CN104836660A - Password management method and system - Google Patents

Abstract

The present invention discloses a password management method, which includes transmitting a session key from a first device to a second device by using a first communication method, wherein the session key is generated by the first device; The second device returns a first ciphertext to the first device, the first ciphertext is obtained by the second device using the session key to encrypt a protection password, the protection password is determined by the first The second device is dynamically generated randomly. The invention also discloses a password management system.

Description

Password management method and system

technical field

The invention relates to the field of password management, in particular to a password management method and system.

Background technique

With the prevalence of e-commerce in recent years, online trading has become a popular trading method, which also brings some trading risks. In order to improve the security of the transaction, people have to adopt some security measures to ensure the security of the transaction. The input of the password is one of them, but this is not just an impenetrable wall.

Since the password is often set by the user, the password will inevitably have personal traces. In addition, users may use the same password to log in to different accounts. If the password of a certain account is leaked, the passwords of other accounts may also be cracked. All of these have brought hidden dangers to the security of passwords.

In order to solve this problem, the invention patent application with the application number 201210225542.X and the title of the invention as "a password management method and system" proposes a password management method. The method includes: when receiving a user's request for a password of an account, randomly generating a password for the account; storing the corresponding relationship between the account and the password; and initiating an operation of outputting the password when an event of logging into the account is detected. The scheme realizes the diversification of passwords by randomly generating passwords, thereby improving information security. In addition, when it is detected that the user needs to input a password, an operation of outputting the password is initiated, so that the user does not need to memorize the password, which facilitates the password management of the user. However, this solution only saves the corresponding relationship between passwords and accounts, and does not consider protecting the password transmission process.

The invention patent application with the application number 201110000718.7 and the invention title "A password management system and method" proposes a password management system, but the password management system has no protection for the communication channel. Once a monitoring program appears, the password will be leaked. And for individual users, the remote server is not necessarily safe.

It can be seen that in the existing password management system, on the one hand, Internet servers are used as storage media, and personal password privacy cannot be effectively guaranteed. On the other hand, traditional network communication transmission is used. Once the transmission channel is monitored and stolen, user passwords will be leaked. .

Contents of the invention

The invention proposes a password management method and system for separating communication channels. In the solution of the present invention, the communication between the PC and the smart terminal (such as a mobile phone) is divided into two communication channels, namely the two-dimensional code and the network channel. By separating the communication channels, information leakage on a single channel can be prevented, ensuring Security of password transmission.

According to one aspect of the present invention, there is provided a password management method, including: using a first communication method to transmit a session key from a first device to a second device, wherein the session key is generated by the first device; using The second communication method returns a first ciphertext from the second device to the first device, the first ciphertext is obtained by the second device using the session key to encrypt a protection password, and the protection The password is dynamically and randomly generated by the second device.

In the password management method above, the first device is a computer plug-in, and the second device is mobile phone software.

In the password management method above, using the first communication method to transmit the session key from the first device to the second device includes: the first device displays the session key to be transmitted on a computer screen in the form of a two-dimensional code picture, And the second device uses a two-dimensional code key to analyze the image data to obtain the session key, wherein the two-dimensional code key is shared by the first device and the second device.

In the password management method above, using the second communication method to return the first ciphertext from the second device to the first device includes: the second device dynamically and randomly generates a protection password, and uses the obtained session key encrypting the protection password to generate a first ciphertext; and the second device transmits the first ciphertext to the first device through a local area network.

The above password management method may further include: the first device decrypts the first ciphertext by using the session key, so as to obtain the protection password.

The above-mentioned password management method may further include: the second device encrypts the protection password with a master key to obtain a second ciphertext and stores it, wherein the master key is used by the second device at Randomly generated during the initialization process.

In the password management method above, the second ciphertext corresponds to the URL of a specific website, so that the second device can retrieve the second ciphertext corresponding to the website through the URL of the website to be visited, and then obtain the protection password .

According to another aspect of the present invention, a password management system is provided. The password management system includes a first device and a second device, wherein the first device is configured to generate a session key and send the session key to the second device by using a first communication method; the second device The second device is configured to dynamically and randomly generate a protection password, use the session key to encrypt the protection password to obtain a first ciphertext, and return the first ciphertext to the first device by using a second communication method.

In the above password management system, the first device is a computer plug-in, and the second device is mobile phone software.

In the password management system above, the first device is configured to: display the session key to be transmitted on the computer screen in the form of a two-dimensional code picture, and use the two-dimensional code key to analyze the picture data, so as to obtain the session A key, wherein the two-dimensional code key is shared by the first device and the second device.

In the above password management system, the second device is configured to: transmit the first ciphertext to the first device through a local area network.

In the password management system above, the first device is further configured to: use the session key to decrypt the received first ciphertext, so as to obtain the protection password.

In the password management system above, the second device is further configured to: use a master key to encrypt the protection password to obtain a second ciphertext and store the second ciphertext, wherein the master key The key is randomly generated by the second device during the initialization process.

In the password management method above, the second ciphertext corresponds to the URL of a specific website, so that the second device can retrieve the second ciphertext corresponding to the website through the URL of the website to be visited, and then obtain the protection password .

By adopting the technical scheme of the present invention, the user's PC no longer saves the password, and only obtains it from the mobile phone when the password is needed, thereby ensuring the security of password storage. In addition, since the key transmission from the PC to the mobile phone uses a QR code image, traditional network communication is not used, which protects the session key from being stolen. Furthermore, the generated QR code image is encrypted, and the key is dynamically variable, which ensures the security of the transmission channel. The password protection in the technical solution of the present invention is based on the mobile phone terminal designated by the user, and the data communication in it is all completed locally without a remote server, which can ensure that the password is not leaked and the password security is ensured. By using this solution, the user can conveniently and quickly save the personal password in the designated mobile terminal, and the personal mobile phone is carried with him, which is very convenient for use.

Description of drawings

Those skilled in the art will understand various aspects of the present invention more clearly after reading the detailed description of the present invention with reference to the accompanying drawings. Those skilled in the art should understand that: these drawings are only used to describe the technical solutions of the present invention in conjunction with specific implementation methods, and are not intended to limit the protection scope of the present invention.

Fig. 1 is a schematic diagram of an initialization process of password management according to an embodiment of the present invention;

Fig. 2 is a schematic diagram of a password generation process according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of a password usage flow according to an embodiment of the present invention.

Detailed ways

The following introduces some of the possible embodiments of the present invention, which are intended to provide a basic understanding of the present invention, but are not intended to identify key or decisive elements of the present invention or limit the scope of protection. It is easy to understand that, according to the technical solution of the present invention, those skilled in the art may propose other alternative implementation manners without changing the essence and spirit of the present invention. Therefore, the following specific embodiments and drawings are only exemplary descriptions of the technical solution of the present invention, and should not be regarded as the entirety of the present invention or as a limitation or restriction on the technical solution of the present invention.

According to an embodiment of the present invention, a password management system may include a first device and a second device. The first device may be configured to generate a session key and send the session key to the second device using the first communication method. The second device is configured to dynamically and randomly generate a protection password, use the session key to encrypt the protection password to obtain the first ciphertext, and use the second communication method to return the first ciphertext to the first device.

Since two different communication methods are used to transmit the key and ciphertext, even if one of the transmission channels (such as the network) is monitored, the password to be protected by the user will not be leaked, because at this time only the passed The first ciphertext encrypted with the session key.

In order to provide network security, the first device and the second device can be located in the same local area network. Moreover, the first device may share the two-dimensional code key with the second device in some way to encrypt and decrypt the two-dimensional code picture, so that even if the two-dimensional code picture is captured and analyzed by a malicious program, the two-dimensional code picture The content in will not be leaked either.

In a specific embodiment, the first device may be a computer plug-in, such as a plug-in in a PC browser. The second device may be smart terminal software, such as password management software on a mobile phone.

Fig. 1 schematically shows a password initialization process according to an embodiment of the present invention. First, make sure that the PC and the mobile phone are in the same local area network, so that the PC can connect to the mobile phone software through the local network. Then, the PC plug-in sends the QR code key to the mobile phone software as a detection request. After detecting the probe request, the software on the mobile phone sends a reply. Subsequently, the mobile terminal software randomly generates a strong password P1, which is used as the master key for encrypted storage of the password. Finally, the mobile phone software saves the QR code key. So far, the initialization process is completed.

Fig. 2 schematically shows a password generation process according to an embodiment of the present invention. As shown in Figure 2, the PC plug-in and mobile phone software have been initialized and can work normally. The user opens the website registration page in the browser. When the browser plug-in detects the registration page, the browser plug-in generates a random session key Key according to the URL, and the plug-in generates a custom QR code image according to the Key and URL, and displays it on the screen. Then, the software on the mobile phone scans the QR code, uses the QR code key to analyze the picture data, obtains information such as the session key Key and URL, recognizes that this is a registration request, and detects and extracts the Key, URL and other information. Then, the mobile phone software dynamically generates a random strong password P2, encrypts P2 with the master key P1 generated in the initialization process to obtain the ciphertext S1, and stores the URL and S1 in the mobile phone database. Then, the software on the mobile phone uses the session key Key to encrypt P2 to obtain the ciphertext S2, and sends S2 to the plug-in. Finally, the plug-in uses the session key Key to decrypt S2, obtains P2 and fills the password into the page password box.

Fig. 3 schematically shows a password usage process according to an embodiment of the present invention. A user opens a website login page in a browser. When the browser plug-in detects the login page, it generates a random session key Key, generates a QR code image according to the Key and URL, and displays the QR code image on the screen. Next, the software on the mobile phone scans the QR code, uses the QR code key to analyze the image data, obtains information such as the session key Key and URL, recognizes that this is a login request, and detects the Key and URL in the extraction request. The mobile phone software can obtain the ciphertext S1 corresponding to the password from the database according to the URL, decrypt S1 into plaintext using the master key P1, and encrypt the plaintext using the session key Key to generate ciphertext S2. Then, the mobile terminal software transmits S2 to the browser plug-in, and the plug-in receives S2 and uses the session key to decrypt it to obtain the password. Finally, the plugin fills the password into the page password box.

By adopting the technical scheme of the present invention, the user's PC no longer saves the password, and only obtains it from the mobile phone when the password is needed, thereby ensuring the security of password storage. In addition, since the key transmission from the PC to the mobile phone uses a QR code image, traditional network communication is not used, which protects the session key from being stolen. Furthermore, the generated QR code image is encrypted, and the key is dynamically variable, which ensures the security of the transmission channel. The password protection in the technical solution of the present invention is based on the mobile phone terminal designated by the user, and the data communication in it is all completed locally without a remote server, which can ensure that the password is not leaked and the password security is ensured. By using this solution, the user can conveniently and quickly save the personal password in the designated mobile terminal, and the personal mobile phone is carried with him, which is very convenient for use.

Hereinbefore, specific embodiments of the present invention have been described with reference to the accompanying drawings. However, those skilled in the art can understand that without departing from the spirit and scope of the present invention, various changes and substitutions can be made to the specific embodiments of the present invention. These changes and substitutions all fall within the scope defined by the claims of the present invention.

Claims (14)

1. a cipher management method, comprising:

Utilize first communication party formula to transmit session key from first device to the second device, wherein said session key is generated by described first device;

Second communication method is utilized to return the first ciphertext from described second device to described first device; described first ciphertext is that described second device utilizes described session key to be encrypted gained to protection password, and described protection password is generated by described second device dynamic random.

2. cipher management method as claimed in claim 1, wherein, described first device is computer socket, and described second device is intelligent terminal software.

3. cipher management method as claimed in claim 2, wherein, utilizes first communication party formula to transmit session key from first device to the second device and comprises:

Described first device transmits session key with the display of the form of two-dimension code image on the computer screen by waiting, and

Described second device utilizes Quick Response Code key-parsing image data, thus obtains described session key,

Wherein, described Quick Response Code key is shared by described first device and described second device.

4. cipher management method as claimed in claim 2, wherein, utilizes second communication method to return the first ciphertext from described second device to described first device and comprises:

Described second device dynamic random generates protection password, and utilizes the session key obtained to be encrypted by described protection password, thus generates the first ciphertext; And

Described second device sends described first ciphertext to described first device by local area network (LAN).

5. cipher management method as claimed in claim 1, also comprises:

Described first device utilizes described session key to be decrypted described first ciphertext, to obtain described protection password.

6. cipher management method as claimed in claim 1, also comprises:

Described second device utilizes master key to be encrypted described protection password to obtain the second ciphertext and to store, and wherein said master key is by described second device stochastic generation in initialize flow.

7. cipher management method as claimed in claim 6, wherein, described second ciphertext is corresponding with the URL of specific website, makes described second device retrieve second ciphertext corresponding with this website by the URL of wanted access websites, and and then acquisition protect password.

8. a password management system, is characterized in that, comprising: first device and the second device,

Wherein, described first device is configured to session key generation and utilizes first communication party formula that described session key is sent to described second device;

Wherein, described second device is configured to dynamic random and generates protection password, utilizes described session key be encrypted described protection password thus obtain the first ciphertext, and utilizes second communication method to return described first ciphertext to described first device.

9. password management system as claimed in claim 8, wherein, described first device is computer socket, and described second device is intelligent terminal software.

10. password management system as claimed in claim 9, wherein, described first device is configured to:

Session key is transmitted with the display of the form of two-dimension code image on the computer screen by waiting, and

Utilize Quick Response Code key-parsing image data, thus obtain described session key, wherein, described Quick Response Code key is shared by described first device and described second device.

11. password management system as claimed in claim 9, wherein, described second device is configured to:

Described first ciphertext is sent to described first device by local area network (LAN).

12. password management system as claimed in claim 8, wherein, described first device is also configured to:

Described session key is utilized to be decrypted the first received ciphertext, to obtain described protection password.

13. password management system as claimed in claim 8, wherein, described second device is also configured to:

Utilize master key to be encrypted described protection password to obtain the second ciphertext and described second ciphertext to be stored, wherein said master key is by described second device stochastic generation in initialize flow.

14. cipher management methods as claimed in claim 13; wherein; described second ciphertext is corresponding with the URL of specific website, makes described second device retrieve second ciphertext corresponding with this website by the URL of wanted access websites, and and then obtains protection password.