Password recovery method, system, electronic device and storage medium in offline environment

Abstract

The present disclosure provides a password recovery method, system, electronic device and storage medium in an offline environment. The method comprises: a first terminal generates a key pair corresponding to first password verification data in response to detecting that a user triggers a first password verification data input completion operation; the first terminal generates an encrypted verification two-dimensional code and a private key two-dimensional code according to the key pair and the first password verification data, and stores the encrypted verification two-dimensional code; a second terminal obtains the private key two-dimensional code from the first terminal and stores the private key two-dimensional code; the first terminal displays the encrypted verification two-dimensional code in response to detecting that a user triggers a password recovery operation; the second terminal obtains the encrypted verification two-dimensional code from the first terminal, and obtains second password verification data according to the private key two-dimensional code and the encrypted verification two-dimensional code; and the first terminal executes a password recovery operation in response to detecting that a user triggers a second password verification data input completion operation. A safe, convenient and anti-forgetting offline password recovery mechanism is realized.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, specifically to a password recovery method, system, electronic device, and storage medium in an offline environment. Background Technology

[0002] With the continuous improvement of computing power, traditional short passwords are no longer sufficient to meet security authentication requirements. To improve security, users have to set longer and more complex passwords, but this also brings the problem of difficulty in remembering them, resulting in frequent password forgetting. In some industry scenarios with high information security requirements, terminal devices are often offline and their usage cycle is not fixed, which further exacerbates the problem of password forgetting.

[0003] To address this issue, password hint questions have been introduced as a supplementary authentication method. This method requires users to pre-set one or more security questions and their answers during registration. When password recovery is needed, the user's identity can be verified by checking their answers to these questions. Because this technology can operate without a network connection and has some practical applications, it has found use in offline environments on PCs (personal computers) and in specific industries.

[0004] However, this technology has significant drawbacks in practical applications: First, users tend to choose answers that are easy to guess, and in today's highly transparent environment of personal information, attackers can easily obtain these answers through social engineering and other means; second, users may forget the exact answers they entered, especially for more complex or older information, which in turn affects the success rate of password recovery; finally, the entire mechanism relies on a static matching method for questions and answers and lacks dynamic updating capabilities, so once the answers are leaked, the security of identity verification will be completely compromised.

[0005] Therefore, it is necessary to propose a password recovery method in an offline environment to solve at least one of the above-mentioned technical problems. Summary of the Invention

[0006] Firstly, this disclosure provides a password recovery method for offline environments, including: In response to detecting that the user has triggered a first password verification data input completion operation, the first terminal generates a key pair corresponding to the first password verification data, wherein the key pair includes public key data and private key data; The first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code; The second terminal obtains the private key QR code from the first terminal and stores the private key QR code; In response to detecting that the user has triggered a password recovery operation, the first terminal displays the encrypted verification QR code; The second terminal obtains the encrypted verification QR code from the first terminal, and obtains the second password verification data based on the private key QR code and the encrypted verification QR code; The first terminal, in response to detecting that the user has triggered the second password verification data input completion operation, performs a password recovery operation.

[0007] In some optional implementations, the first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, including: The first terminal generates encrypted password verification data based on the first password verification data and the public key data; The first terminal converts the encrypted password verification data into the encrypted verification QR code according to a preset QR code conversion method; The first terminal converts the private key data into the private key QR code according to a preset QR code conversion method.

[0008] In some optional implementations, the first terminal, in response to detecting that the user has triggered the second password verification data input completion operation, performs a password recovery operation, including: In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal determines whether the first password verification data and the second password verification data match. If a match is found, the first terminal performs a password recovery operation.

[0009] In some optional implementations, the first terminal determines whether the first password verification data and the second password verification data match, including: The first terminal compares the first password verification data with the second password verification data; If the first password verification data and the second password verification data are the same, the first terminal determines that the first password verification data and the second password verification data match. If the first password verification data and the second password verification data are different, the first terminal determines that the first password verification data and the second password verification data do not match.

[0010] In some optional implementations, the first terminal converts the private key data into the private key QR code according to a preset QR code conversion method, including: The first terminal generates a first random string and stores the first random string; The first terminal converts the first random string and the private key data into the private key QR code according to a preset QR code conversion method.

[0011] In some optional implementations, after the first terminal detects that a user has triggered a password recovery operation, the method further includes: The first terminal generates third password verification data based on the first random string and the current time data; The second terminal parses the private key QR code to obtain a second random string; The second terminal generates fourth password verification data based on the second random string and the current time data; and Before the first terminal displays the encrypted verification QR code, the method further includes: In response to detecting that the user has triggered the fourth password verification data input completion operation, the first terminal determines whether the third password verification data and the fourth password verification data match; If a match is found, the first terminal displays the encrypted verification QR code.

[0012] Secondly, this disclosure provides a password recovery system for offline environments, the system comprising: A first terminal is configured to generate a key pair corresponding to the first password verification data in response to detecting that a user has triggered a first password verification data input completion operation, wherein the key pair includes public key data and private key data; The first terminal is further configured to generate an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and to store the encrypted verification QR code. The second terminal is configured to obtain the private key QR code from the first terminal and store the private key QR code. The first terminal is further configured to display the encrypted verification QR code in response to detecting that the user has triggered a password recovery operation; The second terminal is further configured to obtain the encrypted verification QR code from the first terminal, and obtain the second password verification data based on the private key QR code and the encrypted verification QR code; The first terminal is further configured to perform a password recovery operation in response to detecting that the user has triggered the second password verification data input completion operation.

[0013] Thirdly, this disclosure provides an electronic device, including: One or more processors; Storage device, on which one or more programs are stored, When the above-described one or more programs are executed by the above-described one or more processors, the above-described one or more processors implement the method as described in any embodiment of the first aspect of this disclosure.

[0014] Fourthly, this disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by one or more processors, implements the method described in any embodiment of the first aspect of this disclosure.

[0015] Fifthly, this disclosure provides a computer program product including a computer program / instructions that, when executed by a processor, implement the method described in any embodiment of the first aspect of this disclosure.

[0016] The offline password recovery method provided in the embodiments of this disclosure includes the following steps: A first terminal, in response to detecting a user triggering a first password verification data input completion operation, generates a key pair corresponding to the first password verification data, wherein the key pair includes public key data and private key data; the first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code; a second terminal obtains the private key QR code from the first terminal and stores it; the first terminal, in response to detecting a user triggering a password recovery operation, displays the encrypted verification QR code; the second terminal obtains the encrypted verification QR code from the first terminal, and obtains second password verification data based on the private key QR code and the encrypted verification QR code; the first terminal, in response to detecting a user triggering a second password verification data input completion operation, performs a password recovery operation. This disclosure generates an encrypted verification QR code by encrypting the first password verification data using a public key, and generates a private key QR code based on the corresponding private key, both stored on two different terminal devices. This facilitates the secure transfer of the private key QR code to a network-enabled device like a mobile phone for secure storage. Furthermore, storing the encrypted verification QR code and the private key QR code on separate terminal devices prevents the complete verification information from being obtained due to leakage from either side, significantly improving the security of the password recovery process. When password recovery is required, the user can decrypt the data in the encrypted verification QR code by scanning the private key QR code on the second terminal to obtain the second password verification data, which is then input into the first terminal to complete identity verification and password reset. This method eliminates the need for users to remember complex answers, avoiding authentication failures or security risks caused by forgotten or leaked answers in traditional security questions, and achieving a secure, convenient, and forgetful offline password recovery mechanism. Attached Figure Description

[0017] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the invention. In the drawings: Figure 1 This is a system architecture diagram in which an embodiment of the password recovery method in an offline environment according to this disclosure can be applied; Figure 2 This is a flowchart of an embodiment of a password recovery method in an offline environment according to the present disclosure; Figure 3 This is a flowchart of another embodiment of the password recovery method in an offline environment according to the present disclosure; Figure 4 This is a schematic diagram of a structure of an embodiment of a password recovery system in an offline environment according to the present disclosure; Figure 5 This is a schematic diagram of the structure of a computer system suitable for implementing embodiments of the present disclosure. Detailed Implementation

[0018] The present disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] Figure 1 An exemplary system architecture 100 is shown, which can be applied to embodiments of password recovery methods, systems, electronic devices, and storage media in an offline environment.

[0021] like Figure 1 As shown, the system architecture 100 may include a first terminal device 101, a second terminal device 102, a network 103, and a server 104. The first terminal device 101 is in an offline state, the second terminal device 102 is in an online state, and the network 103 provides a communication link between the second terminal device 102 and the server 104. The network 103 may include various communication connection types, such as wired communication links, wireless communication links, etc.

[0022] Users can use the second terminal device 102 to interact with the server 104 via the network 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101 and the second terminal device 102, such as voice interaction applications, video conferencing applications, short video social applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0023] The first terminal device 101 and the second terminal device 102 can be either hardware or software. When the first terminal device 101 and the second terminal device 102 are hardware, they can be various electronic devices with microphones and speakers, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), portable computers, and desktop computers, etc. When the first terminal device 101 and the second terminal device are software, they can be installed in the electronic devices listed above. They can be implemented as multiple software programs or software modules (e.g., responding to the detection of a user triggering a first password verification data input to complete the operation), or they can be implemented as a single software program or software module. No specific limitations are made here.

[0024] Server 104 can be a server that provides various services. For example, it can be a backend server that allows the second terminal device 102 to obtain an encrypted verification QR code from the first terminal device 101, and then obtain second password verification data based on the private key QR code and the encrypted verification QR code. The backend server can process the private key QR code and the encrypted verification QR code accordingly to obtain the second password verification data.

[0025] In some cases, the password recovery method in an offline environment provided by this disclosure can be jointly executed by the first terminal device 101, the second terminal device 102, and the server 104. For example, the step of "generating a key pair corresponding to the first password verification data in response to detecting that the user has triggered a first password verification data input completion operation" can be executed by the first terminal device 101, the step of "obtaining the private key QR code from the first terminal" can be executed by the second terminal device 102, and the step of "storing the private key QR code" can be executed by the server 104. This disclosure does not limit this. Correspondingly, the password recovery system in an offline environment can also be set up separately in the first terminal device 101, the second terminal device 102, and the server 104.

[0026] In some cases, the password recovery method in an offline environment provided in this disclosure can be executed by the first terminal device 101 and the second terminal device 102. Correspondingly, the password recovery system in an offline environment can also be set in the first terminal device 101 and the second terminal device 102. In this case, the system architecture 100 may not include the server 104.

[0027] It should be noted that server 104 can be either hardware or software. When server 104 is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or as a single server. When server 104 is software, it can be implemented as multiple software programs or software modules (for example, used to provide distributed services), or as a single software program or software module. No specific limitations are made here.

[0028] It should be understood that Figure 1 The number of first terminal devices, second terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of first terminal devices, second terminal devices, networks, and servers can be included.

[0029] All information, data, and signals disclosed herein are authorized by the user or by all parties, and the collection, use, and processing of such data comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0030] Continue to refer to Figure 2 , Figure 2 The flowchart 200 illustrates an embodiment of a password recovery method in an offline environment according to the present disclosure. Figure 2 The offline password recovery method shown can be applied to Figure 1 The first terminal device and the second terminal device are shown in the figure. The process 200 includes at least the following steps 201-206.

[0031] Step 201: In response to detecting that the user has triggered the first password verification data input completion operation, the first terminal generates a key pair corresponding to the first password verification data.

[0032] In this embodiment, the first terminal can refer to a computing device in an offline state. For example, the first terminal device 101 can specifically be a personal computer (PC) or a mobile terminal device, such as a smartphone or tablet computer.

[0033] The first terminal can have various communication client applications installed, such as voice interaction applications, video conferencing applications, short video social applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0034] The first terminal usually has local data processing capabilities, but in actual use cases, it is limited by network connectivity and cannot rely on online services to complete authentication or password recovery operations.

[0035] Password recovery operations can be performed on various applications or software installed on the first terminal.

[0036] For example, when a user forgets their login password for the operating system of the first terminal, they can restore access by using the password recovery method disclosed herein. For specific applications installed on the first terminal (such as email clients, database management systems, etc.), the user can also use the password recovery method disclosed herein to recover the password without relying on a network connection or online service.

[0037] Specifically, users can enter first password verification data on the password verification input interface of the first terminal. The password verification input interface may refer to the interface where users configure one or more security questions and corresponding answers during the account registration or password setting stage on the first terminal.

[0038] The first password verification data can refer to the plaintext data of the answers to one or more security questions.

[0039] When performing a password recovery operation, users can enter the answers to one or more security questions on the password recovery interface of the first terminal to verify the authenticity of their identity.

[0040] Here, once the user completes the input of the first password verification data, the first password verification data input completion operation can be triggered.

[0041] The "first password verification data input completion" operation refers to the confirmation operation triggered after the user completes the first password verification data entry on the password verification input interface. Specifically, this may include clicking the "Confirm" button, performing a preset gesture, selecting a completion option, or other system-defined end input actions. This operation is used to notify the first terminal that the current password verification data input process has been completed and the key pair generation process can be started.

[0042] At this time, the first terminal can generate a key pair corresponding to the first password verification data in response to the detection that the user has triggered the first password verification data input completion operation.

[0043] A key pair is used to encrypt and decrypt the first cryptographic verification data, wherein the key pair includes public key data and private key data.

[0044] Here, various known encryption techniques can be used to generate key pairs, and no specific restrictions are imposed.

[0045] In addition, considering the size limitations of the content transmitted by QR codes, for example, Chinese cryptographic algorithms can be used to generate shorter key pairs.

[0046] Step 202: The first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code.

[0047] In this embodiment, the encrypted verification QR code can refer to the result of encoding the encrypted data generated after encrypting the first password verification data into a QR code, and the encrypted verification QR code can be stored in the first terminal.

[0048] A private key QR code can refer to the result of encoding the private key data used for decryption into a QR code. The private key QR code can be stored in a second terminal, and after storage on the second terminal is completed, the private key QR code can be destroyed on the first terminal to prevent attackers from directly obtaining the private key QR code on the second terminal to decrypt the encrypted verification QR code.

[0049] Specifically, step 202 may include the following A1-A3.

[0050] A1, the first terminal generates encrypted password verification data based on the first password verification data and the public key data.

[0051] In this embodiment, the first terminal can use public key data to encrypt the first password verification data to generate encrypted password verification data. The encrypted password verification data can be the ciphertext data corresponding to the first password verification data encrypted with public key data.

[0052] A2, the first terminal converts the encrypted password verification data into an encrypted verification QR code according to the preset QR code conversion method.

[0053] In this embodiment, the first terminal can convert encrypted password verification data into encrypted verification QR codes according to various known QR code conversion methods, without any specific restrictions.

[0054] A3, the first terminal converts the private key data into a private key QR code according to the preset QR code conversion method.

[0055] In this embodiment, the first terminal can convert private key data into a private key QR code according to various known QR code conversion methods, without any specific restrictions.

[0056] Step 203: The second terminal obtains the private key QR code from the first terminal and stores the private key QR code.

[0057] In this embodiment, after generating the private key QR code, the first terminal can display the private key QR code on the first terminal so that the second terminal can obtain the private key QR code from the first terminal.

[0058] The second terminal can refer to a computing device with strong networking capabilities. For example, the second terminal device 102 can be a personal computer or a mobile terminal device, such as a smartphone or tablet computer.

[0059] The second terminal and the first terminal can be different terminal devices.

[0060] The second terminal can also be equipped with various communication client applications, such as voice interaction applications, video conferencing applications, short video social applications, web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc., to facilitate information interaction and operation for users.

[0061] The second terminal not only has local data processing capabilities, but can also interact with servers via the network, thereby supporting a variety of online services and functions.

[0062] In addition, the second terminal is usually equipped with a camera or other image acquisition device, which can be used to scan QR codes.

[0063] In this embodiment, the second terminal can scan and obtain the private key QR code using a camera, thereby obtaining the private key QR code from the first terminal. After obtaining the private key QR code, the second terminal can store it.

[0064] In this way, since the private key QR code and the encrypted verification QR code are stored on two different terminal devices, the complete verification information can be obtained due to the leakage of the private key QR code or the encrypted verification QR code by any terminal device, thus significantly improving the security of the password recovery process.

[0065] In some alternative implementations, considering the risk of loss or damage to the second terminal device, the private key QR code can be securely stored in a cloud service platform to prevent permanent loss.

[0066] Specifically, after completing identity verification using the standard OAuth2.0 authentication protocol, users upload and store their private key QR code to a trusted cloud service platform. These trusted cloud service platforms provide standardized OAuth2 authentication interfaces, thus enabling fast and secure cloud storage through these mature authentication mechanisms. In this way, even if a user switches to a second device, they can log back into their original account, recover the private key QR code from the cloud, and then complete the password recovery process.

[0067] In other alternative implementations, users can also build a local, independent account and key management system to securely store private key QR codes, ensuring the security of the private key QR codes in a local environment. This is suitable for scenarios with high privacy protection requirements or that do not rely on cloud services.

[0068] Step 204: In response to detecting that the user has triggered a password recovery operation, the first terminal displays an encrypted verification QR code.

[0069] In this embodiment, when a user needs to perform a password recovery operation, an encrypted verification QR code can be displayed on the password recovery operation interface of the second terminal.

[0070] Here, users can trigger a password recovery operation, which can refer to the user's confirmation of the need to recover the password triggered on the password recovery operation interface.

[0071] Specifically, this may include clicking the "Confirm Password Recovery" button, performing a preset gesture, selecting the "Confirm Password Recovery" option, or other confirmation password recovery actions defined by the first terminal. This operation is used to notify the first terminal user that the password needs to be recovered, and can initiate the subsequent password recovery process.

[0072] Step 205: The second terminal obtains the encrypted verification QR code from the first terminal, and obtains the second password verification data based on the private key QR code and the encrypted verification QR code.

[0073] In this embodiment, after the first terminal displays the encrypted verification QR code, the second terminal can obtain the encrypted verification QR code from the first terminal. The second terminal can scan and obtain the encrypted verification QR code through a camera, thereby obtaining the encrypted verification QR code from the first terminal.

[0074] Meanwhile, the first terminal can obtain a private key QR code from a local or cloud service platform, and then decrypt the encrypted verification QR code using the private key QR code to obtain the second password verification data.

[0075] The second password verification data can refer to the plaintext data obtained by the user decrypting the encrypted verification data in the encrypted verification QR code.

[0076] Step 206: In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal performs a password recovery operation.

[0077] In this embodiment, after obtaining the second password verification data, the user can enter the answers to one or more security questions (the second password verification data) on the password recovery interface of the first terminal to confirm the authenticity of the user's identity.

[0078] Specifically, once the user completes the input of the second password verification data, the second password verification data input completion operation can be triggered.

[0079] The "Second Password Verification Data Input Completed" operation can refer to the user's confirmation of the completion of the second password verification data input triggered on the password recovery operation interface.

[0080] Specifically, this may include clicking the "Confirm" button, performing a preset gesture, selecting the completion option, or other end input actions defined by the first terminal. This operation is used to notify the first terminal that the second password verification data input process has been completed and that subsequent password recovery operations can be initiated.

[0081] In some alternative implementations, step 206 may include the following B1-B2.

[0082] B1, the first terminal responds to the detection that the user has triggered the second password verification data input completion operation, and determines whether the first password verification data and the second password verification data match.

[0083] In this embodiment, the first terminal needs to verify the input second password verification data to confirm whether the second password verification data is consistent with the originally stored first password verification data.

[0084] The first terminal can determine the authenticity of the user's identity by comparing the contents of the two, and decide whether to allow the subsequent password recovery operation to be performed accordingly.

[0085] Specifically, the first terminal compares the first password verification data and the second password verification data. If the first password verification data and the second password verification data are the same, the first terminal determines that the first password verification data and the second password verification data match. If the first password verification data and the second password verification data are different, the first terminal determines that the first password verification data and the second password verification data do not match.

[0086] Here, if the first password verification data and the second password verification data are the same, it indicates that the user can provide identity verification information that matches the information provided during registration, thereby confirming the authenticity of their identity. Based on this, the first terminal can determine that the user's identity verification is successful.

[0087] If the first password verification data and the second password verification data are different, it indicates that the user cannot provide the identity verification information that matches the information provided during registration, and therefore the authenticity of the user's identity cannot be confirmed. Based on this, the first terminal can determine that the user's identity verification has failed.

[0088] B2, if a match is found, the first terminal performs a password recovery operation.

[0089] When a user's authentication is successful, the first terminal can perform a password recovery operation. When a user's authentication fails, the first terminal can refuse to perform the subsequent password recovery operation and prompt the user that the password verification data is incorrect.

[0090] In this embodiment, the password recovery operation can refer to allowing a user to reset a new access password after authentication is completed, in order to replace the original forgotten or unusable password.

[0091] In this disclosure, in order to further enhance the security of the password recovery process, a secondary decryption protection mechanism can be introduced into the decryption process.

[0092] Continue to refer to Figure 3 , Figure 3 The flowchart 300 illustrates another embodiment of the password recovery method in an offline environment according to the present disclosure. Figure 3 The offline password recovery method shown can be applied to Figure 1 The first terminal device and the second terminal device are shown in the figure. The process 300 includes at least the following steps 301-310.

[0093] Step 301: In response to detecting that the user has triggered the first password verification data input completion operation, the first terminal generates a key pair corresponding to the first password verification data.

[0094] The key pair includes public key data and private key data.

[0095] Step 302: The first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code.

[0096] Step 303: The second terminal obtains the private key QR code from the first terminal and stores the private key QR code.

[0097] Specifically, step 303 may include the following C1-C4.

[0098] C1, the first terminal generates encrypted password verification data based on the first password verification data and the public key data.

[0099] C2, the first terminal converts the encrypted password verification data into an encrypted verification QR code according to the preset QR code conversion method.

[0100] The specific implementation and technical effects of steps 301, 302, C1 and C2 can be found in steps 201-203, and will not be elaborated here.

[0101] C3, the first terminal generates and stores the first random string.

[0102] In this embodiment, the first terminal can generate a first random string, which can be used as a key parameter to enhance security during the password recovery process and to generate additional authentication information (or a secondary protection password).

[0103] C4, the first terminal converts the first random string and private key data into a private key QR code according to the preset QR code conversion method.

[0104] In this embodiment, the first random string and the private key data can be combined to convert them into a private key QR code.

[0105] Specifically, the first random string and the private key data can be concatenated or encrypted in a structured format to generate a data body containing dual verification information. Then, the first terminal converts the data body containing the first random string and the private key data into a private key QR code.

[0106] The private key QR code generated in this way not only contains the private key data used for decryption, but also incorporates a first random string, which serves as a key factor for generating a secondary protection password.

[0107] When using this QR code to recover a password, users must provide both the private key information and the first random string to complete the full authentication process, thereby achieving a higher level of security protection.

[0108] Step 304: In response to detecting that the user has triggered a password recovery operation, the first terminal generates third password verification data based on the first random string and the current time data.

[0109] The following content will first introduce the Time-based One-Time Password (TOTP) technology.

[0110] One-time cipher technology based on time synchronization relies on a shared key and current time data to generate short-term valid dynamic ciphers. This mechanism requires a certain degree of time synchronization between the first and second terminal devices to ensure that both generate the same one-time cipher value within the same time window.

[0111] When a user attempts to recover a password or perform a sensitive operation, the first terminal device generates a one-time password based on the same input parameters (such as a shared key and the current timestamp) and compares it with the one-time password value generated by the second terminal device. Only when the two match is the authentication considered successful.

[0112] In this embodiment, the first terminal can use time-based one-time password (TOTP) technology to generate third password verification data using a first random string and current time data.

[0113] Third-party password verification data can be used as a one-time verification value to enhance the authentication strength during password recovery and prevent replay attacks or unauthorized reuse.

[0114] For example, the first terminal can use the HMAC-SHA256 algorithm to use the first random string as the shared key, combined with the current timestamp (e.g., with a time window of 30 seconds), to generate a 6-digit dynamic verification code as the third password verification data.

[0115] Users need to enter this verification code when recovering their passwords. The process can only continue after the first terminal device verifies the code and confirms that the verification code matches.

[0116] Step 305: The second terminal parses the private key QR code to obtain the second random string.

[0117] In this embodiment, the second terminal can parse the private key QR code to obtain the second random string in the private key QR code. The second random string can be the same as or different from the first random string.

[0118] Step 306: The second terminal generates the fourth password verification data based on the second random string and the current time data.

[0119] Here, the second terminal can also use time-synchronized one-time password technology to generate the fourth password verification data with the second random string and the current time data.

[0120] The fourth password verification data can be compared with the third password verification data to verify the authenticity of the user's identity and the legality of the operation.

[0121] Step 307: In response to detecting that the user has triggered the fourth password verification data input completion operation, the first terminal determines whether the third password verification data and the fourth password verification data match.

[0122] After obtaining the fourth password verification data, the user can enter the fourth password verification data in the password recovery interface of the first terminal. After the user completes the input of the fourth password verification data, the input completion operation of the fourth password verification data can be triggered.

[0123] The second password verification data input completion operation can refer to the operation triggered by the user on the password recovery operation interface of the first terminal to confirm the fourth password verification data input completion.

[0124] Specifically, this may include clicking the "Confirm" button, performing a preset gesture, selecting the completion option, or other end input actions defined by the first terminal device. This operation is used to notify the first terminal that the fourth password verification data input process has been completed and that subsequent password recovery operations can be initiated.

[0125] Specifically, the first terminal compares the third password verification data with the fourth password verification data. If the third password verification data and the fourth password verification data are the same, the first terminal determines that the third password verification data and the fourth password verification data match. If the third password verification data and the fourth password verification data are different, the first terminal determines that the third password verification data and the fourth password verification data do not match.

[0126] If the third password verification data is the same as the fourth password verification data, it indicates that the verification information provided by the user is an identity credential dynamically generated based on the current time information and matched with the first terminal device, thus confirming the authenticity of their identity. The first terminal then determines that the user's identity verification is successful.

[0127] If the third password verification data is different from the fourth password verification data, it indicates that the verification information provided by the user is not dynamically generated based on the current time information, or is not an identity credential generated by combining the correct first random string. Therefore, the authenticity of the user's identity cannot be confirmed. In this case, the first terminal determines that the user's identity verification has failed.

[0128] Step 308: If a match is found, the first terminal displays an encrypted verification QR code.

[0129] In this embodiment, when the first terminal determines that the third password verification data and the fourth password verification data match, the first terminal determines that the user's identity verification is successful. The first terminal then displays the encrypted verification QR code on the password recovery interface and executes steps 205-206.

[0130] In this embodiment, when the first terminal determines that the third password verification data and the fourth password verification data do not match, the first terminal determines that the user authentication has failed and refuses to perform the subsequent password recovery operation.

[0131] Step 309: The second terminal obtains the encrypted verification QR code from the first terminal, and obtains the second password verification data based on the private key QR code and the encrypted verification QR code.

[0132] Step 310: In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal performs a password recovery operation.

[0133] The specific implementation process and technical effects of steps 309 and 310 can be found in steps 205 and 206, and will not be elaborated here.

[0134] The offline password recovery method provided in the embodiments of this disclosure includes the following steps: A first terminal, in response to detecting a user triggering a first password verification data input completion operation, generates a key pair corresponding to the first password verification data, wherein the key pair includes public key data and private key data; the first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code; a second terminal obtains the private key QR code from the first terminal and stores it; the first terminal, in response to detecting a user triggering a password recovery operation, displays the encrypted verification QR code; the second terminal obtains the encrypted verification QR code from the first terminal, and obtains second password verification data based on the private key QR code and the encrypted verification QR code; the first terminal, in response to detecting a user triggering a second password verification data input completion operation, performs a password recovery operation. This disclosure generates an encrypted verification QR code by encrypting the first password verification data using a public key, and generates a private key QR code based on the corresponding private key, both stored on two different terminal devices. This facilitates the secure transfer of the private key QR code to a network-enabled device like a mobile phone for storage. Furthermore, storing the encrypted verification QR code and the private key QR code on separate terminal devices prevents the complete verification information from being obtained due to leakage from either side, significantly improving the security of the password recovery process. When password recovery is required, the user can scan the private key QR code to decrypt the data in the encrypted verification QR code, obtain the second password verification data, and input it into the first terminal device to complete identity verification and password reset. This method eliminates the need for users to remember complex answers, avoiding authentication failures or security risks caused by forgotten or leaked answers in traditional security questions, and achieving a secure, convenient, and forgetful offline password recovery mechanism.

[0135] Further reference Figure 4 As an implementation of the methods shown in the above figures, this disclosure provides an embodiment of a password recovery system in an offline environment. This system embodiment is similar to... Figure 2 Corresponding to the method embodiment shown, the system can be specifically applied to a first terminal device and a second terminal device.

[0136] like Figure 4As shown, the password recovery system in an offline environment of this embodiment includes a first terminal 401 and a second terminal 402. The first terminal 401 is configured to generate a key pair corresponding to the first password verification data in response to detecting a user triggering a first password verification data input completion operation. The key pair includes public key data and private key data. The first terminal 401 is further configured to generate an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and store the encrypted verification QR code. The second terminal 402 is configured to obtain the private key QR code from the first terminal and store it. The first terminal 401 is further configured to display the encrypted verification QR code in response to detecting a user triggering a password recovery operation. The second terminal 402 is further configured to obtain the encrypted verification QR code from the first terminal and obtain second password verification data based on the private key QR code and the encrypted verification QR code. The first terminal 401 is further configured to perform a password recovery operation in response to detecting a user triggering a second password verification data input completion operation.

[0137] In some alternative implementations, the first terminal 401 is further configured as follows: The first terminal generates encrypted password verification data based on the first password verification data and the public key data; The first terminal converts the encrypted password verification data into an encrypted verification QR code according to a preset QR code conversion method; The first terminal converts the private key data into a private key QR code according to a preset QR code conversion method.

[0138] In some alternative implementations, the first terminal 401 is further configured as follows: The first terminal responds to the detection that the user has triggered the second password verification data input completion operation and determines whether the first password verification data and the second password verification data match. If a match is found, the first terminal performs a password recovery operation.

[0139] In some alternative implementations, the first terminal 401 is further configured as follows: The first terminal compares the first password verification data with the second password verification data; If the first password verification data and the second password verification data are the same, the first terminal determines that the first password verification data and the second password verification data match. If the first password verification data and the second password verification data are different, the first terminal determines that the first password verification data and the second password verification data do not match.

[0140] In some alternative implementations, the first terminal 401 is further configured as follows: The first terminal generates and stores the first random string; The first terminal converts the first random string and private key data into a private key QR code according to a preset QR code conversion method.

[0141] In some alternative implementations, after the first terminal detects that the user has triggered a password recovery operation, the system 400 further includes: The first terminal 401 is further configured to generate third password verification data based on the first random string and the current time data; The second terminal 402 is further configured to parse the private key QR code to obtain a second random string; The second terminal 402 is further configured to generate fourth password verification data based on the second random string and the current time data; and Before the first terminal displays the encrypted verification QR code, the system also includes: The first terminal 401 is further configured to determine whether the third password verification data and the fourth password verification data match in response to detecting that the user has triggered a fourth password verification data input completion operation. If a match is found, the first terminal 401 is further configured to display an encrypted verification QR code.

[0142] It should be noted that the implementation details and technical effects of each unit in the password recovery device in the offline environment provided by the embodiments of this disclosure can be referred to the descriptions of other embodiments in this disclosure, and will not be repeated here.

[0143] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer system 500 suitable for implementing the terminal device of this disclosure. Figure 5 The computer system 500 shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0144] like Figure 5 As shown, the computer system 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the operation of the computer system 500. The processing device 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0145] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows computer system 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 A computer system 500 with various electronic devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0146] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0147] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0148] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0149] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the following functions: Figure 2 The embodiments shown and their alternative implementations illustrate password recovery methods in an offline environment.

[0150] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and Python, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0152] The units described in the embodiments of this disclosure can be implemented in software or in hardware. The names of the units are not necessarily limiting in certain circumstances; for example, a first terminal can also be described as a "first terminal device".

[0153] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A password recovery method in an offline environment, characterized in that, The method includes: In response to detecting that the user has triggered a first password verification data input completion operation, the first terminal generates a key pair corresponding to the first password verification data, wherein the key pair includes public key data and private key data; The first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and stores the encrypted verification QR code; The second terminal obtains the private key QR code from the first terminal and stores the private key QR code; In response to detecting that the user has triggered a password recovery operation, the first terminal displays the encrypted verification QR code; The second terminal obtains the encrypted verification QR code from the first terminal, and obtains the second password verification data based on the private key QR code and the encrypted verification QR code; The first terminal, in response to detecting that the user has triggered the second password verification data input completion operation, performs a password recovery operation; The first terminal generates an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, including: The first terminal generates encrypted password verification data based on the first password verification data and the public key data; The first terminal converts the encrypted password verification data into the encrypted verification QR code according to a preset QR code conversion method; The first terminal converts the private key data into the private key QR code according to a preset QR code conversion method; In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal performs a password recovery operation, including: In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal determines whether the first password verification data and the second password verification data match. If a match is found, the first terminal performs a password recovery operation.

2. The method according to claim 1, characterized in that, The first terminal determines whether the first password verification data and the second password verification data match, including: The first terminal compares the first password verification data with the second password verification data; If the first password verification data and the second password verification data are the same, the first terminal determines that the first password verification data and the second password verification data match. If the first password verification data and the second password verification data are different, the first terminal determines that the first password verification data and the second password verification data do not match.

3. The method according to claim 1, characterized in that, The first terminal converts the private key data into the private key QR code according to a preset QR code conversion method, including: The first terminal generates a first random string and stores the first random string; The first terminal converts the first random string and the private key data into the private key QR code according to a preset QR code conversion method.

4. The method according to claim 3, characterized in that, After the first terminal detects that the user has triggered a password recovery operation, the method further includes: The first terminal generates third password verification data based on the first random string and the current time data; The second terminal parses the private key QR code to obtain a second random string; The second terminal generates fourth password verification data based on the second random string and the current time data; and Before the first terminal displays the encrypted verification QR code, the method further includes: In response to detecting that the user has triggered the fourth password verification data input completion operation, the first terminal determines whether the third password verification data and the fourth password verification data match; If a match is found, the first terminal displays the encrypted verification QR code.

5. A password recovery system for offline environments, characterized in that, The system includes: A first terminal is configured to generate a key pair corresponding to the first password verification data in response to detecting that a user has triggered a first password verification data input completion operation, wherein the key pair includes public key data and private key data; The first terminal is further configured to generate an encrypted verification QR code and a private key QR code based on the key pair and the first password verification data, and to store the encrypted verification QR code. The second terminal is configured to obtain the private key QR code from the first terminal and store the private key QR code. The first terminal is further configured to display the encrypted verification QR code in response to detecting that the user has triggered a password recovery operation; The second terminal is further configured to obtain the encrypted verification QR code from the first terminal, and obtain second password verification data based on the private key QR code and the encrypted verification QR code; The first terminal is further configured to perform a password recovery operation in response to detecting that the user has triggered the second password verification data input completion operation; The first terminal is further configured as follows: The first terminal generates encrypted password verification data based on the first password verification data and the public key data; The first terminal converts the encrypted password verification data into the encrypted verification QR code according to a preset QR code conversion method; The first terminal converts the private key data into the private key QR code according to a preset QR code conversion method; In response to detecting that the user has triggered the second password verification data input completion operation, the first terminal determines whether the first password verification data and the second password verification data match. If a match is found, the first terminal performs a password recovery operation.

6. An electronic device, characterized in that, include: One or more processors; Storage device, on which one or more programs are stored, When one or more programs are executed by one or more processors, the one or more processors implement the method as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, It stores a computer program thereon, wherein the computer program, when executed by one or more processors, implements the method as claimed in any one of claims 1-4.

8. A computer program product, characterized in that, Includes a computer program / instruction that, when executed by a processor, implements the method as described in any one of claims 1-4.

Images