WO2017088677A1 - 一种用户密钥存储方法及服务器 - Google Patents

一种用户密钥存储方法及服务器 Download PDF

Info

Publication number
WO2017088677A1
WO2017088677A1 PCT/CN2016/105668 CN2016105668W WO2017088677A1 WO 2017088677 A1 WO2017088677 A1 WO 2017088677A1 CN 2016105668 W CN2016105668 W CN 2016105668W WO 2017088677 A1 WO2017088677 A1 WO 2017088677A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
key
server
information
identifier
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/105668
Other languages
English (en)
French (fr)
Inventor
张治中
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2017088677A1 publication Critical patent/WO2017088677A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a user key storage method.
  • the application also relates to a server.
  • Websites can be easily divided into the following two categories according to their importance:
  • High-priority accounts such as financial accounts such as banks. This type of account ID and password refer to the user's property security and require the user to properly keep it;
  • the prior art proposes a password manager to improve the user experience in page browsing. Specifically, after the user completes registration through a website, the password manager saves the user name and password, and then automatically fills in the user name and password when the user needs to log in to the website. If the user does not want to set the password, the user can also A password is automatically generated when a password is generated.
  • Last Pass can be used in the form of browser extension.
  • a user logs in to any website, he will prompt to save the login information.
  • the login form will be filled in automatically. Eliminate the hassle of memory accounting and manual input.
  • Last Pass the architecture of the key management system in the prior art is shown in Figure 1.
  • the back end needs to deploy a very heavy service for user indexing, data indexing, and data storage. And you need to define the front and rear interfaces. Therefore, developers need to develop applications and deploy them to service servers to provide services, and developers need to provide user index and data indexing services themselves. If developers do not use cloud storage, they need to provide data storage services themselves.
  • the inventors have found that for ordinary developers, they cannot afford the server rental and installation costs required for a large number of users' key storage, so for such systems, the server will become a performance. bottleneck. Moreover, the design and development habits of different developers are different, resulting in such systems having high coupling but poor reusability.
  • the present invention provides a user key storage method for improving the management efficiency of a user key under the premise of simplifying the development process and reducing the development cost, and the method is applied to a key management server, a user terminal, and an authentication server.
  • Key management system including:
  • the key management server receives a key storage request from the user terminal, where the key storage request carries a temporary authentication token, key information, and a user identifier, where the temporary authentication token is that the user is logged in. After the authentication server is delivered by the authentication server to the user terminal;
  • the key management server authenticates the temporary authentication token
  • the key management server queries the key storage space corresponding to the user, and stores the user identifier and the key information to the key. In storage space.
  • the temporary authentication token is specifically requested by the user terminal to obtain, after the user logs in to the authentication server, the authentication server.
  • the key information includes at least a user account, a user password, and a website identifier, and after the key management server stores the user identifier and the key information in the key storage space, :
  • the key management server determines a target website identifier corresponding to the key filling request
  • the key management server queries a user account corresponding to the target website identifier and a user password in the key storage space;
  • the key management server returns the queried user account and the user password to the user terminal.
  • the key storage request further includes the user information and the website information.
  • the key management server stores the user identifier and the key information in the key storage space, the key management server further includes:
  • the key management server generates a user index according to the user information, the website information, the user identifier, and the to-be-stored key.
  • the method further includes:
  • the search result is generated according to the keyword carried in the key retrieval request and the user index, and the search result is returned to the user terminal.
  • the present invention provides a server for improving the management efficiency of a user key under the premise of simplifying the development process and reducing the development cost, and the server is used as a key management server to include the key management server and the user terminal.
  • the key management system of the authentication server including:
  • the receiving module receives a key storage request from the user terminal, where the key storage request carries a temporary authentication token, key information, and a user identifier, where the temporary authentication token is that the user logs in to the authentication server. And being sent by the authentication server to the user terminal;
  • An authentication module that authenticates the temporary authentication token
  • the server when the temporary authentication token is authenticated, stores a key storage space corresponding to the user, and stores the user identifier and the key information in the key storage space. in.
  • the temporary authentication token is specifically requested by the user terminal to obtain, after the user logs in to the authentication server, the authentication server.
  • the key information includes at least a user account, a user password, and a website identifier; and further includes:
  • a filling module when receiving a key filling request from the user terminal, determining a target website identifier corresponding to the key filling request, and querying, in the key storage space, a user account corresponding to the target website identifier And the user password, returning the queried user account and the user password to the user terminal.
  • the key storage request further carries user information and website information, and further includes:
  • the generating module further generates a search result according to the keyword carried in the key retrieval request and the user index when receiving a key retrieval request from the user, and generates the search result, and the search result Return to the user terminal.
  • the key management server first receives the key storage request from the user terminal, and authenticates the temporary authentication token in the key storage request, because the temporary authentication token is The user is sent to the user terminal by the authentication server after logging in to the authentication server. Therefore, if the temporary authentication token is authenticated, The key management server can query the key storage space corresponding to the user by itself, and store the user identifier and the key information in the key storage space. Therefore, it is no longer necessary to set a dedicated interface between the servers to realize the storage of the user key, which greatly simplifies the development process and reduces the development cost, and improves the development efficiency while ensuring security.
  • FIG. 1 is a schematic structural diagram of a key management system in the prior art
  • FIG. 2 is a schematic flowchart of a method for storing a user key according to the present application
  • FIG. 3 is a schematic diagram of a user key management method according to a specific embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a server according to the present application.
  • the present application proposes a user key storage method, as shown in FIG. 2, the method includes the following steps:
  • the key management server receives a key storage request from a user terminal, where the key storage request carries a temporary authentication token, key information, and a user identifier, where the temporary authentication token is a login of the user.
  • the authentication server is delivered to the user terminal by the authentication server.
  • the terminal device when a user uses a terminal device provided with a key management tool to perform key storage, the terminal device needs to use a dedicated API interface to interface with the service server, and the developer also needs to set other services based on the service server.
  • the server is used to store the user's key data, which undoubtedly greatly increases the development cost and development difficulty of the key management.
  • the present application proposes a set of key management systems consisting only of a key management server, a user terminal, and an authentication server.
  • the user terminal is equipped with a key management tool for front-end display processing, which can be a mobile terminal or a PC terminal, and can be implemented independently from the authentication server and the key management server.
  • Message communication and information storage By optimizing the storage and reading API of the server, the query, storage, and reading of the password management are simplified, and the developer no longer needs to develop these common functions as before.
  • the user when the user needs to store the key, the user will first log in to the authentication server through the user terminal. After the user successfully logs in to the authentication server, the user terminal will request a temporary authentication token from the authentication server, and The temporary authentication token is carried along with the user identification and the key information in a key storage request and sent to the key management server.
  • the technician can arrange the key management server in the current network storage service platform, the network The storage service platform must provide a common interface with storage and read capabilities.
  • the network storage service platform may adopt an OSS (Object Storage Service) capable of providing massive, secure, and highly reliable cloud storage services to the outside. platform.
  • OSS Object Storage Service
  • the server on the OSS platform is used to apply the key management scheme provided by the present application, the developer or the ordinary user can directly interact with the server of the OSS platform through the mobile terminal or the PC terminal used by itself, without setting the API. interface.
  • the technician can further expand the interface function and the storage function of the network based on the independence of the network storage service platform, and the flexible expansion of capacity and processing capability, which are all within the protection scope of the present application.
  • the key management server authenticates the temporary authentication token.
  • the key management server queries the key storage space corresponding to the user by itself, and stores the user identifier and the key information corresponding to the key information. In the key storage space.
  • the key information should include at least the user account and the user. a password and a website identifier, after the key management server stores the user identifier and the key information in the key storage space, and if the key filling request from the user terminal is received, the password
  • the key management server determines a target website identifier corresponding to the key filling request, queries a user account corresponding to the target website identifier and a user password in the key storage space, and returns the queried user account and the user password. To the user terminal, to complete the filling of the username and password for the website.
  • the key storage request may also carry the user information and website information input by the user, and the user identifier and the key are used in the key management server.
  • the key management server After the information is correspondingly stored in the key storage space, the key management server generates a user index according to the user information, the website information, the user identifier, and the to-be-stored key, and receives the user's index.
  • the key management server may generate a search result according to the keyword carried in the key retrieval request and the user index, and return the search result to the user terminal.
  • the solution of the present application utilizes the key management service on the network storage service platform.
  • the various services opened in the cloud computing provided by the server replace the work in the traditional development and eliminate the intermediate links.
  • the user's request and response are directly connected to the service in the cloud, thereby improving the efficiency of existing key management.
  • the user logs in to the authentication server by using the terminal device (PC device or mobile terminal) used by the user.
  • the terminal device PC device or mobile terminal
  • the key management tool has the functions of online password management and page filtering, and can record the user name and password filled by the user through the terminal device during the page browsing process, and identify the user name and password that need to be filled in the current browsing page.
  • the key management tool requests a temporary token token from the authentication server.
  • the authentication server After receiving the temporary token request of the key management tool, the authentication server needs to generate a temporary token for the key management tool.
  • the technician can generate a temporary token by using a Security Token Service (STS), which is a Web service that publishes, authenticates, and renews a security token, and can effectively guarantee a temporary token.
  • STS Security Token Service
  • the key management tool uses the temporary token to obtain the permission to obtain the cloud service accessing the network storage service platform. Start to find the record information related to the user, and write the corresponding user name, password and other data on the network storage service platform, and put the searchable content (such as user name, network name, etc.) in the cloud search service. index;
  • this embodiment also provides a search function for filling a page with a website or other password, as follows: :
  • the user can initiate a search request through the key management tool, and then the key management tool will be based on the website to be searched or The identifier of the padding page is requested by the network storage service platform to the cloud search service.
  • the network storage service platform After receiving the search request of the key management tool, the network storage service platform will store the user before the query according to the index in S305. All the user names and corresponding keys corresponding to the website are stored, and the search result is returned to the key management tool, and the subsequent key management tool displays the obtained user name and password corresponding to the website to the user.
  • the embodiment of the present invention further provides a server that can be applied to the foregoing method flow.
  • a schematic structural diagram of a server according to an embodiment of the present invention may include:
  • the receiving module 401 receives a key storage request from the user terminal, where the key storage request carries a temporary authentication token, key information, and a user identifier, where the temporary authentication token is the user logging in the authentication.
  • the server is sent by the authentication server to the user terminal;
  • the authentication module 402 authenticates the temporary authentication token.
  • the processing module 403 if the temporary authentication token is authenticated, the query server itself stores a key storage space corresponding to the user, and stores the user identifier and the key information in the key storage space. in.
  • the temporary authentication token is specifically requested by the user terminal to obtain, after the user logs in to the authentication server, the authentication server.
  • the key information includes at least a user account, a user password, and a website identifier; and the method further includes:
  • a filling module when receiving a key filling request from the user terminal, determining a target website identifier corresponding to the key filling request, and querying, in the key storage space, a user account corresponding to the target website identifier And the user password, returning the queried user account and the user password to the user terminal.
  • the key storage request further carries user information and website information, and further includes:
  • the generating module further generates a search result according to the keyword carried in the key retrieval request and the user index when receiving a key retrieval request from the user, and returns the search result to the User terminal.
  • the key management server first receives a key storage request from the user terminal, and authenticates the temporary authentication token in the key storage request, because the temporary authentication token is the login authentication of the user.
  • the right server is delivered to the user terminal by the authentication server. Therefore, if the temporary authentication token is authenticated, the key management server can query the key storage space corresponding to the user and corresponding the user identifier with the key information. Stored in the key storage space. Therefore, it is no longer necessary to set a dedicated interface between the servers to realize the storage of the user key, which is extremely It simplifies the development process and reduces development costs, while improving security while improving development efficiency.
  • the present invention can be implemented by hardware or by means of software plus a necessary general hardware platform.
  • the technical solution of the present invention may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (which may be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including several The instructions are for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various implementation scenarios of the present invention.
  • modules in the apparatus in the implementation scenario may be distributed in the apparatus for implementing the scenario according to the implementation scenario description, or may be correspondingly changed in one or more devices different from the implementation scenario.
  • the modules of the above implementation scenarios may be combined into one module, or may be further split into multiple sub-modules.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本发明公开了一种用户密钥存储方法及服务器。密钥管理服务器首先接收来自于用户终端的密钥存储请求，并对密钥存储请求中的临时认证令牌进行鉴权，由于临时认证令牌为用户在登录鉴权服务器后由鉴权服务器下发至用户终端，因此若临时认证令牌鉴权通过，密钥管理服务器即可在自身查询与用户对应的密钥存储空间，并将用户标识与密钥信息对应存储至密钥存储空间中。从而无需再在服务器之间设置专用接口实现用户密钥的存储，极大简化了开发流程以及减少了开发成本，并在保障安全性的同时提高了开发效率。

Description

一种用户密钥存储方法及服务器
本申请要求2015年11月23日递交的申请号为201510819162.2、发明名称为“一种用户密钥存储方法及服务器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种用户密钥存储方法。本申请同时还涉及一种服务器。
背景技术
随着互联网技术的不断发展，人们现在通过互联网能够完成各种自己所需要的事情。在用户通过网络提供或获取服务时，一般都需要在服务提供商或网络运营商注册属于自己的账号，并设置相对应的密码。
在目前生活中，互联网服务多种多样，用户需要注册各类网站，每个网站都要有用户名、密码。网站按重要程度可简单分为以下两种：
(1)高优先级账户，例如银行等金融账户，该类型的账户ID以及密码涉及用户的财产安全，需要用户妥善进行保管；
(2)低优先级账户，例如各种论坛账户，该类型的账户或只注册看一次就不用再管。
为了帮助用户记录繁多的账号密码，现有技术提出了密码管理器以提高用户在页面浏览时的使用体验。具体地，在当用户通过某网站完成注册之后，密码管理器将用户名、密码保存起来，后续在用户需要登录该网站时自动填写用户名、密码，若用户不想自己设置密码，还能在用户需要生成密码时自动生成密码。
作为目前使用率较高的一款密码管理器，Last Pass能够以浏览器扩展的形式使用，当用户登录任何一个网站时会提示保存登录信息，后续用户访问该网站时将会自动填写登录表单，免除记忆账密和手工输入的麻烦。以Last Pass为例，现有技术中的密钥管理系统的架构示意图如图1所示，其后端需要部署很重的服务用来做用户索引、数据索引以及数据存储。而且需要定义前后端接口。因此开发者要自行开发应用并部署至业务服务器上提供服务，而且开发者需要自己提供用户索引和数据索引服务，若开发者不用云存储的话，需要自己提供数据存储服务。
发明人在实现本发明的过程中发现，对于普通的开发者而言，其并不能负担大量用户的密钥存储所需要的服务器租赁以及架设费用，因此对于该类系统而言，服务器会成为性能瓶颈。而且不同开发者的设计以及开发习惯不同，导致此类系统耦合性高但可复用性差。
由此可见，如何在降低硬件使用成本以及缩短开发周期的前提下实现用户的密钥管理，成为本领域技术人员亟待解决的技术问题。
发明内容
本发明提供了一种用户密钥存储方法，用以在简化开发流程以及减少开发成本的前提下提高用户密钥的管理效率，该方法应用于包括密钥管理服务器、用户终端以及鉴权服务器的密钥管理系统中，包括：
所述密钥管理服务器接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录所述鉴权服务器后由所述鉴权服务器下发至所述用户终端的；
所述密钥管理服务器对所述临时认证令牌进行鉴权；
若所述临时认证令牌鉴权通过，所述密钥管理服务器在自身查询与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
优选地，所述临时认证令牌具体为所述用户终端在所述用户登录所述鉴权服务器后向所述鉴权服务器请求获取的。
优选地，所述密钥信息至少包括用户账户、用户密码以及网站标识，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
当接收到来自于所述用户终端的密钥填写请求时，所述密钥管理服务器确定所述密钥填写请求对应的目标网站标识；
所述密钥管理服务器在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码；
所述密钥管理服务器将查询到的用户账户以及用户密码返回至所述用户终端。
优选地，所述密钥存储请求中还携带用户信息以及网站信息，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
所述密钥管理服务器根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引。
优选地，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
当接收到来自于所述用户中的密钥检索请求时，根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
本发明提供了一种服务器，用以在简化开发流程以及减少开发成本的前提下提高用户密钥的管理效率，该服务器用于作为密钥管理服务器应用于包括所述密钥管理服务器、用户终端以及鉴权服务器的密钥管理系统中，包括：
接收模块，接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录所述鉴权服务器后由所述鉴权服务器下发至所述用户终端的；
鉴权模块，对所述临时认证令牌进行鉴权；
处理模块，在所述临时认证令牌鉴权通过时，查询服务器自身与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
优选地，所述临时认证令牌具体为所述用户终端在所述用户登录所述鉴权服务器后向所述鉴权服务器请求获取的。
优选地，所述密钥信息至少包括用户账户、用户密码以及网站标识；还包括：
填充模块，在接收到来自于所述用户终端的密钥填写请求时确定所述密钥填写请求对应的目标网站标识，在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码，将查询到的用户账户以及用户密码返回至所述用户终端。
优选地，所述密钥存储请求中还携带用户信息以及网站信息，还包括：
生成模块，根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引。
优选地，所述生成模块还在接收到来自于所述用户中的密钥检索请求时根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
由此可见，通过应用本申请的技术方案，密钥管理服务器首先接收来自于用户终端的密钥存储请求，并对密钥存储请求中的临时认证令牌进行鉴权，由于临时认证令牌为用户在登录鉴权服务器后由鉴权服务器下发至用户终端，因此若临时认证令牌鉴权通过， 密钥管理服务器即可在自身查询与用户对应的密钥存储空间，并将用户标识与密钥信息对应存储至密钥存储空间中。从而无需再在服务器之间设置专用接口实现用户密钥的存储，极大简化了开发流程以及减少了开发成本，并在保障安全性的同时提高了开发效率。
附图说明
图1为现有技术中密钥管理系统的架构示意图；
图2为本申请提出的一种用户密钥存储方法的流程示意图；
图3为本申请具体实施例所提出的一种用户密钥管理方法的示意图；
图4为本申请提出的一种服务器的结构示意图。
具体实施方式
有鉴于背景技术中所提出的技术问题，本申请提出了一种用户密钥存储方法，如图2所示，该方法包括以下步骤：
S201，所述密钥管理服务器接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录鉴权服务器后由所述鉴权服务器下发至所述用户终端的。
在现有的技术中，用户在利用设有密钥管理工具的终端设备进行密钥存储时，终端设备需要利用专门的API接口与业务服务器进行对接，并且开发者还需要基于业务服务器设置其他的服务器用来存储用户的密钥数据，这无疑极大的增加了密钥管理的开发成本以及开发难度。为此本申请提出了一套仅由密钥管理服务器、用户终端以及鉴权服务器所组成的密钥管理系统。其中用户终端除了向用户提供网站浏览功能之外，搭载前端展示处理的密钥管理工具，其可以为移动终端或者PC终端，与鉴权服务器以及密钥管理服务器之间能够实现不依赖于接口设置的报文通信以及信息存储。通过对服务器的存储和读取的API进行优化，简化了密码管理时的查询、存储、读取等工作，开发者不再需要像以前那样需要对这些通用功能进行开发。
基于以上密钥管理系统，当用户需要存储密钥时，用户将首先通过用户终端登录鉴权服务器，在用户成功登录鉴权服务器之后，用户终端将向鉴权服务器请求临时认证令牌，并将该临时认证令牌与用户标识以及密钥信息一同携带在密钥存储请求中发送至密钥管理服务器。
优选地，技术人员可以将密钥管理服务器布置于目前的网络存储服务平台中，该网 络存储服务平台必须在具有存储及读取功能的前提下提供通用的接口。在具体的应用场景中，为了能够便捷、快速地实现本申请的技术方案，该网络存储服务平台可采用能够对外提供海量、安全和高可靠的云存储服务的OSS(Object Storage Service，对象存储)平台。在采用OSS平台上的服务器应用本申请提供的密钥管理方案时，开发人员或者普通用户均可通过自身所使用的移动终端或者是PC终端直接与OSS平台的服务器进行交互，而无需再设置API接口。在此基础上，技术人员也可基于网络存储服务平台的无关性，容量和处理能力的弹性扩展进一步对网络的接口功能以及存储功能进行拓展，这些都属于本申请的保护范围。
S202，所述密钥管理服务器对所述临时认证令牌进行鉴权。
S203，若所述临时认证令牌鉴权通过，所述密钥管理服务器在自身查询与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
在用户通过互联网进行活动的过程中，大多数情况下用户都是需要在网站填写自己注册的用户名及密码，因此在本申请的一个优选实施例中，密钥信息应至少包括用户账户、用户密码以及网站标识，在密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，若是接收到来自于所述用户终端的密钥填写请求，所述密钥管理服务器确定所述密钥填写请求对应的目标网站标识，在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码，并将查询到的用户账户以及用户密码返回至所述用户终端，以此实现针对网站的用户名及密码的填写。
需要说明的是，虽然以上过程中仅以网站的用户名密码自动填充为例进行说明，然而当用户使用其他方式(例如APP)进行登陆时，也可在此基础上针对标识进行改变以适应性地进行调整填充，这些都属于本申请的保护范围。
此外，为便于用户针对自己所存储的密码进行管理，密钥存储请求中还可携带用户输入的自身的用户信息以及网站信息，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，密钥管理服务器将根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引，而在接收到来自于所述用户中的密钥检索请求时，密钥管理服务器即可根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
通过以上方案可以看出，本申请的方案通过利用网络存储服务平台上的密钥管理服 务器所提供的云计算中开放的种种服务，取代了传统开发中的工作，省去了中间环节。将用户的请求与响应，直接与云计算中的服务打通，从而提高了现有的密钥管理效率。
为了进一步阐述本发明的技术思想，现结合如图3所示的具体应用场景，对本发明的技术方案进行说明。详细步骤如下：
S301，用户通过自身使用的终端设备(PC设备或是移动终端)登录鉴权服务器；
S302，在安全登录了鉴权服务器之后，该用户在终端设备上打开密钥管理工具(该具体实施例中以Last Pass为例进行说明)。该密钥管理工具具有在线密码管理以及页面过滤的功能，能够记录用户通过终端设备在页面浏览过程中所填充的用户名及密码，同时识别当前浏览页面所需要填充的用户名及密码。
S303，密钥管理工具从鉴权服务器请求临时令牌token；
S304，在接收到密钥管理工具的临时token请求之后，鉴权服务器需要为该密钥管理工具生成临时token。在该具体实施例中，技术人员可以采用制定安全令牌服务(STS)生成临时token，该安全令牌服务是一项发布、验证和续订安全令牌的Web服务，可以有效地保证临时token的安全性以及有效性。
S305，密钥管理工具在获得临时token后，利用该临时token取得获取访问网络存储服务平台的云服务的权限。开始查找与用户相关的记录信息，并将对应的用户名、密码以及其它数据等写在网络存储服务平台，同时将可以搜索的内容(例如用户名、网络名称等)放在云搜索服务中进行索引；
S306，用户在通过终端设备进行页面浏览的过程中需要进行密码填充时，通过密钥管理工具从网络存储服务平台获取所需的密码并填写至浏览页面，从而进行进一步的访问。
以上步骤在无需开发专用接口以及服务器的前提下，实现了用户在页面浏览过程中进行密码自动存储以及密钥自动填充的功能。然而，在相隔了一段时间未使用某一个账户之后，用户可能会遗忘当时登录该网站所使用的用户名，因此本具体实施例还提供了针对网站或是其他密码填充页面的搜索功能，具体如下：
S307，如果用户需要针对某一个网站或是密码填充页面搜索之前所填充的用户名及密码时，该用户可通过该密钥管理工具发起搜索请求，随后密钥管理工具将根据待搜索的网站或是填充页面的标识向网络存储服务平台请求云搜索服务，网络存储服务平台在接收到密钥管理工具的搜索请求之后，将根据S305中的索引在记录中查询之前用户所存 储的与该网站对应的所有用户名以及对应的密钥，并将搜索结果返回至密钥管理工具，后续密钥管理工具将获取到的与该网站对应的用户名、密码展示给用户。
基于与上述方法实施例相同的技术构思，本发明实施例还提供了一种服务器可以应用于上述方法流程中。
如图4所示，为本发明实施例提供的一种服务器的结构示意图，可以包括：
接收模块401，接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录所述鉴权服务器后由所述鉴权服务器下发至所述用户终端的；
鉴权模块402，对所述临时认证令牌进行鉴权；
处理模块403，若所述临时认证令牌鉴权通过，查询服务器自身与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
其中，所述临时认证令牌具体为所述用户终端在所述用户登录所述鉴权服务器后向所述鉴权服务器请求获取的。
所述密钥信息至少包括用户账户、用户密码以及网站标识；还包括：
填充模块，在接收到来自于所述用户终端的密钥填写请求时确定所述密钥填写请求对应的目标网站标识，在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码，将查询到的用户账户以及用户密码返回至所述用户终端。
所述密钥存储请求中还携带用户信息以及网站信息，还包括：
生成模块，根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引。
所述生成模块还在接收到来自于所述用户中的密钥检索请求时根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
通过应用本申请的技术方案，密钥管理服务器首先接收来自于用户终端的密钥存储请求，并对密钥存储请求中的临时认证令牌进行鉴权，由于临时认证令牌为用户在登录鉴权服务器后由鉴权服务器下发至用户终端，因此若临时认证令牌鉴权通过，密钥管理服务器即可在自身查询与用户对应的密钥存储空间，并将用户标识与密钥信息对应存储至密钥存储空间中。从而无需再在服务器之间设置专用接口实现用户密钥的存储，极大 简化了开发流程以及减少了开发成本，并在保障安全性的同时提高了开发效率。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明可以通过硬件实现，也可以借助软件加必要的通用硬件平台的方式来实现。基于这样的理解，本发明的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施场景所述的方法。
本领域技术人员可以理解附图只是一个优选实施场景的示意图，附图中的模块或流程并不一定是实施本发明所必须的。
本领域技术人员可以理解实施场景中的装置中的模块可以按照实施场景描述进行分布于实施场景的装置中，也可以进行相应变化位于不同于本实施场景的一个或多个装置中。上述实施场景的模块可以合并为一个模块，也可以进一步拆分成多个子模块。
上述本发明序号仅仅为了描述，不代表实施场景的优劣。
以上公开的仅为本发明的几个具体实施场景，但是，本发明并非局限于此，任何本领域的技术人员能思之的变化都应落入本发明的保护范围。

Claims (10)

  1. 一种用户密钥存储方法，其特征在于，所述方法应用于包括密钥管理服务器、用户终端以及鉴权服务器的密钥管理系统中，该方法包括：
    所述密钥管理服务器接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录所述鉴权服务器后由所述鉴权服务器下发至所述用户终端的；
    所述密钥管理服务器对所述临时认证令牌进行鉴权；
    若所述临时认证令牌鉴权通过，所述密钥管理服务器在自身查询与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
  2. 如权利要求1所述的方法，其特征在于，
    所述临时认证令牌具体为所述用户终端在所述用户登录所述鉴权服务器后向所述鉴权服务器请求获取的。
  3. 如权利要求1所述的方法，其特征在于，所述密钥信息至少包括用户账户、用户密码以及网站标识，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
    当接收到来自于所述用户终端的密钥填写请求时，所述密钥管理服务器确定所述密钥填写请求对应的目标网站标识；
    所述密钥管理服务器在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码；
    所述密钥管理服务器将查询到的用户账户以及用户密码返回至所述用户终端。
  4. 如权利要求1所述的方法，其特征在于，所述密钥存储请求中还携带用户信息以及网站信息，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
    所述密钥管理服务器根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引。
  5. 如权利要求4所述的方法，其特征在于，在所述密钥管理服务器将所述用户标识与所述密钥信息对应存储至所述密钥存储空间之后，还包括：
    当接收到来自于所述用户中的密钥检索请求时，根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
  6. 一种服务器，用于作为密钥管理服务器应用于包括所述密钥管理服务器、用户终端以及鉴权服务器的密钥管理系统中，其特征在于，包括：
    接收模块，接收来自于用户终端的密钥存储请求，所述密钥存储请求中携带有临时认证令牌、密钥信息以及用户标识，所述临时认证令牌为用户在登录所述鉴权服务器后由所述鉴权服务器下发至所述用户终端的；
    鉴权模块，对所述临时认证令牌进行鉴权；
    处理模块，在所述临时认证令牌鉴权通过时，查询服务器自身与所述用户对应的密钥存储空间，并将所述用户标识与所述密钥信息对应存储至所述密钥存储空间中。
  7. 如权利要求6所述的服务器，其特征在于，所述临时认证令牌具体为所述用户终端在所述用户登录所述鉴权服务器后向所述鉴权服务器请求获取的。
  8. 如权利要求6所述的服务器，其特征在于，所述密钥信息至少包括用户账户、用户密码以及网站标识；还包括：
    填充模块，在接收到来自于所述用户终端的密钥填写请求时确定所述密钥填写请求对应的目标网站标识，在所述密钥存储空间中查询与所述目标网站标识对应的用户账户以及用户密码，将查询到的用户账户以及用户密码返回至所述用户终端。
  9. 如权利要求6所述的服务器，其特征在于，所述密钥存储请求中还携带用户信息以及网站信息，还包括：
    生成模块，根据所述用户信息、所述网站信息、所述用户标识以及所述待存储密钥生成用户索引。
  10. 如权利要求9所述的服务器，其特征在于，
    所述生成模块还在接收到来自于所述用户中的密钥检索请求时根据所述密钥检索请求中携带的关键词以及所述用户索引生成搜索结果，并将所述搜索结果返回至所述用户终端。
PCT/CN2016/105668 2015-11-23 2016-11-14 一种用户密钥存储方法及服务器 Ceased WO2017088677A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510819162.2A CN106789848A (zh) 2015-11-23 2015-11-23 一种用户密钥存储方法及服务器
CN201510819162.2 2015-11-23

Publications (1)

Publication Number Publication Date
WO2017088677A1 true WO2017088677A1 (zh) 2017-06-01

Family

ID=58763022

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/105668 Ceased WO2017088677A1 (zh) 2015-11-23 2016-11-14 一种用户密钥存储方法及服务器

Country Status (2)

Country Link
CN (1) CN106789848A (zh)
WO (1) WO2017088677A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109889342A (zh) * 2018-12-15 2019-06-14 中国平安人寿保险股份有限公司 接口测试鉴权方法、装置、电子设备及存储介质
CN110247758A (zh) * 2019-05-30 2019-09-17 世纪龙信息网络有限责任公司 密码管理的方法、装置及密码管理器

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107025409A (zh) * 2017-06-27 2017-08-08 中经汇通电子商务有限公司 一种数据安全存储平台
CN108282331A (zh) * 2018-01-02 2018-07-13 金邦达有限公司 密码处理方法、装置及系统
TWI725352B (zh) * 2018-11-05 2021-04-21 緯創資通股份有限公司 驗證及授權的方法及驗證伺服器
CN109257381A (zh) * 2018-11-08 2019-01-22 江苏恒宝智能系统技术有限公司 一种密钥管理方法、系统及电子设备
CN110536152A (zh) * 2019-08-05 2019-12-03 广州珠江数码集团股份有限公司 一种机顶盒用户鉴权缓存方法、装置、介质及终端设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023875A (zh) * 2012-11-21 2013-04-03 北京荣之联科技股份有限公司 一种账户管理系统及方法
CN103929306A (zh) * 2014-04-02 2014-07-16 天地融科技股份有限公司 智能密钥设备和智能密钥设备的信息管理方法
WO2015149582A1 (zh) * 2014-04-02 2015-10-08 天地融科技股份有限公司 密码输入方法、智能密钥设备以及客户端装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102404337A (zh) * 2011-12-13 2012-04-04 华为技术有限公司 数据加密方法和装置
WO2014189262A1 (en) * 2013-05-24 2014-11-27 Strix Inc. User terminal authentication method of access point apparatus
KR101475462B1 (ko) * 2013-08-14 2014-12-23 브레인즈스퀘어(주) 사용자의 암호화 키로 암호화된 파일을 클라우드 스토리지와 동기화하는 시스템
CN104821937B (zh) * 2015-03-26 2018-05-11 腾讯科技（北京）有限公司 令牌获取方法、装置及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023875A (zh) * 2012-11-21 2013-04-03 北京荣之联科技股份有限公司 一种账户管理系统及方法
CN103929306A (zh) * 2014-04-02 2014-07-16 天地融科技股份有限公司 智能密钥设备和智能密钥设备的信息管理方法
WO2015149582A1 (zh) * 2014-04-02 2015-10-08 天地融科技股份有限公司 密码输入方法、智能密钥设备以及客户端装置

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109889342A (zh) * 2018-12-15 2019-06-14 中国平安人寿保险股份有限公司 接口测试鉴权方法、装置、电子设备及存储介质
CN109889342B (zh) * 2018-12-15 2023-07-18 中国平安人寿保险股份有限公司 接口测试鉴权方法、装置、电子设备及存储介质
CN110247758A (zh) * 2019-05-30 2019-09-17 世纪龙信息网络有限责任公司 密码管理的方法、装置及密码管理器

Also Published As

Publication number Publication date
CN106789848A (zh) 2017-05-31

Similar Documents

Publication Publication Date Title
US12598227B2 (en) Systems and methods for controlling sign-on to web applications
US11962511B2 (en) Organization level identity management
CA3038444C (en) Method for sso service using pki based on blockchain networks, and device and server using the same
US8544072B1 (en) Single sign-on service
WO2017088677A1 (zh) 一种用户密钥存储方法及服务器
CN109510849B (zh) 云存储的帐号鉴权方法和装置
US9450954B2 (en) Form filling with digital identities, and automatic password generation
US9124569B2 (en) User authentication in a cloud environment
US20180241742A1 (en) Token based one-time password security
CN103618717B (zh) 多账户客户信息的动态认证方法、装置和系统
US20170063836A1 (en) Method, device, and system for access control of a cloud hosting service
US8918862B2 (en) Managing access to storage media
WO2012000801A1 (en) Dynamic, temporary data access token
US20130185645A1 (en) Determining repeat website users via browser uniqueness tracking
EP3580684B1 (en) Authentication based on client access limitation
CN104580364A (zh) 一种资源分享的方法和装置
US11550942B2 (en) Universal file access control system and method
CN116484338A (zh) 数据库访问方法及装置
US10904011B2 (en) Configuration updates for access-restricted hosts
CN103118025A (zh) 基于入网认证的单点登录方法、装置及认证服务器
CN118869289A (zh) 基于堡垒机对Windows资产的访问管理方法及装置
US11477189B2 (en) Primary domain and secondary domain authentication
KR20190106589A (ko) 전자 디바이스에 서비스를 제공하는 장치 및 그 방법
KR102689921B1 (ko) 큐버네티스 클러스터의 사용자 통합 인증 방법 및 서버
CN115987626A (zh) 一种信息处理方法及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16867901

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16867901

Country of ref document: EP

Kind code of ref document: A1