Method and system for resetting password of safety equipment and electronic equipment

Abstract

The invention provides a security device password resetting method and system and an electronic device, which are applied to a client terminal, the client terminal is respectively connected with a security device and a service terminal, authentication keys are preset in the security device and the service terminal, and the method comprises the following steps: acquiring a device identifier from the security device, sending the device identifier and a resetting instruction to the service terminal for authentication, the reset instruction is used for driving the service terminal to initiate reset after authentication is completed; obtaining an authentication result, if the authentication is passed, obtaining a first check number from the security device, sending the first check number to the service terminal, and indicating the service terminal to encrypt the first check number by using the authentication key to obtain an encrypted number; sending the encrypted number to the security device, and instructing the security device to decrypt the encrypted number by using the authentication key to obtain a second check number; and if the second check number is consistent with the first check number, obtaining a reset password, and returning the reset password to the security device. When online password resetting is realized, the security in the password resetting process is improved.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method, system and electronic device for resetting passwords for security equipment. Background Technology

[0002] Currently, when logging into a small security device via a client terminal, a password is required to use the device. If the holder forgets the password, it needs to be reset. However, resetting a password usually requires going offline to a designated institution, which is very inconvenient. Therefore, there is currently no secure and convenient way to reset the password for small security devices. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method, system and electronic device for resetting passwords for security devices, so as to realize online password reset and improve the efficiency of password reset.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: A method for resetting a password for a security device, applied to a client terminal, wherein the client terminal is connected to both a security device and a service terminal, and the security device and the service terminal are pre-configured with authentication keys, the method comprising: The device identifier is obtained from the security device, and the device identifier and reset command are sent to the service terminal for authentication. The reset command is used to drive the service terminal to initiate a reset after the authentication is completed. Obtain the authentication result. If the authentication is successful, obtain the first verification number from the security device, send the first verification number to the service terminal, and instruct the service terminal to encrypt the first verification number using the authentication key to obtain the encrypted number. The encrypted number is sent to the security device, and the security device is instructed to decrypt the encrypted number using the authentication key to obtain the second verification number; If the second checksum matches the first checksum, then the reset password is obtained and returned to the security device.

[0005] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A method for resetting a password for a security device is applied to a service terminal connected to a client terminal; the client terminal is connected to the security device to obtain a device identifier; the security device and the service terminal have pre-installed authentication keys; the method includes: The device identifier and reset command sent by the client terminal are obtained for authentication, and a reset is initiated after authentication. The device is instructed to obtain the first verification number and provide feedback. Obtain the first verification number, and encrypt the first verification number using the authentication key to obtain the encrypted number; The encrypted number is sent to the security device, and the security device is instructed to decrypt the encrypted number using the authentication key to obtain the second verification number; If the second checksum matches the first checksum, the client terminal is instructed to obtain and return the reset password, and the reset password is returned to the security device.

[0006] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: A security device password reset system includes a service terminal, a client terminal, and a security device; the client terminal is connected to both the security device and the service terminal. The client terminal is used to obtain identity information and send the identity information to the service terminal for authentication; The service terminal is used to receive the identity information and perform authentication. If the authentication is successful, it initiates the password reset process and obtains the first verification number from the security device. The security device is used to generate the first verification number and send the first verification number to the service terminal; The service terminal is used to encrypt the first verification number using the authentication key to obtain an encrypted number, and then sends the encrypted number to the security device; The security device is also used to obtain the encrypted number, decrypt the encrypted number using the authentication key to obtain a second verification number, and if the second verification number is consistent with the first verification number, then return a result allowing password reset.

[0007] To solve the above-mentioned technical problems, another technical solution adopted by the present invention is as follows: An electronic device includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the security device password reset method described above.

[0008] The beneficial effects of this invention are as follows: The client terminal, after obtaining the device identifier from the security device, sends the device identifier and reset command to the service terminal for authentication. The service terminal's authentication ensures that the operator resetting the password is the legitimate holder of the security device. Then, by obtaining the authentication result, if authentication is successful, a first verification number is obtained from the security device, sent to the service terminal, and the service terminal is instructed to encrypt the first verification number using the authentication key to obtain an encrypted number. This encrypted number is then sent to the security device, and the security device is instructed to decrypt the encrypted number using the authentication key to obtain a second verification number. If the second verification number matches the first verification number, the reset password is obtained and returned to the security device. Through the method of this application, by instructing the service terminal to encrypt the first verification number using the authentication key and instructing the security device to decrypt the encrypted number using the authentication key to obtain the second verification number, and verifying whether the obtained second verification number matches the first verification number using the same authentication key, if they match, the security device authenticates the service terminal's identity. This demonstrates that the security device and the service terminal can establish a secure connection and securely send data. Therefore, remote password reset is possible, achieving a secure and convenient password reset process. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating the steps of applying a security device password reset method to a client terminal in an embodiment of the present invention. Figure 2 This is a flowchart illustrating the steps of applying a security device password reset method to a service terminal in an embodiment of the present invention. Figure 3 This is a flowchart illustrating the steps of a security device password reset system according to an embodiment of the present invention; Figure 4 This is an interactive schematic diagram of a security device password reset system according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0010] Table 1. Glossary

[0011] The core functions of UKey are shown in Table 2 below: Table 2. Core Functions of UKEY

[0012] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0013] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0014] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0015] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0016] In related technologies, logging into a small security device via a client terminal requires entering a password before the device can be used. Taking a UKEY as an example, logging in via a PC client terminal requires entering a PIN code; only after correctly entering the PIN code can the various functions of the UKEY be used. If the UKEY holder forgets the PIN, they need to take the UKEY to the UKEY issuer offline to manually reset the password. Although offline password reset has high security, it is inconvenient for users; therefore, there is currently no secure and convenient way to reset the password for small security devices.

[0017] To address the aforementioned issues, this application provides a method, system, and electronic device for resetting passwords for security devices. The method for downloading the unique identifier key described in this application is detailed below.

[0018] A password reset method for a security device is disclosed, applied to a client terminal. The client terminal is connected to both a security device and a server terminal. The security device and the server terminal have pre-installed authentication keys, such as authentication key AK. Authentication key AK is a symmetric key. It is generated and stored by the server terminal and injected into the security device, simultaneously stored in both the server terminal and the security device, and cannot be modified. The client terminal can be a secure PC on the production end, or other verified PC tools running dedicated production tools (i.e., applications used to execute the method). The security device can be a small security device such as a USB key. Please refer to [reference needed]. Figure 1 The method includes steps 110-140. The service terminal can be a functional server that includes certificate authorities and registration authorities, and has high security.

[0019] Step 110: Obtain the device identifier from the security device, and send the device identifier and reset command to the service terminal for authentication. The reset command is used to drive the service terminal to initiate a reset after authentication is completed.

[0020] The device identifier can be the device's unique serial number (SN), such as LD123456. The SN, LD123456, along with the reset command, is then sent to the service terminal for authentication. Since the security device owner has forgotten the login password, resetting the password does not require logging in. After the client terminal connects to the security device, it will read the relevant information and, upon selecting the password reset option, enter the password reset process, obtain the device identifier, and send it along with the reset command to the service terminal for authentication.

[0021] Step 120: Obtain the authentication result. If authentication is successful, obtain the first verification number from the security device, send the first verification number to the service terminal, and instruct the service terminal to encrypt the first verification number using the authentication key to obtain the encrypted number. That is, after authentication by the service terminal, the client terminal can further send a random number generation command to the security device. The random number generation command is used to instruct the security device to generate the first verification number and encrypt the first verification number using the authentication key AK to obtain the encrypted number.

[0022] Step 130: Send the encrypted number to the security device and instruct the security device to decrypt the encrypted number using the authentication key to obtain the second verification number. That is, the security device uses the same authentication key AK to decrypt the encrypted number to obtain the second verification number.

[0023] Step 140: If the second checksum matches the first checksum, the reset password is obtained and returned to the security device. That is, if the verification matches, the service terminal considers the current security device to be used by a legitimate user performing the password reset operation. For example, after successful authentication, the security device sets an authentication success flag; only when this flag is set is password modification allowed. If authentication has not been performed, the security device will refuse password modification. Subsequently, the security device holder enters the new password on the client terminal, and the client terminal sends the new password to the security device, completing the password reset. During the password reset, the system can receive either a password entered by the user (i.e., the user enters the reset password on the client terminal) or a password uploaded remotely by the user (e.g., imported from the cloud).

[0024] As can be seen from the above embodiments, the client terminal of this application obtains the device identifier from the security device, sends the device identifier and reset command to the service terminal for authentication, and ensures that the operator resetting the password is the legitimate holder of the security device through the authentication of the service terminal. Then, by obtaining the authentication result, if the authentication is successful, the client terminal obtains the first verification number from the security device, sends the first verification number to the service terminal, and instructs the service terminal to encrypt the first verification number using the authentication key to obtain the encrypted number, sends the encrypted number to the security device, and instructs the security device to decrypt the encrypted number using the authentication key to obtain the second verification number. If the second verification number is consistent with the first verification number, the client terminal obtains the reset password and returns the reset password to the security device. Through the method of this application, by instructing the service terminal to encrypt the first verification number using the authentication key to obtain the encrypted number, and instructing the security device to decrypt the encrypted number using the authentication key to obtain the second verification number, and verifying whether the obtained second verification number is consistent with the first verification number based on the same authentication key, if they are consistent, the security device achieves the function of authenticating the identity of the service terminal, indicating that the security device and the service terminal can establish a secure connection and can securely send data. Therefore, the password can be reset remotely, realizing a secure and convenient password reset process.

[0025] In one embodiment of this application, step 110, sending the device identifier and reset command to the service terminal for authentication, includes: The service terminal is instructed to obtain reserved information based on the device identifier and send the first verification information to the holder's device. Specifically, when issuing a UKEY to a security device (such as a UKEY holder), the service terminal associates the UKEY holder's phone number and email address with the device's serial number (SN) and stores this information in the backend system. Subsequently, after obtaining the device identifier (SN), the service terminal will retrieve the phone number and email address based on the SN and send the first verification information to the holder's device, such as the holder's mobile phone or computer.

[0026] As can be seen from the above embodiments, by associating the reserved information with the device identifier at the service terminal, the corresponding reserved information can be obtained through the device identifier when authenticating the holder's identity. The first verification information is then sent to the holder's device of the security device based on the reserved information, preventing the first verification information from being obtained by other unauthorized operators. This ensures that the current operator is a legitimate holder or a trusted operator, thereby improving the security of identity authentication.

[0027] In one embodiment of this application, step 110, which involves sending the device identifier and reset command to the service terminal for authentication, further includes: Obtain the authentication method and send the authentication method, device identifier, and reset command to the service terminal for authentication; for example, you can choose to authenticate using a mobile phone number, email address, or high-level UKEY.

[0028] After obtaining the reserved information based on the device identifier, the service terminal retrieves the target information from the reserved information according to the authentication method, and sends the first verification information to the holder's device based on the target information. The first verification information can be a verification code or other verification message. For example, if mobile phone number authentication is selected, the target information is the mobile phone number, meaning the verification code is sent to the holder's mobile phone. If email authentication is selected, the target information is the email address, meaning the verification code is sent to the holder's email address. Alternatively, a verification code can be sent to a specific verification email address. If a higher-level U-key authentication is selected, authentication is performed using the higher-level U-key. For example, if a user inserts both a U-key and a higher-level U-key into the client terminal, it indicates that the current operator is a general administrator with high operational privileges, and can directly authorize authentication using the higher-level U-key, meaning the current operator has the authority to reset the password.

[0029] As can be seen from the above embodiments, by selecting different authentication methods for identity verification, the identity authentication needs in different application scenarios can be met.

[0030] In one embodiment of this application, it further includes: The system retrieves a first verification key from the security device and sends it to the service terminal, instructing the service terminal to obtain the authentication key corresponding to the device identifier. The first verification key is then encrypted using this authentication key. Specifically, when the authentication key AK is pre-configured in the security device and the service terminal, it is also associated with the device identifier SN of the security device. This ensures a one-to-one correspondence between the authentication key AK and the device identifier SN, enabling the subsequent retrieval of the corresponding authentication key AK through the device identifier SN. The encrypted number is sent to the security device, which is then instructed to obtain the authentication key corresponding to the device identifier and decrypt the encrypted number based on the authentication key.

[0031] As can be seen from the above embodiments, by mapping the authentication key to the device identifier one by one, and since the device identifier is obtained from the security device, the security of the device identifier of the security device can be ensured, thereby ensuring the security when obtaining the authentication key.

[0032] In one embodiment of this application, obtaining the first verification number from the security device in step 120 includes: Instruct the safety device to generate a random number; Receive a random number returned by the security device and use the random number as the first checksum.

[0033] As described in the above embodiments, after a random number is generated by the security device and returned to the service terminal, the service terminal encrypts the random number using the authentication key AK. This ensures that only security devices possessing the authentication key AK can decrypt the random number and verify its consistency with previously generated numbers. This achieves the purpose of authenticating the server's identity through the security device, preventing information leakage caused by arbitrarily unlocking the security device without access to the service terminal. Furthermore, the inclusion of the random number also prevents replay attacks. Since each authentication is based on a different random number, using a historical random number in the next authentication process would fail, thus enhancing the security of the authentication process.

[0034] In one embodiment of this application, step 110, sending the device identifier and reset command to the service terminal for authentication, includes: Establish a secure channel between the service terminal; The device identification and reset command are sent to the service terminal for authentication via a secure channel.

[0035] As can be seen from the above embodiments, before the client terminal sends data and instructions to the service terminal, it first establishes a secure channel between the client terminal and the service terminal, so that all subsequent interaction processes are carried out through the secure channel. After ensuring the security of the interaction between the client terminal and the service terminal, the device identifier and reset instruction are sent to the service terminal for authentication, thereby improving the security of data and instructions.

[0036] In one embodiment of this application, after returning the reset password to the security device in step 140, the method further includes: Send the password reset message to the service terminal; The service terminal includes the functions of certificate authorities and registration authorities.

[0037] As can be seen from the above embodiments, after the client terminal returns the reset password to the security device, the reset password is synchronized to the service terminal. The service terminal has the functions of a certificate authority and a registration authority, which can effectively ensure the security of the reset password.

[0038] This application provides a method for resetting the password of a security device, applied to a service terminal, which is connected to a client terminal; the client terminal is connected to the security device to obtain the device identifier; the security device and the service terminal have pre-set authentication keys.

[0039] Please refer to Figure 2 The method includes steps 210-240: Step 210: Obtain the device identifier and reset command sent by the client terminal for authentication, and initiate a reset after authentication, instructing the security device to obtain the first verification code and provide feedback. For example, after obtaining the device identifier SN: LD123456 and the reset command, authenticate the device identifier SN: LD123456, and execute the reset command after completing the authentication to start the reset process.

[0040] Step 220: Obtain the first verification number and encrypt the first verification number using the authentication key to obtain the encrypted number; that is, obtain the first verification number sent by the client terminal and encrypt the first verification number using the authentication key AK corresponding to the device identifier SN to obtain the encrypted number.

[0041] Step 230: Send the encrypted number to the security device and instruct the security device to decrypt the encrypted number using the authentication key to obtain the second verification number; that is, the security device also uses the same authentication key AK to decrypt the encrypted number to obtain the second verification number.

[0042] Step 240: If the second checksum matches the first checksum, the client terminal is instructed to obtain and return the reset password, and the reset password is also returned to the security device. That is, when the verification matches, the service terminal considers the current security device to be used by a legitimate user performing the password reset operation, and thus obtains the reset password to complete the password reset.

[0043] As can be seen from the above embodiments, after receiving the device identifier and reset command sent by the client terminal, the identity of the security device is authenticated to ensure that the holder of the security device is a legitimate holder. Then, the service terminal initiates the password reset process. During the password reset process, the security device generates a first checksum and sends it to the service terminal. The service terminal encrypts the first checksum using the authentication key and returns it to the security device. The security device then decrypts and verifies the checksum using the same authentication key. That is, only security devices with the same authentication key can decrypt the correct checksum, thus achieving the function of the security device authenticating the identity of the service terminal. This improves the security of the password reset process while enabling online password reset.

[0044] This application provides a security device password reset system, including a service terminal, a client terminal, and a security device; the client terminal is connected to both the security device and the service terminal. Please refer to... Figure 3 The system execution method includes steps 310-350: Step 310: The client terminal obtains the identity information and sends it to the service terminal for authentication; the identity information includes the SN of the security device such as the UKEY, and the authentication method selected by the security device holder.

[0045] Step 320: The service terminal receives the identity information and performs authentication. If authentication is successful, the password reset process is initiated, and the first verification code is obtained from the security device. For example, the pre-stored mobile phone number, email address, etc., are obtained based on the UKEY's SN number, and a verification code is sent via the mobile phone number for identity authentication. After identity authentication is completed, the password reset process is initiated.

[0046] Step 330: The security device generates a first verification number and sends the first verification number to the service terminal; Step 340: The service terminal uses the authentication key to encrypt the first verification number to obtain the encrypted number, and sends the encrypted number to the security device; Step 350: The security device obtains the encrypted number, decrypts the encrypted number using the authentication key, and obtains the second verification number. If the second verification number matches the first verification number, the device returns a result allowing password reset.

[0047] Please refer to Figure 4 This embodiment uses a PC as the client terminal and a UKEY as the security device to illustrate the interaction process of the above system: (1) A first secure channel is established between the server and the PC client terminal; subsequent interactions between the server and the PC client terminal are based on the first secure channel. That is, the step of establishing a secure channel with the server terminal is performed before step 110.

[0048] (2) When the UKEY holder needs to reset the UKEY password, insert the UKEY into the PC client terminal and select "Reset UKEY Password" on the PC client terminal. At the same time, the PC client terminal will obtain the UKEY's SN; then the PC client terminal will ask the holder to select an authentication method, such as selecting a phone number or email address for authentication.

[0049] (3) After the holder enters the authentication method on the PC client terminal, the PC client terminal requests the server to reset the password and sends the authentication method and the UKEY's SN to the server. That is, steps (2)-(3) execute the above step 110 to obtain the device identifier from the security device and send the device identifier and reset command to the service terminal for authentication.

[0050] (4) The server queries the security device holder's reserved information, such as mobile phone number or email address, based on the uploaded SN. If the authentication method is mobile phone, a verification code is generated and sent to the holder's mobile phone according to the phone number. That is, the server executes the authentication step in step 110 above.

[0051] (5) After receiving the verification code, the holder enters the received verification code on the PC client terminal, and the PC client terminal sends the verification code to the server for verification.

[0052] (6) When the server backend system verifies whether the verification code is valid, it assumes that the UKEY holder has reset the password and then initiates the password reset process. That is, the reset command in step 110 is executed to drive the service terminal to initiate the reset step after completing authentication.

[0053] (7) The server requests a random number from the UKEY.

[0054] (8) The UKEY generates a set of random numbers A, uses random number A as the first check number, and sends random number A back to the server through the PC client terminal.

[0055] (9) After the server obtains the corresponding authentication key AK based on the SN, it uses the authentication key AK to encrypt a random number A, and returns the encrypted number A' to the UKEY. Steps (7)-(9) are the execution of step 120 above.

[0056] (10) The UKEY uses the same authentication key AK to decrypt the encrypted number A', obtaining the second check number B. The first check number A is compared with the second check number B, i.e., step 130 above is executed. If they match, it means that they are the same random number, and the authentication is successful. The user is considered legitimate and is required to reset the password. Then, the password reset is allowed. That is, step 140 above is executed.

[0057] (11) The holder enters the new password on the PC client terminal, sends it to the UKEY and synchronizes it to the server.

[0058] As can be seen from the above embodiments, after receiving the device identifier and reset command sent by the PC client terminal, the identity of the UKEY holder is authenticated to ensure that the UKEY holder is a legitimate holder before the server initiates the password reset process. During the password reset process, the UKEY generates a first checksum and sends it to the server. The server encrypts the first checksum using the authentication key and then returns it to the UKEY. The UKEY uses the same authentication key to decrypt and verify it. That is, only a UKEY with the same authentication key can decrypt the correct checksum, thus achieving the function of UKEY authenticating the server's identity. This improves the security of the password reset process while enabling online password reset.

[0059] Meanwhile, resetting the UKEY password is always completed after authentication between the server and the UKEY; only the server has the authority to reset the UKEY password. The PC client terminal merely acts as a forwarder. The system and environment security of the server backend are higher than that of the PC client terminal. The server backend generally uses hardware security devices to store the authentication key AK. The hardware security devices themselves have extremely high security, ensuring that the authentication key AK cannot be stolen. Furthermore, the hardware security devices are placed in a controlled and secure physical environment, further ensuring that the authentication key AK is not at risk of being leaked. In addition, the server backend can centrally manage all UKEY password reset operations, facilitating management, recording, and tracking. If authentication is not performed using the first and second checksums, the PC client terminal and the UKEY will authenticate using the authentication key AK. In this case, the PC client terminal will hold the authentication key AK in plaintext, resulting in a significant reduction in security. This is because the PC client terminal is usually just software and does not have the ability to securely store the authentication key AK. Once the authentication key AK is stolen by a Trojan program, it can arbitrarily change the UKEY password without authentication.

[0060] This application provides an example of a user resetting their password, as follows: After inserting the UKEY into the PC client terminal, the user cannot log in because they have forgotten the UKEY login password. They need to reset the UKEY password on the PC client terminal and then choose to authenticate by phone number. The PC client terminal then obtains the UKEY's SN and sends the SN to the server.

[0061] The server queries the phone number of the UKEY holder based on the uploaded SN, generates a verification code, and sends it to the user's mobile phone. After receiving the verification code, the user enters it into the PC client terminal, which then sends the verification code back to the server for identity verification.

[0062] When the server's backend system verifies that the verification code is valid, it indicates that the identity authentication is successful and the password reset process is initiated. Then, the authentication key AK is used in conjunction with the random number A to verify that the user is a legitimate user who wants to reset the password, and then the password reset is allowed.

[0063] The user enters a new password on the PC client terminal to complete the password reset.

[0064] Please refer to Figure 5This application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the various steps of the client terminal in the security device password reset method described above. The electronic device can be a secure PC for production or other verified PC tools running dedicated production tools.

[0065] In summary, this invention provides a method, system, and electronic device for resetting passwords for secure devices. After obtaining the device identifier from the secure device, the device identifier and reset command are sent to a service terminal for authentication. Once the holder of the secure device is confirmed to be the legitimate holder, the service terminal initiates the password reset process. During the password reset process, the secure device generates a first checksum and sends it to the service terminal. The service terminal encrypts the first checksum using an authentication key and then returns it to the secure device. The secure device decrypts and verifies the checksum using the same authentication key. This means that only secure devices with the same authentication key can decrypt the correct checksum, thus authenticating the service terminal's identity. This enhances security during the online password reset process.

[0066] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent modifications made based on the content of the present invention specification and drawings, or direct or indirect applications in related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A security device password reset method, characterized by, The application is applied to a client terminal, the client terminal is connected with a security device and a service terminal respectively, the security device and the service terminal are pre-stored with an authentication key, and the method comprises the following steps of: obtaining a device identifier from the security device, sending the device identifier and a reset instruction to the service terminal for authentication, and the reset instruction is used to drive the service terminal to initiate a reset after completing the authentication; obtaining an authentication result, if the authentication is passed, obtaining a first check number from the security device, sending the first check number to the service terminal, and instructing the service terminal to encrypt the first check number by using the authentication key to obtain an encrypted number; sending the encrypted number to the security device, and instructing the security device to decrypt the encrypted number by using the authentication key to obtain a second check number; if the second check number is consistent with the first check number, obtaining a reset password, and returning the reset password to the security device.

2. The method of claim 1, wherein, The step of sending the device identifier and the reset instruction to the service terminal for authentication comprises the following steps of: instructing the service terminal to obtain reserved information according to the device identifier, and sending first verification information to a holder device of the security device according to the reserved information.

3. The method of claim 2, wherein, The step of sending the device identifier and the reset instruction to the service terminal for authentication further comprises the following steps of: obtaining an authentication mode, sending the authentication mode, the device identifier and the reset instruction to the service terminal for authentication; instructing the service terminal to obtain target information in the reserved information according to the authentication mode after obtaining the reserved information according to the device identifier, and sending the first verification information to the holder device of the security device according to the target information; the target information comprises a mobile phone number, an email and a high-level UKEY.

4. The method of claim 1, wherein, The method further comprises the following steps of: obtaining a first check number from the security device, sending the first check number to the service terminal, instructing the service terminal to obtain the authentication key corresponding to the device identifier, and encrypting the first check number according to the authentication key; sending the encrypted number to the security device, and instructing the security device to obtain the authentication key corresponding to the device identifier and decrypt the encrypted number according to the authentication key.

5. The method of claim 1 or 4, wherein, The step of obtaining the first check number from the security device comprises the following steps of: instructing the security device to generate a random number; receiving the random number returned by the security device, and taking the random number as the first check number.

6. The method of claim 1, wherein, The step of sending the device identifier and the reset instruction to the service terminal for authentication comprises the following steps of: establishing a secure channel between the service terminal; sending the device identifier and the reset instruction to the service terminal through the secure channel for authentication.

7. The method of claim 1, wherein, The method further comprises the following steps of: sending the reset password to the service terminal after returning the reset password to the security device; The service terminal comprises the functions of a certificate authority and a registration authority.

8. A security device password reset method, characterized by, The application is applied to a service terminal, the service terminal is connected with a client terminal; the client terminal is connected with a security device for obtaining a device identifier; the security device and the service terminal are pre-stored with an authentication key, and the method comprises the following steps of: Obtaining the device identifier and reset instruction sent by the client terminal for authentication, and initiating reset after authentication, instructing the security device to obtain a first check number and feedback; Obtaining the first check number and encrypting the first check number using the authentication key to obtain an encrypted number; Sending the encrypted number to the security device and instructing the security device to decrypt the encrypted number using the authentication key to obtain a second check number; If the second check number is consistent with the first check number, instructing the client terminal to obtain a reset password and feedback, and returning the reset password to the security device.

9. A secure device password reset system, characterized by, The method comprises a service terminal, a client terminal and a security device; the client terminal is connected to the security device and the service terminal respectively; The client terminal is configured to obtain identity information and send the identity information to the service terminal for authentication; The service terminal is configured to receive the identity information and perform authentication, and if the authentication is successful, start a reset password process and obtain a first check number from the security device; The security device is configured to generate the first check number and send the first check number to the service terminal; The service terminal is configured to encrypt the first check number using an authentication key to obtain an encrypted number, and send the encrypted number to the security device; The security device is further configured to obtain the encrypted number, decrypt the encrypted number using the authentication key to obtain a second check number, and if the second check number is consistent with the first check number, return a result allowing the reset password.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor executes the computer program to implement each step of the security device password reset method according to any one of claims 1-7. The processor executes the computer program to implement each step of the security device password reset method according to any one of claims 1-7.

Images