Method and device for secure input of browser password, electronic equipment and storage medium
By generating symmetric and asymmetric keys through custom elements and dynamic encryption scripts, the browser password entered by the user is encrypted in real time, solving the security problem of plaintext passwords in browser memory and during transmission, and achieving full-process security protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA FINANCIAL CERTIFICATION AUTHORITY
- Filing Date
- 2026-01-04
- Publication Date
- 2026-05-29
Smart Images
Figure CN122113082A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of Web front-end security technology, specifically to a secure input method, device, electronic device, and storage medium for browser passwords. Background Technology
[0002] With the rapid development of internet technology and the widespread adoption of digital life, users need to authenticate their identities through various online services. Passwords, as the most common means of authentication, are of paramount importance in terms of security. In a browser environment, the secure input and transmission of user passwords is the first line of defense in protecting user account security.
[0003] However, the core of current mainstream cryptographic processing schemes lies in utilizing HTM standard tags. <input type="password"> Create a password input field. This method only displays the characters entered by the user as asterisks (...). ) or dots ( This is intended to prevent onlookers from spying. However, the plaintext password entered by the user is still stored directly in a specific area of the browser's memory and exists completely in the value property of the document object model. It is extremely vulnerable to being stolen by browser plugins, debugging tools, or malicious scripts, resulting in very low security.
[0004] During data transmission, if a website does not deploy a secure Hypertext Transfer Protocol (HTTP), passwords are typically transmitted directly in plaintext over the network, making them highly vulnerable to man-in-the-middle attacks and interception. Even if a website deploys HTTPS, although it ensures the security of the transmission link, the risk of passwords being exposed in plaintext in the front-end memory and DOM still exists. Summary of the Invention
[0005] In view of this, this application provides a secure password input method, device, electronic device, and storage medium for browsers. The main purpose is to address the current mainstream password processing schemes where user-inputted plaintext passwords are still directly stored in a specific area of the browser's memory and fully reside in the `value` property of the Document Object Model (DOM). This makes them extremely vulnerable to being stolen by browser plugins, debugging tools, or malicious scripts, resulting in very low security. Furthermore, during data transmission, if the website does not deploy a secure Hypertext Transfer Protocol (HTTP), passwords are typically transmitted directly in plaintext over the network, making them highly susceptible to man-in-the-middle attacks and interception. Even with HTTPS, while ensuring the security of the transmission link, the risk of passwords being exposed as plaintext in the front-end memory and DOM still exists.
[0006] Firstly, this application provides a secure method for inputting browser passwords, including: In response to custom elements being loaded in the document, an internal input box is created to receive user input and display a mask, and an encryption script containing encryption logic is dynamically loaded to generate a symmetric encryption key and an initialization vector. Listen for input events in the internal input box. If the input event is a valid character event, encrypt the valid character using the symmetric encryption key and the initial vector to generate the corresponding character ciphertext. The character ciphertext, the symmetric encryption key, and the initial vector are subjected to asymmetric encryption to generate the final ciphertext.
[0007] Secondly, this application provides a secure password input device for a browser, comprising: The loading module is used to respond to custom elements being loaded in the document, create an internal input box to receive user input and display a mask, and dynamically load an encryption script containing encryption logic to generate a symmetric encryption key and an initialization vector. The generation module is used to listen to the input events of the internal input box. If the input event is a valid character event, the valid character is encrypted using the symmetric encryption key and the initial vector to generate the corresponding character ciphertext. An encryption module is used to perform asymmetric encryption processing on the character ciphertext, the symmetric encryption key, and the initial vector to generate the final ciphertext.
[0008] Thirdly, this application provides an electronic device, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the secure input method for browser passwords described in the first aspect.
[0009] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the secure input method for browser passwords described in the first aspect. By employing the above technical solutions, this application provides a secure input method, device, electronic device, and storage medium for browser passwords. Compared with existing technologies, this application can respond to the loading of custom elements in a document, create an internal input box for receiving user input and displaying a mask, and dynamically load an encryption script containing encryption logic to generate a symmetric encryption key and an initialization vector; listen to input events of the internal input box, and if the input event is a valid character event, encrypt the valid character using the symmetric encryption key and the initialization vector to generate the corresponding character ciphertext; and perform asymmetric encryption on the character ciphertext, the symmetric encryption key, and the initialization vector to generate the final ciphertext.
[0010] Using the above technical solution, this application creates an internal input box when the custom element is loaded, and simultaneously loads an encryption script to generate a symmetric key (AES) and an initialization vector (IV). When the user inputs, each valid character triggers real-time encryption, generating character ciphertext, which is then subjected to asymmetric encryption (such as RSA), forming a double encryption protection.
[0011] In this application, the plaintext exists only during the brief input phase in the input box. After encryption, it is immediately stored in memory as ciphertext, preventing the plaintext from residing in the DOM's value attribute or browser memory for an extended period. Even if an attacker accesses the memory using debugging tools, they can only obtain the final ciphertext after asymmetric encryption.
[0012] The symmetric key (used for character-level encryption) and initialization vector in this application are further protected by asymmetric encryption (such as RSA-2048). Even if an attacker obtains the character ciphertext, they will not be able to decrypt the original symmetric key without the asymmetric private key, thus making it impossible to recover the plaintext and improving security.
[0013] During data transmission, even if a website does not deploy Hypertext Transfer Protocol (HTTPS), the final ciphertext after asymmetric encryption is already resistant to interception, and attackers cannot directly obtain the plaintext. If Hypertext Transfer Protocol is deployed, a two-layer protection of "transport layer (TLS) + application layer (asymmetric encryption)" is formed, further reducing the risk of passwords being exposed as plaintext in front-end memory and DOM.
[0014] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description
[0015] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 A flowchart illustrating a secure password input method for a browser provided in this application embodiment; Figure 2 A flowchart illustrating another secure browser password input method provided in this application embodiment; Figure 3 This is a schematic diagram of a secure password input device for a browser, provided in an embodiment of this application. Detailed Implementation
[0018] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.
[0019] The following description, with reference to the accompanying drawings, outlines a secure method, apparatus, electronic device, and storage medium for inputting browser passwords according to embodiments of this application.
[0020] This application provides a secure password input method, device, electronic device, and storage medium for browsers. Its main purpose is to address the current mainstream password processing schemes where user-inputted plaintext passwords are directly stored in a specific area of the browser's memory and fully reside in the document object model's `value` property. This makes them extremely vulnerable to being stolen by browser plugins, debugging tools, or malicious scripts, resulting in very low security. Furthermore, during data transmission, if the website does not deploy a secure Hypertext Transfer Protocol (HTTP), passwords are typically transmitted directly in plaintext over the network, making them highly susceptible to man-in-the-middle attacks and interception. Even with HTTPS, while ensuring the security of the transmission link, the risk of passwords being exposed as plaintext in the front-end memory and DOM still exists.
[0021] like Figure 1 As shown, an embodiment of this application provides a secure password input method for a browser, including: Step 101: In response to the loading of custom elements in the document, create an internal input box to receive user input and display a mask, and dynamically load an encryption script containing encryption logic to generate a symmetric encryption key and an initialization vector.
[0022] This application can be applied to browser environments that support Web Components and modern encryption APIs (such as the Web Crypto API). In this embodiment, the Chinese national cryptographic algorithms SM4 (symmetric encryption) and SM2 (asymmetric encryption) are used as examples for illustration, but those skilled in the art will understand that this does not constitute a limitation on the scope of protection of this application, and other equivalent encryption algorithms (such as AES, DES, RSA, ECC, etc.) are also applicable.
[0023] Among them, custom elements are custom HTML elements; In this embodiment of the application, in response to a custom element being loaded in the document, an internal input box is created to receive user input and display a mask, and an encryption script containing encryption logic is dynamically loaded to generate a symmetric encryption key and an initialization vector, which may specifically include: In response to a custom HTML element being inserted into the document, its pre-defined lifecycle callback function is triggered; During the execution of the preset lifecycle callback function, the following initialization operations are performed: Create a target element inside a custom HTML element, and set the target element as an inner input box for user input with a mask; Create a target tag and add it to the document to dynamically load the encrypted script; Execute the encryption script to call the encryption interface provided by the browser to generate random numbers, and use the random numbers as the symmetric encryption key and the initial vector respectively.
[0024] In this embodiment, as Figure 2 As shown, developers can first define custom HTML elements in the HTML document using the `customElements.define()` interface of Web Components, for example... <secure-password-input>to replace the traditional <input type="password"> Label.
[0025] Developers only need to use the traditional <input type="password"> Replace the tag with <secure-password-input>Tags can be used to introduce a complete security mechanism without the need to write complex encryption and event handling logic, reducing development difficulty and the probability of errors.
[0026] When the browser parses the HTML document and... <secure-password-input>When a tag is inserted into the Document Object Model (DOM), the pre-defined lifecycle callback function of that custom HTML element is triggered. This function serves as the core entry point for initialization operations.
[0027] During the execution of the preset lifecycle callback function, the following initialization operations can be performed: First, create the internal input box: a standard input box can be created using document.createElement('input'). <input> The element is defined, and its `type` attribute is set to 'password'. To make it invisible to the user, its style can be set to invisible (e.g., `position: absolute; left: -9999px;`), or it can be encapsulated as part of the custom element's shadow DOM. This inner input box can be the actual carrier for receiving keyboard events, while the mask seen by the user (such as an asterisk) is dynamically rendered by the custom element based on the length of the subsequent ciphertext structure. In this way, the exposed `value` attribute in the DOM is always empty or unrelated to the actual data, effectively preventing the plaintext from being obtained through DOM scanning.
[0028] Secondly, encrypted scripts can be dynamically loaded: a script can be created using document.createElement('script'). <script>标签，并将其src属性指向包含加密逻辑的JavaScript文件，例如crypto.js（即加密脚本）。随后，可通过document.head.append Child(script Tag) 将该脚本标签添加到文档中，触发浏览器的动态加载和执行机制。这种按需加载的方式可以防止加密逻辑在页面加载初期就被静态分析，提升了安全性。
[0029] 最后，可生成对称加密密钥及初始向量：crypto.js 加密脚本被加载并执行后，可立即调用浏览器提供的加密接口，例如 window.crypto.getRandomValues()，生成高强度的随机数。在本实施例中，可生成两个16字节的随机数，一个作为SM4算法的对称加密密钥（Key），另一个作为SM4算法的初始向量（IV）。这两个值对于本次密码输入会话是唯一的，并在会话结束后销毁，确保了每次加密操作的不可预测性。
[0030] 步骤102、监听内部输入框的输入事件，若输入事件为有效字符事件，则利用对称加密密钥和初始向量对有效字符进行加密处理，生成对应的字符密文。
[0031] 在本实施例中，如图2所示，在完成初始化后，系统可获取步骤101中创建的内部输入框的输入框元素（如（document.getElementById('password1')）），并为其绑定输入事件监听器，例如 input 事件或key down事件，触发handleKeyDown函数。该事件能够捕获包括键盘输入、粘贴、删除在内的所有内容变化。
[0032] 当监听到输入事件时，系统可判断输入事件的事件类型：若输入事件为有效字符事件（例如，用户输入了字母、数字或符号），系统首先可获取内部输入框的当前光标位置信息，当前光标位置信息可包括当前光标的起始位置（selection Start）和结束位置（selection End）。
[0033] 接着，可根据当前光标位置信息，利用步骤101中生成的对称加密密钥（Key）和初始向量（IV），立即对用户刚输入的有效字符（如单个有效字符）进行哈希运算等操作，并对哈希运算等操作后的有效字符进行即时对称加密处理，生成对应的字符密文。
[0034] 然后，系统可维护在内存中的密文结构C，其中，密文结构可用于存储每个字符加密后的密文片段。密文结构可为存储密文的全局数组、链表或其他可进行高效插入删除的数据结构，操作逻辑的核心是保持密文序列与输入序列一致。
[0035] 可根据获取到的当前光标位置信息，将新生成的字符密文插入到密文结构的相应位置。具体而言，在密文结构的索引为起始位置（selection Start）处插入新生成的字符密文。同时，如果用户输入时选中了部分文本（即selection Start 不等于 selection End），则需要先从密文结构中删除从起始位置（selection Start）到结束位置（selection End）之间的原有字符密文，当前选中的字符密文数count为：count = selection End -selection Start。再执行插入操作。这种基于光标位置的精确操作，确保了密文结构中的密文序列与用户在输入框中看到的明文字符序列（尽管显示为掩码）完全同步和对应。
[0036] 若输入事件为删除操作事件（例如，用户按下了Backspace或Delete键）：系统可同样获取当前光标的起始位置（selection Start）和结束位置（selection End）。
[0037] 根据当前光标位置信息，从存储字符密文的密文结构中删除从起始位置（selection Start）到结束位置（selection End）之间的一个或多个字符密文。如果用户未选中文本，则根据删除键的类型删除光标前或后的一个字符密文。
[0038] 通过上述机制，密码的明文仅在单个字符被处理的瞬间存在于内存中，一旦加密完成，该明文字符即可被垃圾回收机制回收。整个输入过程中，内存中持久存储的始终是加密后的密文结构，从而极大地降低了内存泄露的风险。
[0039] 相比传统密码框，本申请从输入第一个字符起，密码即以密文形式存在，极大缩短了明文在前端的存活时间，有效抵御基于内存读取、DOM扫描的攻击。相比提交时加密的方案，本申请保护了输入过程。
[0040] 步骤103、对字符密文、对称加密密钥及初始向量进行非对称加密处理，生成最终密文。
[0041] 对于本申请实施例，如图2所示，当用户完成密码输入并触发表单提交（或自定义的提交指令）时，系统可将执行最终的打包和加密操作：首先，可将密文结构中的所有字符密文按照其索引顺序，拼接成完整的二进制数据块，即完整密文。
[0042] 可将上一步得到的完整密文、步骤101中生成的对称加密密钥（Key）及初始向量（IV）进行序列化组合，形成待加密数据包。序列化可以采用JSON、Protocol Buffers等通用格式，确保数据结构清晰且易于服务器端解析。
[0043] 可利用预置在 crypto.js 加密脚本中的SM2非对称加密公钥，对整个待加密数据包进行非对称加密处理。由于SM2公钥是公开的，加密过程可以在前端安全进行。只有拥有对应SM2私钥的服务器才能解密该数据包。这一层加密保护了传输过程中对称密钥的安全，即使攻击者截获了数据，也无法解密出最终的密码。
[0044] 在经过SM2加密后，生成了最终密文。该最终密文为本次密码输入操作的完整、安全的加密结果。
[0045] 在本申请中，由于最终传输的数据是经过非对称加密的密文，且每次会话的对称密钥Key和IV均不同，保证了传输数据的机密性，有效防止重放攻击和窃听。
[0046] 在生成最终密文之后，该方法还包括：将该最终密文通过网络（例如，通过HTTPS协议的POST请求）发送至服务器。服务器在接收到最终密文后，可使用其本地存储的、与前端SM2公钥对应的SM2私钥进行解密，还原出待加密数据包。然后，从中提取出SM4算法的对称加密密钥（Key）和初始向量（IV），并使用对称加密密钥（Key）和初始向量（IV）对完整密文进行SM4解密，最终得到用户输入的密码明文，用于后续的身份验证。
[0047] 综上所述，本实施例通过自定义元素、动态加载、逐字符加密和双重加密的协同设计，实现了密码从输入、存储到传输的全流程安全保护，有效解决了现有技术中密码明文在前端暴露和传输过程中被窃取的风险，同时为开发者提供了便捷的集成方式。
[0048] 综上，根据本申请提供的一种浏览器密码的安全输入方法，与目前现有技术相比，本申请可响应于自定义元素在文档中被加载，创建用于接收用户输入并显示掩码的内部输入框，并动态加载包含加密逻辑的加密脚本，以生成对称加密密钥及初始向量；监听内部输入框的输入事件，若输入事件为有效字符事件，则利用对称加密密钥和初始向量对有效字符进行加密处理，生成对应的字符密文；对字符密文、对称加密密钥及初始向量进行非对称加密处理，生成最终密文。
[0049] 采用上述技术方案，本申请在自定义元素加载时即创建内部输入框，并同步加载加密脚本生成对称密钥（AES）和初始向量（IV）。用户输入时，每个有效字符触发实时加密，生成字符密文后再进行非对称加密（如RSA），形成双重加密防护。
[0050] 本申请中明文仅存在于输入框的短暂输入阶段，加密后立即以密文形式存储于内存，避免明文在DOM的value属性或浏览器内存中长期驻留。即使攻击者通过调试工具访问内存，也只能获取到非对称加密后的最终密文。
[0051] 本申请对称密钥（用于字符级加密）和初始向量通过非对称加密（如RSA-2048）进一步保护。即使攻击者获取到字符密文，缺乏非对称私钥仍无法解密出原始对称密钥，从而无法还原明文，提高安全性。
[0052] 在数据传输时，即使网站未部署超文本传输协议，非对称加密后的最终密文已具备抗截获能力，攻击者无法直接获取明文。若部署HTTPS，则形成"传输层（TLS）+应用层（非对称加密）”的双层防护，进一步降低密码在前端内存和DOM中作为明文暴露的风险。
[0053] 基于上述图1所示方法的具体实现，本实施例提供了一种浏览器密码的安全输入装置，如图3所示，该装置包括：加载模块31、生成模块32、加密模块33；加载模块31，用于响应于自定义元素在文档中被加载，创建用于接收用户输入并显示掩码的内部输入框，并动态加载包含加密逻辑的加密脚本，以生成对称加密密钥及初始向量；生成模块32，用于监听所述内部输入框的输入事件，若所述输入事件为有效字符事件，则利用所述对称加密密钥和所述初始向量对有效字符进行加密处理，生成对应的字符密文；加密模块33，用于对所述字符密文、所述对称加密密钥及所述初始向量进行非对称加密处理，生成最终密文。
[0054] 在具体的应用场景中，所述自定义元素为自定义HTML元素；加载模块31，可用于响应于所述自定义HTML元素被插入所述文档，触发其预设生命周期回调函数；在所述预设生命周期回调函数的执行过程中，执行以下初始化操作：在所述自定义HTML元素的内部创建目标元素，并将所述目标元素设置为用户输入并显示掩码的内部输入框；创建目标标签，并将所述目标标签添加到所述文档中，以动态加载所述加密脚本；执行所述加密脚本，以调用浏览器提供的加密接口生成随机数，并将所述随机数分别作为所述对称加密密钥及所述初始向量。
[0055] 在具体的应用场景中，生成模块32，可用于若所述输入事件为有效字符事件，则获取所述内部输入框的当前光标位置信息；根据所述当前光标位置信息，利用所述对称加密密钥和所述初始向量对所述有效字符进行即时对称加密处理，并根据所述当前光标位置信息，将生成的所述字符密文插入到密文结构的相应位置，并根据所述当前光标位置信息更新所述密文结构，以使所述密文结构中的密文序列与用户输入的明文字符序列保持同步。
[0056] 在具体的应用场景中，生成模块32，可用于在所述密文结构的所述起始位置处，插入新生成的所述字符密文，并删除从所述起始位置到所述结束位置之间的原有字符密文。
[0057] 在具体的应用场景中，如图3所示，该装置还包括：删除模块34；删除模块34，用于若所述输入事件为删除操作事件，则根据所述当前光标位置信息，从存储所述字符密文的密文结构中删除从所述起始位置到所述结束位置之间的字符密文。
[0058] 在具体的应用场景中，加密模块33，可用于当接收到提交指令时，将所述密文结构中的所有字符密文拼接成完整密文；将所述完整密文、所述对称加密密钥及所述初始向量进行序列化组合处理，生成待加密数据包；利用预置的非对称加密公钥对所述待加密数据包进行非对称加密处理，生成所述最终密文。
[0059] 在具体的应用场景中，如图3所示，该装置还包括：发送模块35；发送模块35，用于将所述最终密文通过网络发送至服务器，以供所述服务器使用与所述非对称加密公钥对应的非对称加密私钥进行解密验证。
[0060] 需要说明的是，本实施例提供的一种浏览器密码的安全输入装置所涉及各功能单元的其它相应描述，可以参考图1中的对应描述，在此不再赘述。
[0061] 基于上述如图1所示方法，相应的，本实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述如图1所示的方法。
[0062] 基于这样的理解，本申请的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质（可以是CD-ROM，U盘，移动硬盘等）中，包括若干指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等）执行本申请各个实施场景的方法。
[0063] 基于上述如图1所示的方法，以及图3所示的虚拟装置实施例，为了实现上述目的，本申请实施例还提供了一种电子设备，该设备包括存储介质和处理器；存储介质，用于存储计算机程序；处理器，用于执行计算机程序以实现上述如图1所示的方法。
[0064] 可选的，上述实体设备还可以包括用户接口、网络接口、摄像头、射频（RadioFrequency，RF）电路，传感器、音频电路、WI-FI模块等等。用户接口可以包括显示屏（Display）、输入单元比如键盘（Keyboard）等，可选用户接口还可以包括USB接口、读卡器接口等。网络接口可选的可以包括标准的有线接口、无线接口（如WI-FI接口）等。
[0065] 本领域技术人员可以理解，本实施例提供的上述实体设备结构并不构成对该实体设备的限定，可以包括更多或更少的部件，或者组合某些部件，或者不同的部件布置。
[0066] 存储介质中还可以包括操作系统、网络通信模块。操作系统是管理上述实体设备硬件和软件资源的程序，支持浏览器密码的安全输入程序以及其它软件和 / 或程序的运行。网络通信模块用于实现存储介质内部各组件之间的通信，以及与浏览器密码的安全输入实体设备中其它硬件和软件之间通信。
[0067] 通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本申请可以借助软件加必要的通用硬件平台的方式来实现，也可以通过硬件实现。通过应用本实施例的方案，与目前现有技术相比，本申请可响应于自定义元素在文档中被加载，创建用于接收用户输入并显示掩码的内部输入框，并动态加载包含加密逻辑的加密脚本，以生成对称加密密钥及初始向量；监听内部输入框的输入事件，若输入事件为有效字符事件，则利用对称加密密钥和初始向量对有效字符进行加密处理，生成对应的字符密文；对字符密文、对称加密密钥及初始向量进行非对称加密处理，生成最终密文。
[0068] 采用上述技术方案，本申请在自定义元素加载时即创建内部输入框，并同步加载加密脚本生成对称密钥（AES）和初始向量（IV）。用户输入时，每个有效字符触发实时加密，生成字符密文后再进行非对称加密（如RSA），形成双重加密防护。
[0069] 本申请中明文仅存在于输入框的短暂输入阶段，加密后立即以密文形式存储于内存，避免明文在DOM的value属性或浏览器内存中长期驻留。即使攻击者通过调试工具访问内存，也只能获取到非对称加密后的最终密文。
[0070] 本申请对称密钥（用于字符级加密）和初始向量通过非对称加密（如RSA-2048）进一步保护。即使攻击者获取到字符密文，缺乏非对称私钥仍无法解密出原始对称密钥，从而无法还原明文，提高安全性。
[0071] 在数据传输时，即使网站未部署超文本传输协议，非对称加密后的最终密文已具备抗截获能力，攻击者无法直接获取明文。若部署HTTPS，则形成"传输层（TLS）+应用层（非对称加密）”的双层防护，进一步降低密码在前端内存和DOM中作为明文暴露的风险。
[0072] 需要说明的是，在本文中，诸如"第一”和"第二”等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语"包括”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句"包括一个……”限定的要素，并不排除在包括要素的过程、方法、物品或者设备中还存在另外的相同要素。
[0073] 以上仅是本申请的具体实施方式，使本领域技术人员能够理解或实现本申请。对这些实施例的多种修改对本领域的技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文的这些实施例，而是要符合与本文所申请的原理和新颖特点相一致的最宽的范围。< / script>
Claims
1. A secure password input method for a browser, characterized in that, The method includes: In response to custom elements being loaded in the document, an internal input box is created to receive user input and display a mask, and an encryption script containing encryption logic is dynamically loaded to generate a symmetric encryption key and an initialization vector. Listen for input events in the internal input box. If the input event is a valid character event, encrypt the valid character using the symmetric encryption key and the initial vector to generate the corresponding character ciphertext. The character ciphertext, the symmetric encryption key, and the initial vector are subjected to asymmetric encryption to generate the final ciphertext.
2. The method according to claim 1, characterized in that, The custom element is a custom HTML element; The response to a custom element being loaded in the document involves creating an internal input box to receive user input and display a mask, and dynamically loading an encryption script containing encryption logic to generate a symmetric encryption key and an initialization vector, specifically including: In response to the insertion of the custom HTML element into the document, its preset lifecycle callback function is triggered; During the execution of the preset lifecycle callback function, the following initialization operations are performed: Create a target element inside the custom HTML element, and set the target element as an internal input box for user input and display a mask; Create a target tag and add the target tag to the document to dynamically load the encrypted script; The encryption script is executed to call the encryption interface provided by the browser to generate random numbers, and the random numbers are used as the symmetric encryption key and the initial vector, respectively.
3. The method according to claim 2, characterized in that, If the input event is a valid character event, then the valid character is encrypted using the symmetric encryption key and the initialization vector to generate the corresponding character ciphertext, specifically including: If the input event is a valid character event, then obtain the current cursor position information of the internal input box; Based on the current cursor position information, the valid characters are subjected to instantaneous symmetric encryption using the symmetric encryption key and the initial vector. Based on the current cursor position information, the generated character ciphertext is inserted into the corresponding position of the ciphertext structure. The ciphertext structure is updated based on the current cursor position information to keep the ciphertext sequence in the ciphertext structure synchronized with the plaintext character sequence input by the user.
4. The method according to claim 3, characterized in that, The current cursor position information includes the start and end positions of the current cursor; The step of inserting the generated character ciphertext into the corresponding position in the ciphertext structure based on the current cursor position information specifically includes: At the starting position of the ciphertext structure, insert the newly generated character ciphertext and delete the original character ciphertext between the starting position and the ending position.
5. The method according to claim 4, characterized in that, The method further includes: If the input event is a deletion operation event, then based on the current cursor position information, the character ciphertext between the start position and the end position is deleted from the ciphertext structure storing the character ciphertext.
6. The method according to any one of claims 1-5, characterized in that, The step of performing asymmetric encryption on the character ciphertext, the symmetric encryption key, and the initial vector to generate the final ciphertext specifically includes: When a submission command is received, all characters in the ciphertext structure are concatenated into a complete ciphertext. The complete ciphertext, the symmetric encryption key, and the initial vector are serialized and combined to generate a data packet to be encrypted. The data packet to be encrypted is subjected to asymmetric encryption using a preset asymmetric encryption public key to generate the final ciphertext.
7. The method according to claim 1, characterized in that, After generating the final ciphertext, the method further includes: The final ciphertext is sent to the server via the network, so that the server can decrypt and verify it using the asymmetric encryption private key corresponding to the asymmetric encryption public key.
8. A secure password input device for a browser, characterized in that, include: The loading module is used to respond to custom elements being loaded in the document, create an internal input box to receive user input and display a mask, and dynamically load an encryption script containing encryption logic to generate a symmetric encryption key and an initialization vector. The generation module is used to listen to the input events of the internal input box. If the input event is a valid character event, the valid character is encrypted using the symmetric encryption key and the initial vector to generate the corresponding character ciphertext. An encryption module is used to perform asymmetric encryption processing on the character ciphertext, the symmetric encryption key, and the initial vector to generate the final ciphertext.
9. An electronic device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.