A password recovery method based on a third-party server and related products

Abstract

This application discloses a password retrieval method and related products based on a third-party server. The method includes: responding to a password retrieval request initiated by a user, obtaining a unique identifier corresponding to the user from a third-party server; obtaining the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identifier; and decrypting the original password ciphertext based on the unique identifier to obtain the original password. In this way, the unique identifier used for decryption originates from an independent third-party server, rather than relying on an email address or mobile phone number provided by the user. This avoids the problem of extremely low security of backup keys caused by the easy theft, hijacking, or tampering of email addresses or mobile phone numbers. While maintaining the security of zero-knowledge encryption, it fundamentally solves the problem of permanent loss of personal sensitive data due to users forgetting their passwords in zero-knowledge encryption technology.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a password retrieval method and related products based on a third-party server. Background Technology

[0002] Zero-knowledge encryption technology is currently recognized in the industry as the most secure data protection solution. Its core principle is to encrypt users' sensitive personal data locally on the client side, and only the encrypted ciphertext is uploaded to the application server. The application server never comes into contact with any plaintext data. Therefore, even if the server is hacked or the database is compromised, attackers cannot obtain any user's plaintext information. However, this technology has a significant problem: once a user forgets the original encryption password, their sensitive personal data will be permanently lost and unrecoverable.

[0003] To address the aforementioned issues, existing technologies primarily use the user's email address or mobile phone number as a backup key, encrypting the original password and storing it on the server. However, email addresses and mobile phone numbers are easily stolen, hijacked, or tampered with, resulting in extremely low security for the backup key. This makes it impossible to achieve reliable password retrieval while retaining the security of zero-knowledge encryption. Summary of the Invention

[0004] This application provides a password retrieval method and related products based on a third-party server. By obtaining a unique identifier corresponding to the user from the third-party server and using the identifier to decrypt the original password ciphertext that was previously encrypted with the identifier, the original password can be directly restored. Therefore, it can fundamentally solve the problem of permanent loss of personal sensitive data due to users forgetting their passwords in zero-knowledge encryption technology.

[0005] In a first aspect, embodiments of this application provide a password retrieval method based on a third-party server, the method comprising: In response to a password retrieval request initiated by a user, a unique identifier corresponding to the user is obtained from a third-party server; Obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identifier; Based on the unique identifier, the original ciphertext is decrypted to obtain the original ciphertext.

[0006] One feasible implementation, wherein the step of obtaining a unique identifier corresponding to the user from a third-party server in response to a password retrieval request initiated by the user, includes: In response to a password retrieval request initiated by a user, the third-party server authenticates the user. If the authentication is successful, the third-party server returns a unique identifier corresponding to the user.

[0007] One possible implementation involves the third-party server authenticating the user, including: Obtain the authentication information entered by the user when logging into the third-party server; The identity authentication information is compared with the user's authentication information pre-stored in the third-party server to verify the user's identity.

[0008] One feasible implementation includes obtaining the original password ciphertext corresponding to the user, comprising: Send a ciphertext retrieval request and receive the original password ciphertext corresponding to the user returned in response to the ciphertext retrieval request.

[0009] One feasible implementation, wherein decrypting the original ciphertext based on the unique identifier to obtain the original ciphertext, includes: Based on a preset symmetric decryption algorithm, the unique identifier is used as the decryption key to decrypt the original ciphertext and obtain the original password.

[0010] Secondly, embodiments of this application provide a password retrieval system based on a third-party server, used to execute the method described in the first aspect. The password retrieval system includes a client, an application server, and a third-party server, wherein the application server communicates with the client and the third-party server respectively. The client is used to respond to a password retrieval request initiated by the user and obtain a unique identity identifier corresponding to the user from the third-party server. The client is used to obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identity identifier; The client is used to decrypt the original ciphertext based on the unique identifier to obtain the original password.

[0011] In one possible implementation, the application server is configured to store the original ciphertext and, in response to a ciphertext retrieval request sent by the client, search for and return the original ciphertext corresponding to the user.

[0012] In one possible implementation, the third-party server is used to authenticate the user, and if the authentication is successful, returns a unique identifier corresponding to the user to the client.

[0013] Thirdly, embodiments of this application provide an electronic device, the device including: a processor, a memory, and a system bus; The processor and the memory are connected via the system bus; The memory is used to store a program, which includes instructions that, when executed by the processor, cause the processor to perform any of the above-described implementation steps for password retrieval based on a third-party server.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium for storing a computer program, which, when executed by a terminal device, implements any of the implementation steps of the above-described password retrieval method based on a third-party server.

[0015] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: As can be seen from the above technical solution, this application provides a password retrieval method and related products based on a third-party server. The method includes: First, in response to a password retrieval request initiated by a user, obtaining a unique identifier corresponding to the user from a third-party server. Next, obtaining the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identifier. Subsequently, based on the unique identifier, decrypting the original password ciphertext to obtain the original password.

[0016] As can be seen, this solution, when a user initiates a password retrieval request, obtains a unique identifier corresponding to the user from a third-party server and uses this identifier to decrypt the original password ciphertext, which was previously encrypted with that identifier, thereby directly restoring the original password. In this process, the unique identifier used for decryption originates from an independent third-party server, rather than relying on the user's self-provided email address or phone number. This avoids the problem of extremely low backup key security caused by the easy theft, hijacking, or tampering of email addresses or phone numbers. While maintaining the security of zero-knowledge encryption, it fundamentally solves the problem of permanent loss of sensitive personal data due to users forgetting their passwords in zero-knowledge encryption technology. Attached Figure Description

[0017] Figure 1 A flowchart illustrating a password retrieval method based on a third-party server, provided as an embodiment of this application; Figure 2 This is a schematic diagram of the structure of a password retrieval system based on a third-party server, provided as an embodiment of this application. Detailed Implementation

[0018] As mentioned earlier, zero-knowledge encryption technology encrypts a user's sensitive personal data locally on the client side, with only the encrypted ciphertext being uploaded to the application server. The application server never accesses any plaintext data throughout the process. Therefore, even if the server is hacked or the database is compromised, attackers cannot obtain any user's plaintext information. However, this technology has a significant problem: if a user forgets the original encryption password, their sensitive personal data will be permanently lost and unrecoverable.

[0019] To address these issues, existing technologies primarily use the user's email address or mobile phone number as the backup key; alternatively, they store the backup key for the user's original password on the application server and decrypt it when the user forgets their password; or, when the user forgets their password, they directly force a password reset to set a new password and discard the original encrypted data. However, these solutions suffer from several drawbacks: email addresses and mobile phone numbers are easily stolen, hijacked, or tampered with, resulting in extremely low security for the backup key; the application server, once attacked, leads to the leakage of users' sensitive personal data; and users' historical sensitive personal data is permanently lost, severely impacting business continuity.

[0020] To address the aforementioned issues, this application provides a password retrieval method and related products based on a third-party server. The method includes: first, in response to a user-initiated password retrieval request, obtaining a unique identifier corresponding to the user from a third-party server; next, obtaining the original encrypted password corresponding to the user, wherein the original encrypted password is obtained by encrypting it using the unique identifier; and then, decrypting the original encrypted password based on the unique identifier to obtain the original password.

[0021] As can be seen, this solution, when a user initiates a password retrieval request, obtains a unique identifier corresponding to the user from a third-party server and uses this identifier to decrypt the original password ciphertext, which was previously encrypted with that identifier, thereby directly restoring the original password. In this process, the unique identifier used for decryption originates from an independent third-party server, rather than relying on the user's self-provided email address or phone number. This avoids the problem of extremely low backup key security caused by the easy theft, hijacking, or tampering of email addresses or phone numbers. While maintaining the security of zero-knowledge encryption, it fundamentally solves the problem of permanent loss of sensitive personal data due to users forgetting their passwords in zero-knowledge encryption technology.

[0022] Meanwhile, with this solution, the application server only stores the original encrypted password and does not store any backup keys. Even if the application server is attacked, attackers cannot obtain users' sensitive personal data, thus avoiding the risk of user data leakage due to server attacks under existing server-hosted key schemes. Furthermore, this solution directly restores the original password through decryption, eliminating the need for users to reset their passwords or discard existing encrypted data. All of the user's historical sensitive personal data is completely preserved, thus avoiding the permanent loss of user historical data and business continuity issues caused by forced password reset schemes.

[0023] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0024] Figure 1 This is a flowchart illustrating a password retrieval method based on a third-party server, provided as an embodiment of this application. (In conjunction with...) Figure 1 As shown, it may specifically include steps S101-S103.

[0025] S101: In response to a password retrieval request initiated by the user, obtain a unique identifier corresponding to the user from a third-party server.

[0026] In this embodiment of the application, in response to the password retrieval request triggered by the user clicking the "Forgot Password" button, the client pops up an authentication window of the third-party server. The client obtains the authentication information entered by the user when logging into the third-party server through the authentication window, and compares the authentication information with the user's authentication information pre-stored in the third-party server to authenticate the user. If the authentication is successful, the third-party server will return a unique identity identifier corresponding to the user.

[0027] It should be noted that the unique identity identifier returned by the third-party server in this application embodiment is unique and unforgeable, thereby ensuring that the unique identity identifier can accurately and reliably identify the user's identity and prevent impersonation or tampering. For example, the third-party server can be a mainstream platform such as WeChat Open Platform, Alipay Open Platform, the unified identity authentication platform of the National Government Service Platform, or WeChat Work. The unique identity identifier can be a WeChat user identifier returned by WeChat Open Platform, an Alipay user identifier returned by Alipay Open Platform, a government user identifier returned by the National Government Service Platform, or a WeChat Work user identifier returned by WeChat Work, etc.

[0028] Furthermore, this application does not limit the method by which a third-party server generates a unique identifier. Any implementation that can generate a unique identifier that is uniquely bound to the user and cannot be forged is applicable to this application. For example, a third-party server can directly use the unique ID assigned to the user by its internal database as the unique identifier, or it can generate a pseudo-random identifier based on the user's identity information and the client identifier using a hash algorithm as the unique identifier. It should be noted that the unique identifier can be used directly, or it can be used after undergoing conventional preprocessing operations in the art, such as hashing, salting, or encoding conversion. These simple transformations do not depart from the protection scope of this application.

[0029] S102: Obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using a unique identifier.

[0030] In this embodiment of the application, during the registration stage, the user accesses the target information system on the client and clicks the registration button, enters the account information and SMS verification code to set the original password, uses the original password as the master key, and uses the AES-256-GCM algorithm (a highly secure symmetric encryption algorithm) to encrypt the user's sensitive personal information with the master key, thereby generating encrypted personal information.

[0031] Next, the client initiates an authentication request to the third-party server according to the OAuth2.0 protocol standard (an open standard protocol for authorization and authentication). After the user is successfully authenticated, the third-party server returns a unique identifier corresponding to the user to the client and uses this unique identifier as a backup key. The backup key is also encrypted with the AES-256-GCM algorithm to generate the original password ciphertext.

[0032] Subsequently, the client uploads the encrypted personal information and the original encrypted password to the application server, which then associates and stores these two encrypted data with the corresponding user. Therefore, in this embodiment, the application server does not store any plaintext, master key, or backup key. Even if an attacker steals the application server's database, they cannot decrypt any user's sensitive personal data.

[0033] Based on this, when a user forgets their original password, the client sends a ciphertext retrieval request to the application server. The application server responds to the ciphertext retrieval request, finds and returns the original password ciphertext corresponding to the user to the client, and the client receives the original password ciphertext.

[0034] S103: Based on the unique identifier, decrypt the original ciphertext to obtain the original ciphertext.

[0035] In this embodiment, the client uses a unique identifier obtained from a third-party server as the decryption key. Employing the same AES-256-GCM algorithm used during encryption, the client locally decrypts the original password ciphertext to recover the user's original password. The client then displays the original password on the interface for the user to view and record. Therefore, when a user forgets their original password, they only need to complete authentication once on the third-party server to directly view it, without needing to force a password reset. This completely avoids the problem of losing historical data due to password resets and achieves a secure and convenient password retrieval method while fully preserving the security of zero-knowledge encryption.

[0036] Next, the user enters the original password locally on the client and requests the application server to download the encrypted personal information corresponding to the user. The client uses the original password as the master key to decrypt the encrypted personal information locally, thereby obtaining the plaintext personal information.

[0037] Furthermore, as a further improvement of this application, this embodiment supports users binding to multiple third-party servers simultaneously. The client encrypts the original password using the unique identifier returned by each third-party server, thereby generating multiple ciphertexts of the original password and storing them in the application server. When a user forgets their original password, they can select any bound third-party server for authentication to obtain the corresponding unique identifier. Based on this unique identifier, the ciphertext of the original password is decrypted to obtain the original password. Through the above method, this embodiment can further avoid the problem of password retrieval failure due to the malfunction of a single third-party server.

[0038] Therefore, this application embodiment, while fully preserving the security of zero-knowledge encryption, obtains the original password by decrypting the unique identifier obtained from a third-party server, without the need to reset the password, thus avoiding data loss. At the same time, it does not rely on any specific third-party platform, has low implementation cost and strong scalability, and is especially suitable for application scenarios with extremely high requirements for the security of users' sensitive personal data, such as online registration, online education, and medical health.

[0039] It should be noted that this application does not limit the specific type of third-party server. As long as the server supports the OAuth2.0 protocol, it can be used as the third-party authentication service in this solution. Therefore, this application has high versatility and can be compatible with various mainstream third-party servers.

[0040] Based on the above steps S101-S103, it can be seen that, firstly, in response to the user's password retrieval request, a unique identifier corresponding to the user is obtained from a third-party server. Next, the original password ciphertext corresponding to the user is obtained, where the original password ciphertext is encrypted using the unique identifier. Subsequently, based on the unique identifier, the original password ciphertext is decrypted to obtain the original password. It is evident that this solution, when a user initiates a password retrieval request, obtains the unique identifier corresponding to the user from a third-party server and uses this identifier to decrypt the original password ciphertext pre-encrypted with that identifier, thereby directly restoring the original password. In this process, the unique identifier used for decryption originates from an independent third-party server, rather than relying on the user's self-provided email address or mobile phone number. Therefore, it avoids the problem of extremely low backup key security caused by the easy theft, hijacking, or tampering of email addresses or mobile phone numbers. While maintaining the security of zero-knowledge encryption, it fundamentally solves the problem of permanent loss of personal sensitive data due to users forgetting their passwords in zero-knowledge encryption technology.

[0041] Furthermore, Figure 2 This is a schematic diagram illustrating the structure of a password retrieval system based on a third-party server, provided as an embodiment of this application. (Combined with...) Figure 2 As shown, the password retrieval system 200 provided in this application embodiment may include a client 201, an application server 202 and a third-party server 203, wherein the application server 202 communicates with the client 201 and the third-party server 203 respectively; The client 201 is used to respond to a password retrieval request initiated by the user and obtain a unique identity identifier corresponding to the user from the third-party server. The client 201 is used to obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it through the unique identity identifier; The client 201 is used to decrypt the original password ciphertext based on the unique identity identifier to obtain the original password.

[0042] Optionally, the application server 202 is used to store the original password ciphertext and, in response to the ciphertext retrieval request sent by the client, to find and return the original password ciphertext corresponding to the user.

[0043] Optionally, the third-party server 203 is used to authenticate the user and, if the authentication is successful, return a unique identifier corresponding to the user to the client.

[0044] Furthermore, embodiments of this application also provide an electronic device, including: a processor, a memory, and a system bus; The processor and the memory are connected via the system bus; The memory is used to store one or more programs, the one or more programs including instructions that, when executed by the processor, cause the processor to perform any of the implementation steps of the above-described password retrieval method based on a third-party server.

[0045] Furthermore, embodiments of this application also provide a computer-readable storage medium for storing a computer program, which, when executed by a terminal device, implements any of the implementation steps of the above-described password retrieval method based on a third-party server.

[0046] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that all or part of the steps in the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application. It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on describing the differences from other embodiments. The same or similar parts between the various embodiments can be referred to mutually.

[0047] The system disclosed in the embodiments is described in a relatively simple manner because it corresponds to the method disclosed in the embodiments. For relevant details, please refer to the method section.

[0048] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0049] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A third-party server based password recovery method, characterized in that, The method includes: In response to a password retrieval request initiated by a user, a unique identifier corresponding to the user is obtained from a third-party server; Obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identifier; Based on the unique identifier, the original ciphertext is decrypted to obtain the original ciphertext.

2. The method of claim 1, wherein, The step of responding to a user-initiated password retrieval request by obtaining a unique identifier corresponding to the user from a third-party server includes: In response to a password retrieval request initiated by a user, the third-party server authenticates the user. If the authentication is successful, the third-party server returns a unique identifier corresponding to the user.

3. The method of claim 2, wherein, The third-party server authenticates the user, including: Obtain the authentication information entered by the user when logging into the third-party server; The identity authentication information is compared with the user's authentication information pre-stored in the third-party server to verify the user's identity.

4. The method of claim 1, wherein, The step of obtaining the original password ciphertext corresponding to the user includes: Send a ciphertext retrieval request and receive the original password ciphertext corresponding to the user returned in response to the ciphertext retrieval request.

5. The method of claim 1, wherein, The process of decrypting the original ciphertext based on the unique identifier to obtain the original ciphertext includes: Based on a preset symmetric decryption algorithm, the unique identifier is used as the decryption key to decrypt the original ciphertext and obtain the original password.

6. A third-party server based password recovery system, comprising: The password retrieval system is used to perform the method according to any one of claims 1-5, wherein the password retrieval system includes a client, an application server, and a third-party server, and the application server communicates with the client and the third-party server respectively; The client is used to respond to a password retrieval request initiated by the user and obtain a unique identity identifier corresponding to the user from the third-party server. The client is used to obtain the original password ciphertext corresponding to the user, wherein the original password ciphertext is obtained by encrypting it using the unique identity identifier; The client is used to decrypt the original ciphertext based on the unique identifier to obtain the original password.

7. The system of claim 6, wherein, The application server is used to store the original password ciphertext and, in response to the ciphertext retrieval request sent by the client, to find and return the original password ciphertext corresponding to the user.

8. The system according to claim 6, characterized in that, The third-party server is used to authenticate the user and, if the authentication is successful, returns a unique identifier corresponding to the user to the client.

9. An electronic device, characterized in that, The device includes: a processor, a memory, and a system bus; The processor and the memory are connected via the system bus; The memory is used to store a program, the program including instructions that, when executed by the processor, cause the processor to perform the steps of the password retrieval method based on a third-party server as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium is used to store a computer program, and the computer program is executed by a terminal device to implement the steps of the third-party server-based password recovery method in any one of claims 1-5.

Images