquisition module 830 is used to obtain a first random number based on the login private key identifier, and to decrypt the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number.

[0163] The decryption module 840 is used to decrypt the first encrypted login private key according to the first random number to obtain the login private key, and to log in to the target account on the account user terminal according to the login private key.

[0164] In one embodiment, the account user terminal 800 is specifically used for:

[0165] Receive the first encrypted message, login private key identifier, and target account sent by the account holder, and construct a sharing list based on the login private key identifier and target account;

[0166] The shared list is stored in association with the first encrypted message;

[0167] Obtain the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information, including:

[0168] Based on the target account, retrieve the login private key identifier from the sharing list, and obtain the first encrypted information associated with the sharing list.

[0169] In one embodiment, the account user terminal 800 is specifically used for:

[0170] Receive the first encrypted information, login private key identifier, target account, and first valid time period information of the first encrypted information sent by the account holder;

[0171] A sharing list is constructed based on the login private key identifier, the target account, and the first valid time period information;

[0172] Based on the target account, retrieve the login private key identifier from the share list, including:

[0173] Based on the target account, retrieve the first valid time period information from the sharing list;

[0174] If the current time point falls within the first valid time period, retrieve the login private key identifier from the share list.

[0175] In one embodiment, the account user terminal 800 is specifically used for:

[0176] If the current time exceeds the first valid time period, output a message indicating that the target account has expired.

[0177] In one embodiment, the account user terminal 800 is specifically used for:

[0178] Identify the sharing terminal for the target account. The sharing terminal is used to instruct the device to share the target account to the user of the account.

[0179] When the sharing terminal is the account holder, obtain the first device public key of the account holder and the device private key of the account user.

[0180] In one embodiment, the account user terminal 800 is specifically used for:

[0181] In cases where the sharing terminal is not the account holder, obtain the second device public key of the sharing terminal and the device private key of the account user.

[0182] The second common key is determined based on the second device public key and the device private key, and the second encrypted login private key of the target account is obtained by decrypting the first ciphertext information based on the second common key.

[0183] Obtain the first random number generated by the account holder based on the login private key identifier, and obtain the second random number generated by the sharing terminal based on the login private key identifier;

[0184] The second encrypted login private key is decrypted using the first and second random numbers to obtain the login private key, and the target account is logged in on the account user's terminal using the login private key.

[0185] In one embodiment, the account user terminal 800 is specifically used for:

[0186] If a sharing operation targeting a target account is detected, the target terminal specified by the sharing operation is determined, and a third random number is generated;

[0187] The third encrypted login private key is obtained by encrypting the first encrypted login private key using the third random number.

[0188] Obtain the second public key of the target terminal, and determine the third common key based on the second public key and the device private key;

[0189] The third encrypted login private key is encrypted using the third common key to obtain the second ciphertext information, and the second ciphertext information, the target account, and the login private key identifier are sent to the target terminal.

[0190] In one embodiment, the account user terminal 800 is specifically used for:

[0191] Set a second valid time period for the third encrypted login private key;

[0192] Send the second encrypted information, the target account, the second valid time period information, and the login private key identifier to the target terminal.

[0193] In one embodiment, the account user terminal 800 is specifically used for:

[0194] Receive the first login request for the target account sent by the target terminal, and obtain the login private key identifier based on the first login request;

[0195] A third random number is obtained based on the login private key identifier, and a second login request for the target terminal to log in to the target account is generated based on the login private key identifier;

[0196] Send the second login request to the account holder and receive the first random number fed back by the account holder based on the second login request;

[0197] The first and third random numbers are sent to the target terminal so that the target terminal can obtain the login private key based on the first and third random numbers to log in to the target account.

[0198] In one embodiment, the account user terminal 800 is specifically used for:

[0199] Generate a target login request for the target account based on the login private key identifier, and send the target login request to the account holder.

[0200] The first random number returned by the account holder based on the target login request.

[0201] In one embodiment, the account user terminal 800 is specifically used for:

[0202] The authentication server displays the login interface sent by the authentication server. In this interface, the account holder cancels the account user's permission to log in to the target account. The authentication server then sends the login interface to the account user to log the account user out of the target account.

[0203] In this application embodiment, the account user terminal can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or other devices besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not specifically limit the scope of the application.

[0204] In this application embodiment, the account user can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system used.

[0205] The account client provided in this application embodiment can achieve... Figure 2-6 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0206] Based on the same inventive concept, this application also provides an account holder. The following is in conjunction with... Figure 8 The account holder provided in the embodiments of this application will be described in detail.

[0207] Figure 9 This is a structural block diagram of an account holder according to an exemplary embodiment.

[0208] like Figure 9 As shown, 900 can be an electronic device for account login, and the account holder 900 may include:

[0209] The determination module 910 is used to determine the account user specified by the sharing operation and generate a random number when a sharing operation targeting a target account in the account holder is detected.

[0210] The fourth acquisition module 920 is used to acquire the login private key of the target account in the account holder and the login private key identifier corresponding to the login private key, and to encrypt the login private key according to the random number to obtain the encrypted login private key;

[0211] The fifth acquisition module 930 is used to acquire the device public key of the account user and the device private key of the account holder, and determine the target common key based on the device public key and the device private key;

[0212] The encryption module 940 is used to encrypt the encrypted login private key according to the target common key to obtain ciphertext information, and send the ciphertext information, the target account, and the login private key identifier to the account user terminal.

[0213] In one embodiment, the account holder 900 is specifically used for:

[0214] Set a valid time period for the encrypted login private key;

[0215] Send the encrypted information, target account, valid time period information, and login private key identifier to the account user.

[0216] In one embodiment, the account holder 900 is specifically used for:

[0217] Receive the target login request for the target account sent by the account user;

[0218] Obtain the login private key identifier based on the target login request, and obtain the random number of the login private key corresponding to the encrypted login private key identifier;

[0219] Send a random number to the account holder.

[0220] In one embodiment, the account holder 900 is specifically used for:

[0221] If a permission cancellation operation is detected for the target account logged in by the user, a logout command for the target account is sent to the authentication server. The authentication server then sends a login interface to the user based on the logout command. The login interface is used to instruct the user to log out of the target account.

[0222] In this application embodiment, the account holder can be an electronic device or a component within an electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal or any other device besides a terminal. For example, the electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. It can also be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not impose specific limitations.

[0223] In this application embodiment, the account holder can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit the specific operating system used.

[0224] The account holder provided in this application embodiment can achieve... Figure 7 The various processes implemented in the method embodiments achieve the same technical effect, and will not be described again here to avoid repetition.

[0225] In some embodiments, such as Figure 10As shown, this application embodiment also provides an electronic device 1000, including a processor 1001 and a memory 1002. The memory 1002 stores a program or instructions that can run on the processor 1001. When the program or instructions are executed by the processor 1001, they implement the various steps of the above-described account sharing method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0226] It should be noted that the electronic devices in the embodiments of this application include the aforementioned mobile electronic devices and non-mobile electronic devices.

[0227] Figure 11 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of this application.

[0228] The electronic device 1100 includes, but is not limited to, components such as: radio frequency unit 1101, network module 1102, audio output unit 1103, input unit 1104, sensor 1105, display unit 1106, user input unit 1107, interface unit 1108, memory 1109, and processor 1110.

[0229] Those skilled in the art will understand that the electronic device 1100 may also include a power supply (such as a battery) for supplying power to various components. The power supply may be logically connected to the processor 1110 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system. Figure 11 The electronic device structure shown does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown, or combine certain components, or have different component arrangements, which will not be elaborated here. The processor 1110 is used to implement the steps in any of the above embodiments.

[0230] It should be understood that, in this embodiment, the input unit 1004 may include a graphics processing unit (GPU) 10041 and a microphone 10042. The GPU 10041 processes image data of still images or videos obtained by an image capture device (such as a camera) in video capture mode or image capture mode. The display unit 1106 may include a display panel 11061, which may be configured in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit 1107 includes at least one of a touch panel 11071 and other input devices 11072. The touch panel 11071 is also called a touch screen. The touch panel 11071 may include a touch detection device and a touch controller. Other input devices 11072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0231] The memory 1109 can be used to store software programs and various data. The memory 1109 may primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area may store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, the memory 1109 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DRRAM). The memory 808 in the embodiments of this application includes, but is not limited to, these and any other suitable types of memory.

[0232] Processor 1110 may include one or more processing units; in some embodiments, processor 1110 integrates an application processor and a modem processor, wherein the application processor mainly handles operations involving the operating system, user interface, and applications, and the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the modem processor may also not be integrated into processor 1110.

[0233] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described account sharing method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0234] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as a computer read-only memory, random access memory, magnetic disk, or optical disk.

[0235] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above-described account sharing method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0236] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0237] This application provides a computer program product that is stored in a storage medium and executed by at least one processor to implement the various processes of the account sharing method embodiment described above, and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0238] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0239] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0240] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for sharing accounts, characterized in that, include: When the account user detects a login operation for a target account shared by the account holder, it obtains the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information. The login private key identifier is used to indicate the identifier of the login private key of the target account. The account user obtains the first device public key and the device private key of the account holder, and determines the first common key based on the first device public key and the device private key; The account user obtains a first random number based on the login private key identifier, and decrypts the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number. The account user decrypts the first encrypted login private key based on the first random number to obtain the login private key, and logs into the target account based on the login private key.

2. The method according to claim 1, characterized in that, Before the account user obtains the first encrypted information shared by the account holder, the process also includes: Receive the first encrypted information, the login private key identifier, and the target account sent by the account holder, and construct a sharing list based on the login private key identifier and the target account; The sharing list is associated with and stored in relation to the first encrypted information; The step of obtaining the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information includes: Based on the target account, obtain the login private key identifier from the sharing list, and obtain the first encrypted information associated with the sharing list.

3. The method according to claim 2, characterized in that, The process of receiving the first encrypted information, the login private key identifier, and the target account sent by the account holder, and constructing a sharing list based on the login private key identifier and the target account, includes: Receive the first encrypted information, the login private key identifier, the target account, and the first valid time period information of the first encrypted information sent by the account holder; A sharing list is constructed based on the login private key identifier, the target account, and the first valid time period information; The step of obtaining the login private key identifier from the sharing list based on the target account includes: Based on the target account, obtain the first valid time period information from the sharing list; If the current time point falls within the first valid time period, the login private key identifier is obtained from the sharing list.

4. The method according to claim 3, characterized in that, After obtaining the first valid time period information from the sharing list based on the target account, the method further includes: If the current time exceeds the first valid time period, output a message indicating that the target account has expired.

5. The method according to claim 1, characterized in that, The account user terminal obtains the first device public key and the device private key of the account holder terminal, including: The sharing terminal of the target account is determined, and the sharing terminal is used to instruct the device to share the target account to the device using the account; When the sharing terminal is the account holder, the first device public key of the account holder and the device private key of the account user are obtained.

6. The method according to claim 5, characterized in that, After determining the sharing terminal of the target account, the method further includes: If the sharing terminal is not the account holder, obtain the second device public key of the sharing terminal and the device private key of the account user. A second common key is determined based on the second device public key and the device private key, and the first ciphertext information is decrypted based on the second common key to obtain the second encrypted login private key of the target account; The first random number generated by the account holder is obtained based on the login private key identifier, and the second random number generated by the sharing terminal is obtained based on the login private key identifier; The second encrypted login private key is decrypted based on the first random number and the second random number to obtain the login private key, and the target account is logged in on the account user terminal based on the login private key.

7. The method according to claim 1, characterized in that, After the account user decrypts the first ciphertext information using the first common key to obtain the first encrypted login private key of the target account, the method further includes: If a sharing operation targeting the target account is detected, the target terminal specified by the sharing operation is determined, and a third random number is generated; The first encrypted login private key is encrypted using the third random number to obtain the third encrypted login private key; Obtain the second public key of the target terminal, and determine the third common key based on the second public key and the device private key; The third encrypted login private key is encrypted using the third common key to obtain the second ciphertext information, and the second ciphertext information, the target account, and the login private key identifier are sent to the target terminal.

8. The method according to claim 7, characterized in that, Sending the second encrypted information, the target account, and the login private key identifier to the target terminal includes: Set a second valid time period for the third encrypted login private key; The second encrypted information, the target account, the second valid time period information, and the login private key identifier are sent to the target terminal.

9. The method according to claim 7, characterized in that, After sending the second encrypted information, the target account, and the login private key identifier to the target terminal, the method further includes: Receive the first login request for the target account sent by the target terminal, and obtain the login private key identifier according to the first login request; A third random number is obtained based on the login private key identifier, and a second login request for the target terminal to log in to the target account is generated based on the login private key identifier; The second login request is sent to the account holder, and the first random number fed back by the account holder based on the second login request is received. The first random number and the third random number are sent to the target terminal so that the target terminal can obtain the login private key based on the first random number and the third random number to log in to the target account.

10. The method according to claim 1, characterized in that The step of obtaining the first random number based on the login private key identifier includes: A target login request for the target account is generated based on the login private key identifier, and the target login request is sent to the account holder. Receive the first random number fed back by the account holder based on the target login request.

11. The method according to any one of claims 1-10, further comprising, after logging into the target account on the account user terminal using the login private key: The authentication server displays a login interface, wherein the account holder cancels the account user's permission to log in to the target account, and the authentication server sends the login interface to the account user to cause the account user to log out of the target account.

12. A method for sharing accounts, characterized in that, include: When the account holder detects a sharing operation targeting a target account in the account holder, it determines the account user specified by the sharing operation and generates a random number; The account holder obtains the login private key of the target account and the login private key identifier corresponding to the login private key from the account holder, and encrypts the login private key according to the random number to obtain the encrypted login private key; The account holder obtains the device public key and the device private key of the account user, and determines the target common key based on the device public key and the device private key; The account holder encrypts the encrypted login private key using the target common key to obtain ciphertext information, and sends the ciphertext information, the target account, and the login private key identifier to the account user.

13. The method according to claim 12, characterized in that, Sending the encrypted information, the target account, and the login private key identifier to the account user terminal includes: Set a valid time period for the encrypted login private key; The encrypted information, the target account, the valid time period information, and the login private key identifier are sent to the account user terminal.

14. The method according to claim 12, characterized in that, After sending the encrypted information, the target account, and the login private key identifier to the account user terminal, the process further includes: Receive the target login request for the target account sent by the account user terminal; Obtain the login private key identifier based on the target login request, and obtain a random number that encrypts the login private key corresponding to the login private key identifier; The random number is sent to the account holder.

15. The method according to any one of claims 12-14, characterized in that, After sending the encrypted information, the target account, and the login private key identifier to the account user terminal, the process further includes: Upon detecting a permission cancellation operation for the target account logged in by the account user, an exit command for the target account is sent to the authentication server. The authentication server then sends a login interface to the account user based on the exit command, and the login interface is used to instruct the account user to log out of the target account.

16. An account user terminal, characterized in that, include: The first acquisition module is used to acquire, upon detecting a login operation for a target account shared by an account holder, the first encrypted information shared by the account holder and the login private key identifier corresponding to the first encrypted information, wherein the login private key identifier is used to indicate the identifier of the login private key of the target account. The second acquisition module is used to acquire the first device public key of the account holder and the device private key of the account user, and determine the first common key based on the first device public key and the device private key; The third acquisition module is used to acquire a first random number based on the login private key identifier, and decrypt the first ciphertext information based on the first common key to obtain the first encrypted login private key of the target account. The first encrypted login private key is obtained by the account holder encrypting the login private key based on the first random number. The decryption module is used to decrypt the first encrypted login private key according to the random number to obtain the login private key, and to log in to the target account on the account user terminal according to the login private key.

17. An account holder terminal, characterized in that, include: The determination module is used to determine the account user specified by the sharing operation and generate a random number when a sharing operation for a target account in the account holder is detected. The fourth acquisition module is used to acquire the login private key of the target account in the account holder terminal and the login private key identifier corresponding to the login private key, and to encrypt the login private key according to the random number to obtain the encrypted login private key; The fifth acquisition module is used to acquire the device public key of the account user and the device private key of the account holder, and determine the target common key based on the device public key and the device private key; The encryption module is used to encrypt the encrypted login private key according to the target common key to obtain ciphertext information, and send the ciphertext information, the target account, and the login private key identifier to the account user terminal.

18. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the account sharing method as described in any one of claims 1-15.

19. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the account sharing method as described in any one of claims 1-15.

20. A computer program product, characterized in that, The program product is stored in a storage medium, and the program product is executed by at least one processor to implement the steps of the account sharing method as described in any one of claims 1-15.

Images