WO2009155813A1

WO2009155813A1 - Method for storing encrypted data in client and system thereof

Info

Publication number: WO2009155813A1
Application number: PCT/CN2009/071883
Authority: WO
Inventors: 陈启祥; 陈定佳; 傅建兵
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2008-06-27
Filing date: 2009-05-20
Publication date: 2009-12-30
Also published as: CN101309278B; CN101309278A

Abstract

A method for storing encrypted data in client is provided by the present invention. The following steps are included in the method: a server authenticates a login password from a client, and transmits an encryption object with the current time of the server side to the client; the client encrypts the login password and the encryption object to generate encrypted data; the client stores the encrypted data generated by the validated login password and the corresponding encryption object. A system for storing encrypted data in client is also provided by the present invention. The method and system for storing encrypted data in client provided by the present invention enhance the security of storing encrypted data in client.

Description

Method and system for storing encrypted data on client

Technical field

The present invention relates to the field of communication networks, and in particular, to a method and system for storing encrypted data on a client. Background of the invention

In general, when the user uses the software or application provided by the server with the permission, the user usually needs to input the corresponding login account and login password to prevent illegal users from using it. To facilitate user login, the client provides the "remember password" function of the login account. The user uses the "remember password" function when logging in for the first time, and the remember password ticket corresponding to the login account and the login password is saved on the client. When the user logs in again on the same client, he only needs to provide the login account, and the client will directly read the corresponding remember password ticket according to the login account and log in to the account.

Referring to FIG. 1 , a flow chart of a method for saving encrypted data on a client in the prior art. The method includes the following steps:

Step 101: The user enters a login account and a login password on a client login interface, and selects the "remember password" function;

Step 102: The client hashes the password of the login password or the password obtained by hashing the login password as a password password ticket according to the login account and the login password provided by the user, and saves the password ticket.

When the user logs in again at the client, the login account is input, and the client extracts the password for the password corresponding to the login account according to the login account provided by the client, and transmits the password to the server.

The server verifies whether the received password ticket and the saved login password information are received. Match, if yes, think that the login password is correct, allow the user to log in directly; if no, return the login password error message, the client prompts the user to re-enter the login password.

The login password information saved by the server may be the plain text of the login password or the password hash corresponding to the plaintext of the login password. If the server saves the password of the login password, first calculate the corresponding password hash according to the plaintext of the login password, and then verify whether the calculated password hash is the same as the received password hash; if the server saves the password hash , directly verify that the password hash stored by itself is the same as the received password hash.

The above method for saving the remember password ticket on the client directly saves the login password plaintext or password hash as a remember password ticket to the local client.

Obviously, this approach is very unsafe. If the user forgets to cancel the function after using the "remember password" function on the client in public, the generated remember password ticket will be saved on the client and can be easily obtained by others. When the remember password ticket is the login password plaintext, the login password is directly stolen; when the remember password ticket is a password hash, as long as the password hash calculation method is known, the hash may be hashed according to the password. The column result database reverses the plaintext of the login password, causing the login password to be stolen. Summary of the invention

The technical problem to be solved by the present invention is to provide a method and system for storing encrypted data on a client to enhance the security of storing encrypted data on the client.

In order to solve the above technical problem, the present invention provides a method for storing encrypted data on a client, the method comprising: the server authenticating a login password of the client, and transmitting the encrypted object including the current time information of the server to the client; The client encrypts the login password and the encrypted object to generate encrypted data; the client saves the login password passed by the verification and the encrypted data generated by the corresponding encrypted object.

The present invention also provides a system for storing encrypted data on a client, including a client and The server, the client encrypts the login password and the encrypted object sent by the server, generates encrypted data, and stores the login password verified by the server and the encrypted data generated by the corresponding encrypted object; the server, the login to the client The password is verified, and the encrypted object including the current time information on the server side is sent to the client.

Compared with the prior art, the present invention has the following advantages:

In the method described in the embodiment of the present invention, the encrypted data stored in the client is encrypted by using the hash data obtained by hashing the login password as a key, and encrypting the encrypted object returned by the server including the current time. When the encrypted data is acquired, even if it is known that the encryption algorithm is used, since it is difficult to obtain information about the encrypted object, only the hash data related to the login password as the key is obtained based on the encrypted data. The possibility is very small, ensuring the security of storing encrypted data. Compared with the prior art, only the cryptographic hash is used as the cryptographic ticket, which greatly enhances the security of storing encrypted data on the client.

In the method of the embodiment of the present invention, the server returns an encrypted object including the current time, and the current time is a time when the client first performs password saving. Even if another person can successfully log in according to the encrypted data stored on the client, the server compares the time when the first password is saved in the encrypted object with the time of the login, when the password is saved for the first time and the time of the login. When the interval is too large, the server notifies the client to refuse to automatically log in to the account, prompting the user to re-enter the login password. Therefore, even if another person can successfully log in according to the encrypted data stored in the client, the account cannot be used for a long time, and the automatic login function of the account will be automatically canceled within a certain period of time. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a flow chart of a method for storing encrypted data on a client in the prior art; FIG. 2 is a flowchart of a method for saving encrypted data at a client according to the present invention; 3 is a flow chart of a first scheme for saving encrypted data on a client according to the present invention;

4 is a second schematic flowchart of a method for storing encrypted data on a client according to the present invention;

FIG. 5 is a third schematic flowchart of a method for storing encrypted data on a client according to the present invention; FIG.

6 is a flowchart of a method for storing encrypted data on a client according to an embodiment of the present invention; FIG. 7 is a flowchart of a method for saving encrypted data on a client according to a first embodiment of the present invention;

Figure 8 is a flow chart showing the automatic registration of the method of storing encrypted data on the client side according to the first embodiment of the present invention;

9 is a flow chart of a method for storing encrypted data on a client according to a second embodiment of the present invention;

FIG. 10 is a flowchart of implementing automatic login by storing a method of encrypting data on a client according to a second embodiment of the present invention; FIG.

FIG. 11 is a system diagram of storing encrypted data on a client according to a first embodiment of the present invention; FIG. 12 is a system diagram for storing encrypted data on a client according to a second embodiment of the present invention. Mode for carrying out the invention

The present invention will be further described in detail with reference to the accompanying drawings and specific embodiments.

2 is a flow chart of a method for storing encrypted data on a client according to the present invention. As shown in FIG. 2, the method includes:

Step 21: The server verifies the login password of the client, and sends the encrypted object including the current time information of the server side to the client. Step 22: The client encrypts the login password and the encrypted object to generate encrypted data.

Step 23: The client saves the login password passed by the verification and the encrypted data generated by the corresponding encrypted object.

Because the encrypted data saved by the client in the present invention is generated by the login password and the corresponding encrypted object, wherein the login password verification ensures the validity of the current client, the encrypted object including the server side time information is difficult to be The third party obtains that the encrypted data is difficult to be cracked or falsified. Therefore, the application of the present invention can enhance the security of storing encrypted data on the client.

As for the specific technical details of how to verify the client login password, including the information including the server-side current time information, the verification client login password, and the specific order of returning the encrypted object, various schemes can be used. The implementation of the present invention does not constitute a limitation of the present invention. The following is a description of the corresponding technical solutions. Referring to FIG. 3, FIG. 3 is a flowchart of a first scheme for saving encrypted data on a client according to the present invention. As shown in Figure 3, the process includes:

Step 310: The server sends an encrypted object including the current time information of the server side to the client according to the request of the client.

Step 320: The client encrypts the login password and the encrypted object, generates encrypted data, and sends the generated encrypted data to the server.

Step 330: The server verifies the encrypted data. If the verification succeeds, the server sends an indication of the login password verification, and the client saves the login password verified by the verification and the encrypted data generated by the corresponding encryption object.

Referring to FIG. 4, FIG. 4 is a flowchart of a second method for storing encrypted data on a client according to the present invention. As shown in FIG. 4, the process includes:

Step 410: The server will include the current time letter of the server side according to the request of the client. The encrypted object is sent to the client.

Step 420: The client sends the login password information to the server, and receives the verification result returned by the server.

The login password information in this step can be either a login password or a function such as a login password.

Step 430: The client encrypts the login password and the encrypted object that are verified by the authentication, generates encrypted data, and saves the data.

Referring to FIG. 5, FIG. 5 is a flowchart of a third method for storing encrypted data on a client according to the present invention. As shown in FIG. 5, the process includes:

Step 510: The client sends the login password information to the server.

The login password information in this step is the same as the login password information in step 420.

Step 520: The server returns the verification result and the force including the current time on the server side to the client. Secret object.

Step 530: The client encrypts the authentication password and the corresponding encrypted object, and generates encrypted data and saves it.

The following is a detailed description of various possible technical details of the present invention by taking the scheme 3 as an example. Referring to FIG. 6, a flow chart of a method for storing encrypted data on a client according to an embodiment of the present invention is shown.

Step 1111: The client sends a login password to the server, and receives an encrypted object that is returned by the server and includes the current time.

Step 1112: The client performs at least one hash on the login password, generates hash data corresponding to the login password, and encrypts the encrypted object including the current time as a key to generate encrypted data.

Step 1113: The client saves the encrypted data.

Referring to FIG. 7, a method for storing encrypted data on a client according to a first embodiment of the present invention Flow chart.

Step 201: The user inputs a login account and a login password on the client login interface, and selects a "remember password" function;

Step 202: The client sends a login request including a user login account and a login password to the server, and receives an encrypted object returned by the server and includes the current time information.

The current time is the time of the server side when the user saves the user login password for the first time. For the same client, the time is unique.

Step 203: The client selects a hash algorithm, and performs at least one hash of the login password provided by the user, and obtains hash data corresponding to the login password as a key.

The hashing algorithm is a one-way function that receives the plaintext of the password and converts the character string representing the plaintext of the password into a hashed data that cannot be used to reconstruct the original plaintext, that is, the password hash.

In the method of the embodiment of the present invention, the login password provided by the user may be directly hashed to generate a password hash as a key.

In order to enhance the security of the login password preservation, the present invention can also calculate the cryptographic hash by using a preset operation function f to obtain hash data related to the cryptographic hash as a key.

The hash data associated with the cryptographic hash = f (cryptographic hash)

f is a preset arithmetic function and can be set as needed. f may be N (N is an integer not less than 1) sub-hash for the cryptographic hash, and generally N is 2, 3 or 4, and the hash data is obtained as a key; The cryptographic hash is hashed N times, and then the corresponding confusing data is added to the obtained hash data according to a preset rule to obtain new hash data as a key; In the column, the corresponding obfuscated data is added according to a preset rule, and then N hashes are performed to obtain new hash data as a key.

In function f, to further enhance security, for N hashes, each hash can Using the same hashing algorithm, different hashing algorithms can also be used to enhance the complexity of the hashed data as a key and to enhance the difficulty of being deciphered.

Step 204: The client uses a preset encryption algorithm to encrypt the encrypted object by using the hash data as a key, and generates encrypted data, which is stored as a remember password ticket and stored in the client.

The encryption algorithm is a specific formula and rule for specifying a transformation method between plaintext and ciphertext. Take the commonly used data encryption standard data encryption algorithm (DES: Data Encryption Standard) as an example to illustrate the process of encrypting with encryption algorithm.

The DES is an algorithm for encrypting binary data, and includes three parameters: a key (Key), a data plaintext (Data), and a mode selection (Mode). The Key is 8 bytes and a total of 64 bits, which is the working key of the DES algorithm; Data is also 8 bytes and 64 bits, which is the data plaintext to be encrypted or decrypted; Mode DES working mode, including Encrypt or decrypt.

When the Mode is encrypted, the Data is encrypted by the Key, and the data plaintext to be encrypted is subjected to 16 rounds of iteration, product transformation, compression transformation, etc., to generate Data encrypted data (64 bits) as the output result of the DES. . During the decryption process, the same key is used to decrypt the cryptographic data, and the plaintext of the data in clear form is reproduced.

In the method of the embodiment of the present invention, the encryption object is data to be encrypted, and the hash data is used as a key, and the mode is encryption. The DES algorithm is used to encrypt the encrypted object, and the generated encrypted data is saved as a remember password ticket on the client.

Using the method described in the embodiment of the present invention, the remember password ticket stored in the client, that is, the encrypted data, is the encrypted object including the current time returned by the server using the hash data obtained by hashing the login password as a key. Encrypted. When the remember password ticket is acquired, even if it is known that the encryption algorithm is used, since it is difficult to obtain information about the encrypted object, the login password is obtained only as a key according to the remember password ticket. The possibility of hashing data information is very small, ensuring the security of remembering password tickets on the client. Compared with the prior art, only the cryptographic hash is used as the remember password ticket, which greatly enhances the security of remembering the password ticket on the client side.

In the method of the embodiment of the present invention, the hash data as a key may be calculated by using a preset function f to calculate a cryptographic hash, even if the remember password ticket is deciphered to obtain an encrypted object, It is impossible to know the specific definition of the function f, and it is also difficult to obtain the password plaintext by back-checking the hash data.

The client in the embodiment of the present invention may be software of a client, a web application triggered by a web (web), a wireless application of a mobile terminal, or the like. The method according to the embodiment of the present invention is applicable to fields such as instant messaging, mail, and games.

Referring to Figure 8, there is shown a flow chart for implementing automatic login by storing the encrypted data on the client side according to the first embodiment of the present invention.

Step 301: The user logs in again at the client, and the client extracts the corresponding remember password ticket, that is, encrypted data, according to the login account provided by the user, and sends an automatic login that includes the remember password ticket and the login account. Request to the server;

Step 302: The server receives the automatic login request information, and extracts password hash data corresponding to the login account from the database, as a decrypted key.

If the hash data obtained by the cryptographic hashing according to the function f is used as the key in step 202, correspondingly, in step 302, the cryptographic hash is set according to the operation function f preset in step 202. Performing an operation to generate hash data as a decrypted key; Step 303: The server decrypts the remember password ticket received from the client by using the hash data, and if the decryption is successful, the client password is proved to be correct, and the encrypted object is obtained. Proceed to step 304; if the decryption fails, proceed to step 306;

The server decrypts the remember password ticket using the same encryption algorithm as in step 204. Step 304: The server checks the encrypted object obtained after decryption, determines whether the remember password ticket is valid, if the remember password ticket is valid, proceeds to step 305; otherwise, proceeds to step 306;

The encryption object is the time on the server side when the client first saves the information about the user login password, which is simply referred to as the password storage time.

The determining whether to remember whether the password ticket is valid specifically includes the following steps.

Step 304a: determining whether the password saving time is later than the current time of the server, if yes, indicating that the remembering password ticket is invalid, proceeding to step 306; otherwise, proceeding to step 304b; step 304b: determining the password saving time and the Whether the time interval between the current time of the server exceeds the preset maximum allowable time interval. If yes, it indicates that the remember password ticket has been saved in the local client for a long time without login, and the remember password ticket has expired. 306, otherwise proceeds to step 305;

The length of the maximum allowable time interval can be specifically set as needed, typically one month.

Step 305: The server notifies the client that the user is allowed to log in automatically, and the automatic login process ends.

Step 306: The server notifies the client to prompt the user to input the password again, and the automatic login process ends.

According to the automatic login process, the method for saving encrypted data on the client in the embodiment of the present invention uses the password storage time as an encryption object, even if others can successfully decrypt or successfully log in according to the encrypted data stored in the client. The server compares the password save time in the encrypted object with the current server time. When the time interval between the password save time and the current server time is too large, the memory password ticket has been saved on the client for a long time without login. The server notifies the client to refuse to automatically log in to the account, prompting the user to re-enter the login password. So even if others can decrypt the success or the root According to the successful registration of the encrypted data stored in the client, the account cannot be used for a long time, and the automatic login function of the account will be automatically cancelled within a certain period of time.

In order to further enhance the security of the password storage, the encrypted object in the first embodiment of the present invention may further include a server receiving a password saving renewal request time and a server receiving a password saving renewal request number, which are respectively referred to as renewal time and continuation. Number of periods.

In step 201, when the user selects the "remember password" function, the method further includes: setting the validity period of the "remember password" function.

Generally, the password is saved on the client for a certain period of time, that is, the validity period, such as one week, one month, four months, or one year. When the user selects the "remember password" function, the client prompts the user to select the "remember password" expiration date or automatically generate a default expiration date. The validity period is the validity period of the current remember password ticket.

During the validity period of the remember password ticket, when the user logs in to the local client, the client automatically performs a "remember password" function renewal operation, and the client issues a password save renewal request with the current remember password ticket. After the server successfully decrypts the remember password ticket to obtain the encrypted object, the server automatically updates the renewal time in the encrypted object to the current time, and adds the number of renewals to 1, and then The newly generated encrypted object is encrypted, a new remember password ticket is returned to the client, the client saves the new remember password ticket, and a new expiration date is set for the new remember password ticket.

In general, when the client logs in to the client within three days or one week before the expiration of the validity period of the remember password ticket, the client automatically performs a renewal operation of the "remember password" function for the user. If during this period, the user has not logged in at the client, after the expiration date, the remember password ticket expires, the client no longer saves the user's remember password ticket. The next time the user logs in, they need to enter the login account and login password again.

When the user selects "remember password" for the first time at the client, the renewal time is 0, and the number of renewals is also 0. Server update each time the client performs a renewal operation The renewal time in the encrypted object is the renewal time, and the number of renewals is increased by one. For example: When a user logs in to an MSN account on January 1, 2008 at 13:33:45, he chooses to use the "remember password" function. It is assumed that the validity period of the password ticket is one month by default. The encryption object is: generation time = 2008/01/01 13:33:45; renewal time = 0; number of renewals = 0. Assuming that the early renewal time is one week before the expiration, at some time after January 24, 2008, assuming that it is 14:34:36 on January 25, 2008, the user logs in at the client, and the client automatically performs the user for the user. The renewal operation updates the encrypted object to: generation time = 2008/01/01 13:33:45; renewal time = 2008/01/25 14:34:36; number of renewals = 1. If the user does not log in to the client before 13:33:45 on February 1, 2008, the client no longer saves the user's remember from 13:33:45 on February 1, 2008. Password ticket.

For the method of saving the encrypted data on the client by using the password save time, the renewal time, and the number of renewals as the encryption object, when the user automatically logs in at the client, in step 304, the judgment determines whether the password ticket is remembered. Validation specifically includes the following steps:

Step 304A: determining whether the password saving time is later than the current time of the server, if yes, indicating that the remembering password ticket is invalid, proceeding to step 306; otherwise, proceeding to step 304B; Step 304B: determining the password saving time and the Whether the time interval between the current time of the server exceeds the preset maximum allowable time interval, if yes, indicating that the remember password ticket has been saved in the local client for a long time without login, proceed to step 304C, otherwise proceed to step 305;

Step 304C: When the renewal time is 0 or the time interval between the renewal time and the current time is within a preset maximum allowable time interval, the client is notified to perform the renewal operation; otherwise, the renewal is not allowed. Operation, that the remember password ticket is invalid, proceeds to step 306; Step 305: The server notifies the client that the user is allowed to log in automatically, and the automatic login process ends.

In step 304C, when the server notifies the client to perform the renewal operation, the client sends a password save renewal request containing the current remember password ticket to the server, and the server decrypts the remember password ticket successfully to obtain the encrypted object. After that, the renewal time in the encrypted object is automatically updated to the current time information, and the number of renewals is incremented by 1, and then the newly generated encrypted object is encrypted, and a new remember password ticket is returned to the The client saves the new remember password ticket. Therefore, for each of the updated password notes, the renewal time is different, which is the time of the most recent renewal operation.

In step 304C, before the server notifies the client to perform the renewal operation, it may further determine whether the number of renewals has exceeded a preset maximum number of allowed renewals. If yes, the renewal operation is no longer performed, and the server directly Notify the client to prompt the user to enter the password again.

In step 304C, the server may further determine a time interval between the renewal time and the generation time. If the time interval exceeds a preset maximum allowable time interval, the renewal operation is no longer performed, and the server directly notifies. The client prompts the user to enter the password again.

According to the above automatic login process, when the encrypted object is the password storage time, the renewal time, and the number of renewals, the strength of the server for verification is further enhanced, and the security of the password is enhanced. In actual use, even if the remember password ticket is deciphered and the login is implemented, if it is not renewed, it cannot be used for too long, which reduces the loss of password theft.

In order to enhance the reliability of the encrypted data storage, the server information may further include: a format version number, obfuscated data, and other data to further increase the complexity of the encrypted object and enhance the security of the encrypted data storage. In the method of the embodiment of the present invention, the setting of the encryption object can be flexibly set according to specific needs. When the server verifies the remember password ticket and judges whether the remember password ticket is valid, the server notifies the client to refuse the automatic login, and prompts the user to input the login again, as long as any one of the encrypted objects does not satisfy the verification condition. password. Through the method, the reliability and flexibility of the server verification are greatly enhanced, and the security of the client to save the encrypted data is enhanced.

The second embodiment of the present invention is different from the first embodiment in that: after encrypting the encrypted object by using the hash data, the password data obtained by the first encryption is secondarily encrypted by using the local information of the client, thereby Generate a remember password ticket, save it on the client, further increase the complexity of remembering the password ticket, and improve the security of saving encrypted data on the client.

Referring to FIG. 9, a flowchart of a method for saving encrypted data on a client according to a second embodiment of the present invention is shown.

Step 401: The user inputs a login account and a login password on the client login interface, and selects the "remember password" function;

Step 402: The client sends a login request including a user login account and a login password to the server, and receives an encrypted object that is returned by the server and includes the current time.

Step 403: The client selects a hash algorithm, hashes the login password provided by the user, and obtains hash data corresponding to the login password as a key.

Step 404: The client uses a preset encryption algorithm, uses the hash data as a key, encrypts the encrypted object once, obtains an encrypted data, and then uses the client local information as a key, The primary encrypted data is subjected to secondary encryption to obtain secondary encrypted data, which is stored as a remember password ticket and stored in the client.

The client local information may be machine information inherent to the local client itself, or may be local network related information or locally generated data.

The machine information inherent to the client itself may be the physical (MAC) of the client network card. Address, serial number of the first hard disk of the client, etc. The local network related information may be a client's IP address, a gateway address, a subnet mask, and the like. The locally randomly generated data may be data randomly generated by a local client, and used in conjunction with the inherent machine information or local network related information of the client according to a preset rule, which is used to enhance the key. Complexity, to enhance the difficulty of being deciphered.

The use of the client local information as a key is to enhance the difficulty of decrypting the key. According to the need, the client randomly selects the relevant information, composes the key according to certain rules, and encrypts the encrypted object. It is difficult for others to obtain the above key by technical means. Therefore, even if the encryption algorithm is known, it is still difficult to decipher the encryption. Object, steal password.

In general, the client's own machine information is used as the client's local information, because this part of the information is fixed, and can be blocked by the administrator to make it impossible for outsiders to know, further enhancing the security of password storage. Correspondingly, the information about the local network may be fixed or may be arbitrarily changed. For example, if the local network uses the method of automatically obtaining an IP address, the IP address of the client may be different each time. This further enhances the security of password storage.

In the method of the embodiment of the present invention, the encrypted object may be encrypted and twice encrypted by the same encryption algorithm, or different encryption algorithms may be used for the two encryptions to further enhance the security of password storage. Sex.

In the second embodiment of the present invention, the method for storing encrypted data on the client side uses the client local information as a key to perform secondary encryption on the encrypted object, and generates the encrypted data as a password cryptographic note, and stores it in the client.

In the method of the embodiment of the present invention, the client local information as the secondary encryption key may be preset according to the needs of the client, by the local client's own machine information, local network related information, and locally randomly generated data. The rules are randomly combined to generate, which enhances the confidentiality of the key. Even if someone knows the encryption algorithm, the key cannot be learned. The components and definitions, it is difficult to get the key to decipher the password, therefore, the method of saving the encrypted data on the client has high security.

Referring to Fig. 10, there is shown a flow chart for implementing automatic login by storing a method of encrypting data on a client side according to a second embodiment of the present invention.

Step 501: The user logs in again at the client, and the client extracts the corresponding remember password ticket locally according to the login account provided by the user, and decrypts the remember password ticket according to the local information of the client, to obtain the Encrypting the data once, and transmitting the automatic login request information including the primary encrypted data and the login account to the server;

The server decrypts the remember password ticket using the algorithm corresponding to the secondary encryption algorithm in step 404.

Step 502: The server receives the automatic login request information, and extracts password hash data corresponding to the login account from the database as a key.

If the hash data obtained by the cryptographic hashing according to the function f is used as the key in step 402, correspondingly, in step 502, the cryptographic hash data is set according to the operation function preset in step 402. f performs an operation to generate hash data as a decrypted key; Step 503: The server decrypts the encrypted data received from the client by using the hash data, and if the decryption is successful, the client password is proved to be correct, and the encrypted object is obtained. Proceed to step 504; if the decryption fails, proceed to step 506;

The server decrypts the remember password ticket using an algorithm corresponding to the one-time encryption algorithm in step 404.

Step 504: The server checks the encrypted object obtained after decryption, determines whether the remember password ticket is valid, if the remember password ticket is valid, proceeds to step 505; otherwise, proceeds to step 506;

The encryption object is the time on the server side when the client saves the user login password for the first time, and is simply referred to as a password storage time. The specific process of determining whether the cipher ticket is valid is the same as step 304 of the first embodiment of the present invention.

Step 505: The server notifies the client that the user is allowed to log in automatically, and the automatic login process ends.

Step 506: The server notifies the client to prompt the user to input the password again, and the automatic login process ends.

In order to enhance the reliability of the password storage, the encrypted object in the second embodiment of the present invention may further include a renewal time and a number of renewals, and the server verifies the renewal time and the number of renewals with the first embodiment. The verification process is the same.

In order to enhance the reliability of the encrypted data storage, the server information may further include: a format version number, obfuscated data, and other data to increase the complexity of generating the remember password ticket.

Based on the above method of storing encrypted data on a client, the present invention also provides a system for storing encrypted data on a client.

Referring to FIG. 11, a system diagram for storing encrypted data on a client according to a first embodiment of the present invention is shown.

The system includes a client 61 and a server 62, wherein the client 61 includes: an encrypted object receiving module 610, configured to receive a force including the current time returned by the server. Secret object.

The login password hashing module 611 is configured to hash the login password at least once to generate hash data.

The hash data encryption module 612 is configured to encrypt the encrypted object generated by the encrypted object generating module 610 by using the hash data generated by the login password hashing module 611 as a key according to a preset encryption algorithm. The generated encrypted data is sent to the storage module 613 as a remember password ticket. The storage module 613 is configured to save the remember password ticket, that is, the encrypted data, sent by the hash data encryption module 612.

In order to enhance the reliability of the password storage, the login password hashing module 611 in the embodiment of the present invention may directly hash the login password provided by the user, generate a password hash, and use the preset as a key. The arithmetic function f calculates the cryptographic hash to obtain hash data related to the cryptographic hash as a key. Even if someone knows the hashing algorithm, it is difficult to get the key to decipher the password because it cannot know how the function f is defined.

In the system according to the embodiment of the present invention, the remember password ticket stored in the storage module 613, that is, the encrypted data, is the hash data obtained by hashing the login password as a key, and the encryption returned by the server with the current time. The object is encrypted. When the remember password ticket is acquired, even if it is known that the encryption algorithm is used, since it is difficult to obtain information about the encrypted object, the login password is obtained only as a key according to the remember password ticket. The possibility of hashing data information is very small, ensuring the security of saving passwords. Compared with the prior art, only the cryptographic hash is used as the remember password ticket, which greatly enhances the security of storing encrypted data on the client.

Referring to FIG. 12, a system diagram for storing encrypted data on a client according to a second embodiment of the present invention is shown.

The system for storing encrypted data on the client according to the first embodiment and the second embodiment of the present invention is different in that the client in the second embodiment further includes a local information encryption module 614.

The local information encryption module 614 is configured to encrypt the encrypted data output by the hash data encryption module 612 by using a preset encryption algorithm, using the client local information as a key, generate a remember password ticket, and send Go to the storage module 613.

Correspondingly, the storage module 613 is configured to save the remember password ticket sent by the local information encryption module.

The client local information may be machine information inherent to the local client itself, or It is related to local network information or locally generated data.

In the system of the embodiment of the present invention, the client local information encryption module 614 uses the client local information as a key, and the client local information may be localized by the local client according to the needs of the client. The network related information and the locally randomly generated data are randomly combined and generated according to a preset rule, which enhances the confidentiality of the key. Even if someone knows the encryption algorithm, it is difficult to obtain the key because the key component and the definition manner cannot be obtained. The key is used to decipher the password, so the system for storing the encrypted data on the client has high security.

The foregoing provides a method and system for storing encrypted data on a client, and the description of the above embodiments is only for helping to understand the method and core idea of the present invention. Meanwhile, for the general technology in the field In the following, the description of the present invention is not limited to the scope of the present invention.

Claims

Claim

A method for storing encrypted data on a client, the method comprising: the server authenticating a login password of the client, and transmitting the encrypted object including the current time information of the server to the client;

The client encrypts the login password and the encrypted object to generate encrypted data; the client saves the login password passed by the verification and the encrypted data generated by the corresponding encrypted object.

2. The method of claim 1 wherein:

The server verifies the login password of the client, and sends the encrypted object including the current time information of the server to the client. The client encrypts the login password and the encrypted object, and the generated encrypted data includes:

The server sends an encrypted object including the current time information of the server side to the client according to the request of the client;

The client encrypts the login password and the encrypted object, generates encrypted data, and sends the generated encrypted data to the server;

The server verifies the encrypted data, and if the verification passes, sends an indication to the client that the login password is verified.

3. The method of claim 1 wherein:

The client sends the login password information to the server, and receives the verification result returned by the server; The client encrypts the login password passed by the verification and the encrypted object to generate encrypted data.

4. The method of claim 1 wherein:

The server verifies the login password of the client, and sends the encrypted object including the current time information of the server side to the client, including:

The client sends the login password information to the server, and receives the verification result returned by the server and the encrypted object including the current time.

The method according to any one of claims 1 to 4, wherein the encrypting the login password and the encrypted object by the client comprises: the client accessing the login password at least once Hashing, generating hash data, and encrypting the encrypted object with the hash data.

The method according to claim 5, wherein the encrypting the encrypted object by using the hash data is specifically:

The obfuscated data is added to the hash data, and the encrypted object is encrypted by the hash data added with the obfuscated data.

The method according to claim 5, wherein the encrypting the encrypted object by using the hash data further comprises:

The encrypted object is secondarily encrypted using client local information.

The method according to claim 7, wherein the client local information is a client NIC physical address, a client hard disk serial number, and/or a data randomly generated by the client.

9. The method according to claim 5, further comprising: the client transmitting an automatic login request containing the encrypted data to the server; the server decrypting the encrypted data, determining the encrypted object The current time in the middle does not exceed the preset maximum allowable time interval, and returns automatic login information to the client.

The method according to claim 5, wherein after the client sends the login password information to the server, the method further includes: setting a saving validity period of the password.

11. The method according to claim 10, further comprising: the client transmitting a password save renewal request containing the encrypted data to the server; the server decrypting the encrypted data, and updating the decrypted encryption The object, and then encrypting the updated encrypted object, and returning the updated encrypted data to the client;

The server extends the password save validity period.

The method according to claim 11, wherein before the server extends the validity period of the password save, the method further includes:

The server determines that the number of times the receiving password save renewal request does not exceed the preset maximum allowed number of renewals.

The server determines that the receiving password save renewal request time does not exceed the preset maximum allowable time interval.

The method according to claim 11, wherein the updating the encrypted object obtained after decryption comprises:

The server adds a receiving password save renewal request time to the encrypted object.

The method according to claim 14, wherein the receiving password save renewal request time is the time of receiving the password retention renewal request most recently.

The server adds a number of receiving password save renewal requests to the encrypted object.

The method according to claim 16, wherein the updating the encrypted object obtained after decryption comprises: The server adds a format version number and obfuscated data to the encrypted object.

18. A system for storing encrypted data on a client, comprising a client and a server, wherein:

The client encrypts the login password and the encrypted object sent by the server, generates encrypted data, and saves the login password verified by the server and the encrypted data generated by the corresponding encrypted object;

The server verifies the login password of the client, and sends the encrypted object including the current time information of the server side to the client.

19. The system of claim 18, wherein:

The client requests an encryption object including current time information of the server side to the server, encrypts the login password and the encrypted object, generates encrypted data, sends the generated encrypted data to the server, and receives the login password verification sent by the server. After passing the indication, saving the encrypted data;

The server returns an encrypted object including the current time information of the server according to the request of the client, and verifies the encrypted data sent by the client. If the verification succeeds, the client sends an indication that the login password is verified.

20. The system of claim 18, wherein

The client requests an encryption object including current time information of the server side to the server, sends login password information to the server, receives the verification result returned by the server, encrypts the login password and the encrypted object, and generates encryption. Data and save;

The server returns an encrypted object including the current time information of the server according to the request of the client, and verifies the login password information sent by the client. If the verification succeeds, the server sends an indication of the login password verification.

21. The system of claim 18, wherein:

The client sends login password information to the server, and receives the return from the server. Verifying the result and the encrypted object including the current time, encrypting the verified login password and the encrypted object, generating encrypted data and saving;

The server receives the login password information sent by the client, verifies the login password information, and sends the verification result to the client together with the encryption object including the current time information of the server side.

The system according to any one of claims 18 to 21, wherein the client comprises:

An encryption object receiving module, configured to send login password information to the server, receive the verification result returned by the server, and the encrypted object including the current time;

a login password hashing module, configured to hash the login password that has passed the verification at least once to generate hash data;

a hash data encryption module, configured to encrypt the encrypted object by using the hash data to generate encrypted data;

And a storage module, configured to save the encrypted data sent by the hash data encryption module.

The system according to claim 22, wherein the client further comprises:

a local information encryption module, configured to encrypt the encrypted data output by the hash data encryption module by using local information of the client;

The storage module is configured to save the encrypted data sent by the local information encryption module.