Customers online password reset system with verification enhanced and method thereof
Patent Information
- Authority / Receiving Office
- TW · TW
- Patent Type
- Applications
- Current Assignee / Owner
- CHANG HWA BANK
- Filing Date
- 2025-01-02
- Publication Date
- 2026-07-16
AI Technical Summary
Existing password reset methods lack sufficient security, as they are vulnerable to leaks via email or can be easily guessed through social engineering, and OTPs transmitted via SMS are insecure.
An enhanced authentication-based online password reset system that compares user identification codes, mobile phone numbers, and email addresses during the reset process, generating a random password for matching inputs, sending warnings for partial matches, and disabling login for non-matching inputs.
Enhances password reset security by ensuring that only authorized users can reset passwords, reducing the risk of unauthorized access and brute-force attacks.
Smart Images
Figure TWG2TA001067661_001 
Figure TWG2TA001067661_002 
Figure TWG2TA001067661_003
Abstract
Description
[Technical Field]
[0001] This invention relates to a password reset system and method, particularly an enhanced authentication-based online password reset system and method for clients. [Previous Technology]
[0002] In recent years, with the popularization and rapid development of the Internet, various Internet services have sprung up like mushrooms after rain. In order to distinguish whether someone is authorized to use the service, an account and password are usually used for identity verification. However, due to the limited memory of people, when using a large number of Internet services, there are often times when passwords are forgotten. At this time, it is necessary to provide a password reset function.
[0003] Generally, the traditional password reset method involves sending a new password to the email address provided when registering for the service, allowing the user to log in with the new password. However, this method lacks security, as transmitting passwords via email makes them vulnerable to leakage. Another method involves users pre-setting security questions and answers. When a user forgets their password, they can be asked the questions and then enter the correct answers to reset it. However, this method is easily guessed, for example, by obtaining the correct answers through publicly available information or social engineering. Therefore, traditional password reset methods have security limitations.
[0004] In view of this, some manufacturers have proposed One-Time Password (OTP) technology to enhance the security of the password reset process. However, since OTPs are usually transmitted via SMS, and SMS has been proven to be insecure, this method is still insufficient to solve the problem of inadequate security during password reset.
[0005] In summary, it can be seen that the prior art has long suffered from insufficient security in password reset, so it is necessary to propose improved technical means to solve this problem. [Summary of the Invention]
[0006] This invention discloses an enhanced authentication-based online password reset system and method for customers.
[0007] First, this invention discloses an enhanced authentication-based online password reset system for clients, running on a server and allowing client connections. This system includes: a storage module, a receiving module, a judgment module, a comparison module, a reset module, a warning module, and a disable module. The storage module stores multiple user profiles, each containing a reserved identification code, a reserved mobile phone number, and a reserved email address. The receiving module receives password reset requests from clients, where each request includes a user identification code, a mobile phone number, and an email address. The judgment module, connected to the receiving module, compares the user identification code with the reserved identification code of each user profile, and loads the corresponding user profile when the comparison matches. The comparison module, connected to the receiving and judgment modules, compares the mobile phone number and email address with the reserved mobile phone number and email address of the loaded user profile, respectively, and generates a comparison result. The reset module, connected to the comparison module, resets the password when the comparison result shows that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address. When the email address matches the registered email address, a random password is generated to allow access to the password reset page. This password reset page hyperlink and the corresponding random password are then sent to the client, enabling the client to access the password reset page and perform a password reset. A warning module connects to the comparison module to generate a warning message when the comparison result shows that either the mobile phone number or the email address does not match. This warning message is then transmitted via the registered mobile phone number and registered email address. A disable module connects to the comparison module to generate a disable signal to disable online login when both the mobile phone number and email address do not match. This warning message is also transmitted via the registered mobile phone number and registered email address.
[0008] In addition, the present invention also discloses an enhanced authentication-based online password reset method for clients, which runs on a server and allows client connections. The steps include: the server storing multiple sets of user data, each set of user data including a reserved identification code, a reserved mobile phone number, and a reserved email address; the server receiving a password reset request from a client, wherein the password reset request includes a user identification code, a mobile phone number, and an email address; the server comparing the user identification code with the reserved identification code of each set of user data, and loading the corresponding user data when the comparison matches; the server comparing the mobile phone number and email address with the reserved mobile phone number and reserved email address of the loaded user data, respectively, and generating a comparison result; the server, upon finding that the comparison result is a mobile phone number... When the phone number matches the registered mobile number and the email address matches the registered email address, a random password is generated to allow access to the password reset page. The hyperlink to the password reset page and the corresponding random password are sent to the client, enabling the client to access the password reset page and perform a password reset using the random password. If the server finds that either the mobile number or the email address does not match, a warning message is generated and sent via both the registered mobile number and the registered email address. If the server finds that neither the mobile number nor the email address matches, a disabling signal is generated to disable online login, and a warning message is generated and sent via both the registered mobile number and the registered email address.
[0009] The system and method disclosed in this invention are as described above. The difference between this invention and the prior art is that, when resetting a password, the system compares the user identification code, mobile phone number, and email address in the password reset request with the reserved information. When all the comparison results match, a random password that allows opening hyperlinks is generated and sent to the client, enabling the client to perform a password reset based on the random password. When the comparison results partially match, a warning message is generated and sent to the reserved mobile phone number and reserved email address for warning purposes. When all the comparison results do not match, a disabling signal is generated to disable the online login function, and a warning message is sent in the same manner for warning purposes.
[0010] Through the above-mentioned technical means, the present invention can achieve the technical effect of improving the security of password reset.
Implementation Method
[0011] The embodiments of the present invention will be described in detail below with reference to the drawings and examples, so that the implementation process of how the present invention uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.
[0012] Please refer to "Figure 1" first. "Figure 1" is a system block diagram of the enhanced authentication online password reset system of the present invention. It runs on server 110 and allows client 100 to connect. The client 100 and server 110 can use wired networks, such as Ethernet, Power Line Communication (PLC), etc., or wireless networks, such as Wi-Fi, Zigbee, LoRa (Long Range) or similar technologies to connect.
[0013] The enhanced verification-based online password reset system for customers of the present invention includes: a storage module 111, a receiving module 112, a judgment module 113, a comparison module 114, a reset module 115, a warning module 116, and a disabling module 117. The storage module 111 stores multiple user records, each containing a reserved identification code, a reserved mobile phone number, and a reserved email address. In practice, the storage module 111 can be implemented using files, a relational database, or a NoSQL database. Furthermore, the reserved identification code can be unique characters, numbers, symbols, or combinations thereof, such as account numbers, ID card numbers, etc.
[0014] The receiving module 112 is used to receive password reset requests from the client 100, wherein the password reset request includes a user identification code, a mobile phone number, and an email address. In practice, the client 100 can transmit the password reset request via a webpage. For example, the user identification code, mobile phone number, and email address can be entered in the input area of the webpage to generate a password reset request. In addition, when the receiving module 112 receives a password reset request, it can also detect the source address of the password reset request (i.e., the source IP address) and set a weight value corresponding to this source address. The magnitude of the weight value is positively correlated with the priority of executing the password reset request. For example, the larger the weight value, the higher the priority, and vice versa.
[0015] The judgment module 113 is connected to the receiving module 112 to compare the user identification code with the reserved identification code of each user data, and when the comparison matches, the corresponding user data is loaded. For example, assuming the reserved identification code is "A123456789", when the user identification code in the password reset request is also "A123456789", it is considered that the comparison matches and the corresponding user data is loaded.
[0016] The comparison module 114 is connected to the receiving module 112 and the judging module 113, and is used to compare the mobile phone number and email address with the reserved mobile phone number and email address in the loaded user data, respectively, and generate a comparison result. The actual comparison method is to compare the mobile phone number with the reserved mobile phone number and the email address with the reserved email address. There are four possible comparison results: the first is that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address; the second is that the mobile phone number matches the reserved mobile phone number, but the email address does not match the reserved email address; the third is that the mobile phone number does not match the reserved mobile phone number, but the email address matches the reserved email address; and the fourth is that the mobile phone number does not match the reserved mobile phone number and the email address does not match the reserved email address. In practice, "1,1", "1,0", "0,1", and "0,0" can be used sequentially to represent the four cases mentioned above and serve as the comparison results. "1" indicates a match, and "0" indicates a mismatch. The part before the comma represents the comparison result for the mobile phone number, and the part after the comma represents the comparison result for the email address. Furthermore, if a weight value corresponding to the source address is set, the comparison module 114 can use regular expressions to check the format of the mobile phone number and email address during the comparison. If the format is invalid, the comparison will be stopped and an error message will be output. The weight value can also be adjusted to reduce the priority of password reset requests from the source address. In other words, when the input format is invalid, not only will the current comparison be stopped, but subsequent password reset requests from the same source address will be prioritized, with password reset requests from sources other than this one being executed first.
[0017] The reset module 115 connects to the comparison module 114 to generate a random password that allows opening the hyperlink when the comparison result is that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address (e.g., the comparison result is "1,1"). The hyperlink and its corresponding random password are then sent to the client so that the client 100 can open the hyperlink with the random password to perform a password reset.
[0018] The warning module 116 is connected to the comparison module 114 to generate a warning message when the comparison result shows that the mobile phone number and the email address do not match (e.g., the comparison result is "0,1" or "1,0"). The warning message is then transmitted via the reserved mobile phone number and the reserved email address to issue a warning. In practice, after the warning message is generated, the warning module 116 can adjust the weight value to reduce the priority of executing the password reset request for this source address, and can accumulate the number of warning messages generated (i.e., the cumulative count). When the cumulative count reaches a preset number, the receiving module 112 is driven to discard the password reset request for this source address within a specified time range (e.g., in hours, minutes, or seconds). The cumulative count is then initialized again after this time range is exceeded, such as resetting the cumulative count to zero.
[0019] The disable module 117 is connected to the comparison module 114 to generate a disable signal to disable the online login function when the comparison result shows that both the mobile phone number and email address do not match (e.g., the comparison result is "0,0"). A warning message is also generated and sent via the reserved mobile phone number and email address for alerting the user. In practice, after the disable signal is generated, the receiving module 112 can be driven to continuously discard password reset requests from this source address until an identity verification packet containing the warning message is received. That is, after receiving the identity verification packet, the module stops discarding password reset requests from this source address.
[0020] It is particularly noted that in practical embodiments, the modules of the present invention may be implemented in various ways, comprising firmware, hardware or arbitrary combinations thereof, e.g., in certain embodiments, the modules may be implemented using firmware and hardware or one of them, in addition, the invention may also be implemented partially or completely based on hardware, e.g Programmable Logic Device (CPLD), Field Programmable Gate Array (FPGA), etc. to implement. The invention may be systems, methods and / or computer programs. The computer program may include computer-readable storage media uploaded with computer-readable program instructions for enabling the processor to implement various aspects of the invention, the computer-readable storage media may be a tangible device that can hold and store instructions for use by the command-executing device. Computer-readable storage media may be, but are not limited to, electrical storage equipment, magnetic storage equipment, optical storage equipment, electromagnetic storage equipment, semiconductor storage equipment, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a nonexhaustive list) include: hard drives, random access memory, read-only memory, flash memory, optical discs, floppy disks, and any suitable combination of the above. The computer-readable storage media used here are not construed as instantaneous signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagated through waveguides or other transmission media (e.g., optical signals via fiber optic cables), or electrical signals transmitted through wires. Additionally, the computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing equipment, or to an external computer equipment or external storage equipment via a network, such as an Internet, LAN, WAN, and / or wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, hubs and / or gateways. The network card or network interface in each computing / processing equipment receives computer-readable program instructions from the network and forwards these computer-readable program instructions for storage in the computer-readable storage media in the respective computing / processing equipment.The computer program instructions that execute the operations of this invention can be assembly language instructions, instruction set architecture instructions, machine instructions, machine-dependent instructions, microinstructions, firmware instructions, or source code or object code written in any combination of one or more programming languages. The programming languages include object-oriented programming languages such as Common Lisp, Python, C++, Objective-C, Smalltalk, Delphi, Java, Swift, C#, Perl, Ruby, and PHP, as well as conventional procedural programming languages such as C or similar languages. The computer program instructions can be executed entirely on the computer, partially on the computer, partially on a client computer and partially on a remote computer, or entirely on a remote computer or server.
[0021] Please refer to Figures 2A and 2B. Figures 2A and 2B are flowcharts of the enhanced authentication online password reset method for clients according to the present invention. The method runs on server 110 and allows client 100 to connect. The steps include: server 110 storing multiple sets of user data, each set of user data including a reserved identification code, a reserved mobile phone number, and a reserved email address (step 210); server 110 receiving a password reset request from client 100, wherein the password reset request includes a user identification code, a mobile phone number, and an email address (step 220); server 110 comparing the user identification code with the reserved identification code of each set of user data, and loading the corresponding user data when the comparison matches (step 230); server 110 comparing the mobile phone number and email address with the reserved mobile phone number and reserved email address of the loaded user data, respectively. The server 110 generates a comparison result (step 240); when the comparison result shows that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address, the server 110 generates a random password that allows opening a hyperlink and sends the hyperlink and its corresponding random password to the client 100, so that the client 100 can open the hyperlink with the random password to perform a password reset (step 250); when the comparison result shows that the mobile phone number and the email address do not match, the server 110 generates a warning message and sends the warning message through the reserved mobile phone number and the reserved email address for warning purposes (step 260); and when the comparison result shows that neither the mobile phone number nor the email address matches, the server 110 generates a disable signal to disable the online login function, generates a warning message and sends the warning message through the reserved mobile phone number and the reserved email address for warning purposes (step 270). Through the above steps, when resetting a password, the system compares the user identification code, mobile phone number, and email address in the password reset request with the pre-registered information. If all the comparison results match, a random password that allows opening hyperlinks is generated and sent to the client, enabling the client to perform a password reset based on the random password. If the comparison results partially match, a warning message is generated and sent to the pre-registered mobile phone number and email address as a warning. If all the comparison results do not match, a disabling signal is generated to disable the online login function, and a warning message is sent in the same manner as a warning.
[0022] The following description, in conjunction with Figures 3A to 4, illustrates an embodiment. Please refer to Figures 3A to 3C, which are schematic diagrams illustrating the application of this invention to perform a password reset. Assume a user on client 100 forgets their password when logging into server 110. The user can click the "Forgot Password" hyperlink on the login page to access the password reset request page 300. Next, the user enters their user identification code in the user identification code input block 311, their mobile phone number in the mobile phone number input block 312, and their email address in the email address input block 313. After entering the information, the user clicks the confirmation element 320. At this point, a password reset request containing the user identification code, mobile phone number, and email address is generated and sent to server 110. Next, server 110 compares the user identification code with the reserved identification code in each user's profile. If the comparison matches (indicating the existence of this user), the corresponding user information is loaded. Then, based on the loaded user information, the server compares the mobile phone number and email address with the reserved mobile phone number and email address, generating a comparison result, such as: all matches, partially matches, or all does not match. Based on the comparison result, appropriate processing is performed. For example, if all matches, server 110 generates a random password that allows opening a hyperlink (pointing to a webpage entry that can perform a password reset) and sends this hyperlink and its corresponding random password to client 100. In this way, client 100 can then proceed as shown in Figure 3B. As shown, in browser 350, type this hyperlink into address bar 351 to display verification page 360. Enter the random password in random password input block 361 on verification page 360 and click the confirmation element 362. If the random password is correct, the hyperlink will open to access password reset page 370 as shown in "Figure 3C". After entering the same new password in different input blocks (371, 372), click the confirmation element 373 to perform a password reset, changing the old password to the new password. This completes the password reset process.
[0023] As shown in Figure 4, Figure 4 is a schematic diagram illustrating the transmission of warning messages using the present invention. If the comparison results are not entirely consistent as described above, the server 110 will generate a warning message 410 and send the warning message 410 to the mobile phone number and email address reserved by the user on the server 110 as a warning. In this way, the user can view the warning message 410 through the email client program 400 to learn that someone has attempted to perform a password reset with incorrect information (such as an incorrect mobile phone number or email address). If this operation was not performed by the user, they can reset a longer or more complex password to reduce the risk of brute-force attack. In addition, when the comparison results are completely inconsistent, the server 110 will further generate a disabling signal to disable the online login function, for example, by disabling or hiding the login button, until a specified time (e.g., 5 minutes later) has elapsed. In practice, the specified time can be dynamically adjusted according to the number of warning messages generated. For example, the more warning messages are generated, the longer the specified time is adjusted to increase the difficulty of brute-force attacks.
[0024] In summary, the difference between the present invention and the prior art lies in that, when resetting a password, the user identification code, mobile phone number, and email address in the password reset request are compared with the reserved information. When all the comparison results match, a random password that allows opening hyperlinks is generated and sent to the client, enabling the client to perform a password reset based on the random password. When the comparison results partially match, a warning message is generated and sent to the reserved mobile phone number and reserved email address for warning purposes. When all the comparison results do not match, a disabling signal is generated to disable the online login function, and a warning message is sent in the same manner for warning purposes. This technical means can solve the problems existing in the prior art, thereby achieving the technical effect of improving the security of password reset.
[0025] Although the present invention has been disclosed above with reference to the foregoing embodiments, it is not intended to limit the present invention. Any person skilled in the art may make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of patent protection of the present invention shall be determined by the scope of the patent application attached to this specification. [Simplified Explanation of the Diagram]
[0026] Figure 1 is a system block diagram of the enhanced authentication online password reset system of the present invention. Figures 2A and 2B are flowcharts of the enhanced authentication online password reset method of the present invention. Figures 3A to 3C are schematic diagrams of applying the present invention to perform password reset. Figure 4 is a schematic diagram of applying the present invention to transmit warning messages.
Claims
1. An enhanced authentication-based online password reset system for clients, running on a server and allowing a client to connect, the system comprising: a storage module for storing multiple user profiles, each user profile including a pre-reserved identification code, a pre-reserved mobile phone number, and a pre-reserved email address; and a receiving module for receiving a password reset request from the client, detecting a source address of the password reset request, and setting a weight value corresponding to the source address, wherein... The password reset request includes a user identification code, a mobile phone number, and an email address. The weight value is positively correlated with the priority of executing the password reset request. A judgment module, connected to the storage module and the receiving module, compares the user identification code with the reserved identification code of each user profile, and loads the corresponding user profile when the comparison matches. A comparison module, connected to the receiving module and the judgment module, compares the mobile phone number and the email address with the reserved mobile phone number and the reserved email address of the loaded user profile, respectively, and generates a comparison result. A reset module, connected to the comparison module, generates a random password that allows opening a password reset page when the comparison result shows that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address. The reset module then transmits the password reset page and the corresponding random password to the client, enabling the client to open the password reset page using the random password to perform a password reset. A warning module, connected to the comparison module, is configured to generate a warning message when the comparison result indicates that the mobile phone number and the email address do not match, and transmit the warning message through the reserved mobile phone number and the reserved email address for alerting the user; and a disabling module, connected to the comparison module, is configured to generate a disabling signal to disable the online login function when the comparison result indicates that neither the mobile phone number nor the email address matches, and generate the warning message and transmit the warning message through the reserved mobile phone number and the reserved email address for alerting the user, wherein, after the disabling signal is generated, the receiving module is driven to continuously discard the password reset request from the source address until an identity verification packet containing the warning message is received.
2. As in request item 1, the enhanced authentication online password reset system for customers, wherein the comparison module, when performing the comparison, uses regular expressions to check the format of the mobile phone number and the email address, and stops the comparison and outputs an error message when the format is invalid, and adjusts the weight value to reduce the priority of executing the password reset request from the source address.
3. As in request item 1, the enhanced authentication online password reset system for customers, wherein after the warning message is generated, the weight value is adjusted to reduce the priority of executing the password reset request from the source address, and when the cumulative number of times the warning message is generated reaches a preset number, the receiving module is driven to discard the password reset request from the source address within a time range, until the time range is exceeded and the cumulative number is initialized again.
4. A method for resetting an online password for a client with enhanced authentication, running on a server and allowing a client to connect, comprising the following steps: The server stores multiple user profiles, each containing a reserved identification code, a reserved mobile phone number, and a reserved email address. The server receives a password reset request from the client, detects the source address of the password reset request, and sets a weight value corresponding to the source address. The password reset request includes a user identification code, a mobile phone number, and an email address, and the weight value is positively correlated with the priority of executing the password reset request. The server compares the user identification code with the reserved identification code of each user profile, and loads the corresponding user profile if the comparison matches. The server compares the mobile phone number and email address with the reserved mobile phone number and reserved email address of the loaded user profile, respectively, and generates a comparison result. When the comparison result shows that the mobile phone number matches the reserved mobile phone number and the email address matches the reserved email address, the server generates a random password that allows access to a password reset page and sends the password reset page and the corresponding random password to the client, enabling the client to access the password reset page and perform a password reset using the random password. When the comparison result shows that the mobile phone number does not match either the mobile phone number or the email address, the server generates a warning message and sends the warning message through the reserved mobile phone number and the reserved email address for alerting the client. When the comparison result shows that neither the mobile phone number nor the email address matches, the server generates a disable signal to disable the online login function and generates the warning message and sends the warning message through the reserved mobile phone number and the reserved email address for alerting the client. After the disable signal is generated, the server continuously discards password reset requests from the source address until it receives an identity verification packet containing the warning message.
5. The enhanced authentication online password reset method for customers as described in request item 4, wherein when the server performs the comparison, it uses regular expressions to check the format of the mobile phone number and the email address, and stops the comparison and outputs an error message when the format is invalid, and adjusts the weight value to reduce the priority of executing the password reset request from the source address.
6. As in request item 4, the enhanced authentication online password reset method for clients, wherein after the warning message is generated, the server adjusts the weight value to reduce the priority of executing the password reset request from the source address, and when the cumulative number of times the warning message is generated reaches a preset number, the server discards the password reset request from the source address within a time range until the time range is exceeded before re-initializing the cumulative number.