WO2019134236A1 - 密码管理方法、装置、终端设备及存储介质 - Google Patents

密码管理方法、装置、终端设备及存储介质 Download PDF

Info

Publication number
WO2019134236A1
WO2019134236A1 PCT/CN2018/077332 CN2018077332W WO2019134236A1 WO 2019134236 A1 WO2019134236 A1 WO 2019134236A1 CN 2018077332 W CN2018077332 W CN 2018077332W WO 2019134236 A1 WO2019134236 A1 WO 2019134236A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
terminal
token
dynamic
dynamic password
Prior art date
Application number
PCT/CN2018/077332
Other languages
English (en)
French (fr)
Inventor
江炬生
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019134236A1 publication Critical patent/WO2019134236A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication

Definitions

  • the present application relates to the field of password security management, and in particular, to a password management method, apparatus, terminal device, and storage medium.
  • the embodiment of the present invention provides a password management method, device, terminal device, and storage medium, so as to solve the problem that the current user easily forgets the password and is prone to password leakage.
  • an embodiment of the present application provides a password management method, including the following steps performed by a first terminal:
  • the token seed information is processed according to a preset password generation algorithm to generate a first dynamic password.
  • the embodiment of the present application provides a password management method, including the following steps performed by a second terminal:
  • the token seed information is processed according to a preset password generation algorithm to generate and display a second dynamic password.
  • the embodiment of the present application provides a password management apparatus, including a first terminal, where the first terminal includes:
  • a random two-dimensional code generating module configured to acquire a random two-dimensional code generating instruction, and automatically generate and display the random two-dimensional code every other time change period, where the random two-dimensional code includes token seed information;
  • a first dynamic password generating module configured to process the token seed information according to a preset password generation algorithm according to a time synchronization form, to generate a first dynamic password
  • the unlock password obtaining module is configured to obtain an unlock password input by the user
  • the password acquisition interface enters a module, and is configured to enter a password acquisition interface if the unlock password matches the first dynamic password;
  • the destination password obtaining module is configured to obtain a destination password obtaining instruction, and obtain a destination password on the password obtaining interface according to the destination password obtaining instruction.
  • the embodiment of the present application provides a password management apparatus, including a second terminal, where the second terminal includes:
  • Token application load module for loading token applications
  • a token seed information obtaining module configured to scan a random two-dimensional code of the first terminal by using the token application, to obtain token seed information
  • the second dynamic password generating module is configured to process the token seed information according to a preset password generation algorithm according to a time synchronization form, and generate and display a second dynamic password.
  • an embodiment of the present application provides a terminal device, where the terminal device is a first terminal, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, The processor implements the following steps when executing the computer readable instructions:
  • the token seed information is processed according to a preset password generation algorithm to generate a first dynamic password.
  • the embodiment of the present application provides a terminal device, where the terminal device is a second terminal, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor,
  • the processor implements the following steps when executing the computer readable instructions:
  • the token seed information is processed according to a preset password generation algorithm to generate and display a second dynamic password.
  • the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores computer readable instructions, and when the computer readable instructions are executed by a processor of the first terminal, the following steps are implemented:
  • the token seed information is processed according to a preset password generation algorithm to generate a first dynamic password.
  • the embodiment of the present application provides a computer readable storage medium, where the computer readable storage medium stores computer readable instructions, and when the computer readable instructions are executed by a processor of the second terminal, the following steps are implemented:
  • the token seed information is processed according to a preset password generation algorithm to generate and display a second dynamic password.
  • the token seed information is processed according to a preset password generation algorithm based on the time synchronization form and the token seed information included in the random two-dimensional code.
  • the first dynamic password generated by the first terminal and the second terminal password generated by the second terminal can be successfully matched in the same time change period, and enter the password obtaining interface, and obtain the destination password by using the password obtaining instruction in the password obtaining interface.
  • the first terminal can store the user's password efficiently and securely.
  • the user obtains the stored password, and the second terminal scans the random two-dimensional code to generate the second dynamic password, and uses the second dynamic password to obtain the password stored in the first terminal.
  • the process needs to be combined with two terminals for password verification, which effectively ensures the security of the password, so that the user can manage and store the password safely and effectively.
  • FIG. 1 is a flowchart of a password management method in Embodiment 1 of the present application.
  • FIG. 2 is a specific flowchart of step S13 in FIG. 1.
  • FIG. 3 is a specific flow chart of step S15 of FIG. 1.
  • FIG 4 is a specific flow chart of step S17 of Figure 1.
  • FIG. 5 is a schematic block diagram of a password management apparatus in Embodiment 2 of the present application.
  • FIG. 6 is a schematic diagram of a terminal device in Embodiment 4 of the present application.
  • the password management method specifically includes the following steps performed by the first terminal:
  • the token seed information is processed according to a preset password generation algorithm to generate a first dynamic password.
  • the password management method specifically includes the following steps performed by the second terminal:
  • the token seed information is processed according to a preset password generation algorithm to generate and display a second dynamic password.
  • the password management method can be implemented by a first terminal with a built-in password safe and a second terminal with a token application built in, and the configuration of the first terminal and the second terminal enables secure and efficient management and storage of passwords.
  • the first terminal includes but is not limited to the smart watch in this embodiment
  • the second terminal includes, but is not limited to, the smart phone in this embodiment.
  • FIG. 1 shows a flow chart of a password management method in this embodiment. As shown in FIG. 1, the implementation process of the password management method is illustrated by the following detailed example:
  • the first terminal acquires a random two-dimensional code generating instruction, and automatically generates and displays a random two-dimensional code every other time change period, where the random two-dimensional code includes token seed information.
  • the first terminal may be a smart watch with a built-in password safe.
  • the random two-dimensional code generating instruction refers to an instruction input by the user to the first terminal for triggering the first terminal and causing the first terminal to generate a random two-dimensional code. It can be understood that the first terminal does not always be in a state of generating a random two-dimensional code. Therefore, the random second-dimensional code command is required to trigger the first terminal, so that the first terminal generates a random two-dimensional code based on the random two-dimensional code generating instruction.
  • the time change period is the time when each random two-dimensional code exists. For example, if each two-dimensional code exists for 30 seconds, the time change period is 30 seconds.
  • the token seed information may specifically refer to a random string carrying 64 bytes. It can be understood that the token seed information can be saved in the form of a random two-dimensional code, that is, the random two-dimensional code corresponding to the token seed information includes 64 bytes of information of the token seed information.
  • the first terminal acquires a random two-dimensional code generation instruction input by the user, and triggers the first terminal, so that the first terminal starts to generate a random two-dimensional code.
  • the random two-dimensional code will regenerate a new random two-dimensional code every other time change period (such as 30 seconds), and display the generated random two-dimensional code on the display interface of the first terminal.
  • the generated random two-dimensional code includes token seed information, which may be a random string carrying 64 bytes.
  • the first terminal may be used to generate a random two-dimensional code, which provides a basis for the subsequent second terminal to acquire the token seed information carried by the random two-dimensional code.
  • the first terminal processes the token seed information according to a preset password generation algorithm according to a time synchronization form to generate a first dynamic password.
  • the time synchronization form refers to that the server clock of the first terminal and the server clock of the second terminal are synchronized with respect to time. It can be understood that the time of the first terminal and the second terminal are the same and synchronized, and there is no difference in time, and the current time of the first terminal and the second terminal (ie, the current time of the system) are the same.
  • the first terminal processes the token seed information saved by the generated random two-dimensional code according to a preset password generation algorithm.
  • the process may be: first, the first terminal generates a time string based on a time synchronization form with the second terminal, where the time string may be a current time and a generation time (the time when the first terminal starts generating the random two-dimensional code). The time difference value, and the time-dependent string obtained by dividing the time difference value by the time change period. Then, based on the token seed information and the time string, a digest operation is performed to obtain a digest feature, that is, a digest operation is performed on the time string and the token seed information (random string), and the corresponding digest feature is obtained.
  • the algorithm of the digest operation may be other algorithms such as HMAC-SHA-1 in the one-way hash function.
  • the feature value is extracted from the summary feature to generate a first dynamic password.
  • the long digest feature is processed to obtain a 32-bit (4 byte) unsigned integer, mod is the modulo operation, d is the length of the eigenvalue, and X is the digest feature.
  • the value of the eigenvalue d can be any positive integer. If the value of d is 6, the last extracted feature value can be 123456.
  • the feature value generated by the operation of the first terminal is the first dynamic password.
  • the first terminal processes the token seed information according to a preset password generation algorithm, and the generated first dynamic password is stored in the first device as a time-lock period.
  • the verification password of the first device is stored in the first device as a time-lock period.
  • the second terminal may be a smart phone with a token application built in.
  • a token application is an application that can generate tokens based on a predetermined password generation algorithm.
  • the dynamic password generated by the token application of the second terminal is referred to as a second dynamic password, and the password generation algorithm preset in the token application of the second terminal and the preset password in the first terminal are used.
  • the generation algorithm is the same.
  • the second terminal loads the token application, which is a token seed information that can be acquired by the first terminal, and provides a running environment for generating the second dynamic password according to the preset password generation algorithm. basis.
  • S14 The second terminal scans the random two-dimensional code of the first terminal by using a token application, and obtains token seed information.
  • the token application has a scanning function including but not limited to two-dimensional code scanning.
  • the token application of the second terminal acquires the scan instruction input by the user, enters the scan state interface, and aligns the scan status interface of the second terminal with the random two-dimensional code displayed on the display interface of the first terminal, and obtains the The token seed information in the random QR code.
  • the step of scanning the random two-dimensional code of the first terminal by using the token application by the second terminal ensures that the token seed information acquired by the second terminal is consistent with the token seed information generated by the first terminal.
  • the second terminal processes the token seed information according to a preset password generation algorithm according to a time synchronization form, and generates and displays a second dynamic password.
  • the second terminal processes the token seed information acquired by the first terminal scan according to a preset password generation algorithm, and generates and displays a second dynamic password.
  • the password generation algorithm preset in the token application of the second terminal is the same as the password generation algorithm preset in the first terminal, and is the first dynamic password generated by the first terminal and the second generated by the second terminal. Dynamic passwords are the same basis for providing the same time period.
  • the first terminal and the second terminal adopt the same token seed information, and when the first dynamic password and the second dynamic password are in the same time change period, the generated second dynamic password and the first dynamic password will be The second terminal can be used to unlock the first terminal to enter the password acquisition interface of the first terminal.
  • S16 The first terminal acquires an unlock password input by the user.
  • the unlock password refers to any password that attempts to unlock the first terminal to enter the password acquisition interface of the first terminal.
  • a random two-dimensional code is displayed on the display interface of the first terminal.
  • a password unlocking frame can also be displayed on the display interface.
  • the password unlock box is used to obtain an unlock password input by the user.
  • the first terminal acquires the unlock password input by the user based on the password unlocking box to try to unlock the first terminal and enter the password of the password obtaining interface of the first terminal.
  • the unlock password may be the second dynamic password generated by the second terminal, or may be any other input password.
  • S17 The first terminal enters a password obtaining interface of the first terminal when the unlocking password matches the first dynamic password.
  • the first terminal matches the first dynamic password stored in the first terminal according to the unlock password entered in the password unlocking box. If the unlocking password matches the first dynamic password (that is, the same), the unlocking succeeds and the first terminal is successfully entered.
  • Password acquisition interface In particular, when the input unlock password is continuously erroneously reached for a preset number of times (eg, 5 times), the first terminal will be locked within a preset period of time (eg, 1 hour), and no operation can be performed on the first terminal at this time. .
  • the first terminal generates a random two-dimensional code and a corresponding first dynamic password every other time change period
  • the second terminal scans the random two-dimensional code and generates a second dynamic password based on the random two-dimensional code.
  • the user can unlock the first terminal by inputting an unlock password on the first terminal according to the displayed second dynamic password.
  • the first dynamic password on the first terminal is updated every other time period. If the user fails to input the matching unlock password (that is, the displayed second dynamic password) in time, the user may not be able to enter the matching password. Unlock the first terminal.
  • S18 The first terminal acquires a destination password obtaining instruction, and acquires a destination password on the password obtaining interface according to the destination password obtaining instruction.
  • the destination password refers to the password that the user ultimately wants to obtain.
  • the destination password can include multiple attributes such as password name and comment information. If the destination password is stored as a file, the password file stored as a file is the destination password file.
  • the destination password acquisition instruction may specifically be an instruction such as a destination password selection instruction or a destination password query instruction, and the destination password acquisition instruction is a general concept, and may include a plurality of specific instructions for obtaining a destination password.
  • the password acquisition interface of the first terminal displays a password file list, and the user can obtain the destination password file according to the password file list, and obtain the destination password file through the destination password file.
  • password When the destination password acquisition instruction specifically refers to the destination password query instruction, the password acquisition interface of the first terminal displays a search box, and the user can search for the destination password according to the attribute of the destination password (such as the destination password name). For example, when querying "Ping An Auto Insurance", if "Ping Auto Insurance" is an existing password name, the password file with the same password name will be displayed on the password acquisition interface, and the password file is the destination password file, which is obtained through the destination password file. Destination password.
  • the query “Ping” will display all the account password files related to Ping An (ie support fuzzy query).
  • the user can obtain the destination password file in all the password files of the "Peace” account displayed, and obtain the destination password through the destination password file. By obtaining the destination password on the password acquisition interface, the destination password can be obtained quickly and conveniently.
  • step S13 the second terminal loads the token application, and specifically includes the following steps:
  • S131 The second terminal acquires current fingerprint information.
  • the second terminal is a device with a fingerprint recognition function.
  • the current fingerprint information refers to fingerprint information for verification that the user enters on the second terminal.
  • the second terminal acquires current fingerprint information input by the user to perform identity verification on the user fingerprint.
  • S132 The second terminal performs fingerprint identification according to the current fingerprint information and the pre-stored standard fingerprint information, and acquires fingerprint recognition similarity.
  • the standard fingerprint information refers to fingerprint information used by the user to be entered and stored in the second terminal for verifying the legality of the user identity.
  • the second terminal invokes the pre-stored standard fingerprint information according to the obtained current fingerprint information.
  • the standard fingerprint information can be stored in the form of a file.
  • the second terminal compares the current fingerprint information with the standard fingerprint information according to the preset fingerprint identification model, and acquires the fingerprint recognition similarity based on the current fingerprint information and the standard fingerprint information in the preset fingerprint recognition model.
  • the fingerprint recognition similarity may be represented by a probability value, for example, the acquired fingerprint recognition similarity may be 0.98.
  • the preset similarity threshold refers to a pre-set evaluation reference value for determining whether the fingerprint recognition similarity can pass the user identity verification.
  • the preset similarity threshold may be set to 0.95, and when the fingerprint recognition similarity is less than or equal to 0.95, the current fingerprint information and the standard fingerprint information are not considered to belong to the fingerprint of the same user, and cannot be verified by the user identity.
  • the second terminal will not be able to load the token application.
  • the fingerprint recognition similarity is greater than 0.95, it is considered that the current fingerprint information and the standard fingerprint information belong to the same user's fingerprint, and can be verified by the user identity.
  • the second terminal then loads the token application after successful authentication.
  • the second terminal can effectively ensure the security and uniqueness of the token application loading through the fingerprint-based user identity verification mechanism, and ensure that only the corresponding user corresponding to the second terminal can load and use the token application of the second terminal.
  • step S15 the second terminal processes the token seed information according to a preset password generation algorithm according to a time synchronization format, and generates and displays a second dynamic password, specifically including The following steps:
  • the second terminal acquires a time string based on a time synchronization form with the first terminal.
  • the time synchronization form refers to that the server clock of the first terminal and the server clock of the second terminal are synchronized with respect to time. It can be understood that the time of the first terminal and the second terminal are the same and synchronized, and there is no difference in time, and the current time of the first terminal and the second terminal (ie, the current time of the system) are the same.
  • the second terminal acquires a time string based on a time synchronization form with the first terminal.
  • the time string based on the time synchronization form of the second terminal may specifically be a time difference obtained by taking the time and the generation time (the time when the first terminal starts generating the random two-dimensional code), and dividing the time difference by the time variation.
  • the time-dependent string obtained by the period. Because it is a time synchronization form, the time string generated by the second terminal and the time string generated by the first terminal are the same, and the consistency of the time string generated by the second terminal and the first terminal is ensured.
  • S152 The second terminal performs a digest operation based on the token seed information and the time string to obtain the digest feature.
  • the digest operation can be realized by a one-way hash function.
  • a one-way hash function also known as a one-way hash function, is capable of changing an arbitrarily long input message string into a fixed-length output string, and it is difficult to obtain a function of the input string from the output string.
  • This output string is called the hash value of the message, the digest feature.
  • the second terminal performs a digest operation based on the token seed information and the time string to obtain the digest feature.
  • the algorithm of the digest operation may be other algorithms such as HMAC-SHA-1 in the one-way hash function.
  • HMAC is a key-related hash operation message authentication code.
  • the HMAC operation uses a hash algorithm (such as SHA-1) to input a message digest as an output with a key and a message.
  • HMAC is used.
  • the key entered in is the token seed information, and the input message is the time string.
  • SHA-1 Secure Hash Algorithm, also known as SHS, Secure Hash Standard
  • SHS Secure Hash Standard
  • S153 The second terminal extracts the feature value from the digest feature to generate a second dynamic password.
  • the second terminal is required to extract the feature value from the digest feature to generate a second dynamic password.
  • the excessively long digest feature obtained by the algorithm such as -1 is processed to obtain a 32-bit (4 byte) unsigned integer, mod is the modulo operation, d is the length of the eigenvalue, and X is the digest feature.
  • the value of the eigenvalue d can be any positive integer. If the value of d is 6, the last extracted feature value can be 123456.
  • the feature value generated by the second terminal operation is the second dynamic password.
  • the steps S151-S153 and the step S12 are related, and the difference is the difference of the execution subject.
  • the process of generating the first dynamic password by the first terminal is not repeated here.
  • the time string is the same on the first terminal and the second terminal
  • the token seed information is the same on the first terminal and the second terminal based on the mechanism for scanning the random two-dimensional code. .
  • the digest features acquired after the same digest operation are also necessarily the same, and the feature values extracted for the digest feature are also the same.
  • the first dynamic password generated by the first terminal and the second dynamic password generated by the second terminal are the same, so that the user can achieve the same through the orderly interaction between the first terminal and the second terminal.
  • the same effect of the dynamic password generated by each time in the time change period provides a basis for effectively verifying the unlock password and unlocking the first terminal to obtain the password stored in the first terminal.
  • step S17 the following steps are included:
  • the first terminal determines, according to the generation time of the first dynamic password and the current time of the system, whether the first dynamic password is in a time change period.
  • the current time of the system is the current time of the first terminal server clock, and the generation time of the first dynamic password and the current time of the system can be expressed in the form of a timestamp, wherein the timestamp is a data that can represent a certain data.
  • the complete and verifiable data that existed before a specific time usually a sequence of characters, uniquely identifies the time of a certain moment.
  • the first terminal acquires and calculates the time difference (absolute value) of the two dynamic passwords based on the generation time of the first dynamic password and the current time of the system. Whether the first dynamic password is within a time change period is determined according to the time difference.
  • the generation time of the first dynamic password is represented by a timestamp of 1514346507
  • the unlock password refers to any password that attempts to unlock the first terminal to enter the password acquisition interface of the first terminal.
  • the first dynamic password is in the time change period and the unlock password is the second dynamic password, the matching can be completed.
  • the unlock password input by the user may be a password composed of any character, that is, the unlock password may be the second dynamic password or may not be the second dynamic password.
  • the second dynamic password is input as an unlock password to the first terminal for matching verification when the first dynamic password is in the time change period.
  • the token seed information is the same based on the time synchronization form and the information interaction between the first terminal and the second terminal (by scanning
  • the first dynamic password and the second dynamic password must be the same when the first dynamic password is in the time change period, that is, the first dynamic password matches the unlock password.
  • the password verification process of the first terminal is completed, thereby unlocking the first terminal.
  • the first terminal has a built-in tamper protection circuit, and the tamper protection circuit is configured to detect whether the first terminal is disassembled and is related to the tampering when the first terminal is disassembled (such as clearing the password) control signal.
  • the password management method may further include the following steps: the first terminal acquires a control signal sent by the tamper protection circuit; and if the control signal is a password clear signal, the password stored by the first terminal is cleared according to the password clear signal.
  • the first terminal acquires a control signal sent by the tamper protection circuit.
  • the control signal When the first terminal is not disassembled, the control signal only transmits a signal that the current circuit condition is normal to the first terminal, instead of Will do any processing on the first terminal. If the first terminal is disassembled and destroyed, the tamper protection circuit will detect that the circuit of the first terminal is abnormal, and will immediately send a password clear signal.
  • the control signal sent by the tamper protection circuit acquired by the first terminal is a password clear signal, and the first terminal will execute an instruction to clear the password stored by the first terminal according to the password clear signal, and the built-in tamper protection circuit can ensure the first The security of a password stored by a terminal.
  • the time string is the same on the first terminal and the second terminal, and based on the mechanism for scanning the random two-dimensional code, the token seed information is in the first terminal and the first The same is true on the second terminal.
  • the digest features acquired after the same digest operation are also necessarily the same, and the feature values extracted for the digest feature are also the same. That is, in the same time change period, the first dynamic password generated by the first terminal and the second dynamic password generated by the second terminal are the same, so that the user can achieve the same through the orderly interaction between the first terminal and the second terminal.
  • the effect of the same dynamic password generated in the time change period is that the unlocking password is validly verified, and the first terminal is unlocked to obtain the password stored in the first terminal, so that the first dynamic password generated by the first terminal and the second
  • the second terminal password generated by the terminal can be successfully matched in the same time change period, and enters the password acquisition interface, and obtains the destination password through the password acquisition instruction in the password acquisition interface.
  • the first terminal can store the user's password efficiently and securely.
  • the user obtains the stored password
  • the second terminal scans the random QR code of the first terminal to generate a second dynamic password, and uses the second dynamic password to obtain the password stored in the first terminal.
  • the process needs to be combined with two terminals for password verification, which effectively ensures the security of the password stored by the user at the first terminal, so that the user can manage and store the password safely and effectively.
  • Fig. 5 is a block diagram showing the principle of the password management apparatus corresponding to the password management method in the first embodiment.
  • the password management apparatus includes a first terminal 10 and a second terminal 20.
  • the first terminal 10 includes a random two-dimensional code generation module 11, a first dynamic password generation module 12, an unlock password acquisition module 13, a password acquisition interface entry module 14, and a destination password acquisition module 15.
  • the implementation functions of the random two-dimensional code generation module 11, the first dynamic password generation module 12, the unlock password acquisition module 13, the password acquisition interface entry module 14, and the destination password acquisition module 15 are the first in the password management method in the first embodiment.
  • the steps corresponding to the terminal correspond one-to-one. To avoid redundancy, the present embodiment is not described in detail.
  • the random two-dimensional code generating module 11 is configured to acquire a random two-dimensional code generating instruction, and automatically generate and display a random two-dimensional code every other time change period, and the random two-dimensional code includes token seed information.
  • the first dynamic password generating module 12 is configured to process the token seed information according to a preset password generation algorithm according to a time synchronization form to generate a first dynamic password.
  • the unlock password acquisition module 13 is configured to acquire an unlock password input by the user.
  • the password acquisition interface enters the module 14 for entering the password acquisition interface if the unlock password matches the first dynamic password.
  • the destination password obtaining module 15 is configured to obtain a destination password obtaining instruction, and obtain a destination password on the password obtaining interface according to the destination password obtaining instruction.
  • the password acquisition interface entry module 14 includes a first dynamic password determination unit 141 and a password matching unit 142.
  • the first dynamic password determining unit 141 is configured to determine whether the first dynamic password is in a time change period based on a generation time of the first dynamic password and a current time of the system.
  • the password matching unit 142 is configured to: if the first dynamic password is in the time change period, and the unlock password is the second dynamic password, the first dynamic password matches the unlock password, where the second dynamic password is the second terminal based on the time In the synchronous form, the token seed information is processed and generated according to a preset password generation algorithm.
  • the first terminal 10 of the password management device further includes a tamper protection circuit module 16, and preferably, the tamper protection circuit module 16 includes a control signal acquisition unit 161 and a password clearing unit 162.
  • the control signal acquiring unit 161 is configured to acquire a control signal sent by the tamper protection circuit.
  • the password clearing unit 162 is configured to: if the control signal is a password clearing signal, clear the password stored by the first terminal according to the password clearing signal.
  • the password management apparatus includes a first terminal 10 and a second terminal 20.
  • the second terminal 20 includes a token application loading module 21, a token seed information acquiring module 22, and a second dynamic password generating module 23.
  • the implementation functions of the token application loading module 21, the token seed information obtaining module 22, and the second dynamic password generating module 23 are in one-to-one correspondence with the steps corresponding to the second terminal in the password management method in Embodiment 1, in order to avoid redundancy. This embodiment is not described in detail.
  • the token application loading module 21 is used to load the token application.
  • the token seed information obtaining module 22 is configured to scan the random two-dimensional code of the first terminal by using the token application to obtain token seed information.
  • the second dynamic password generating module 23 is configured to process the token seed information according to a preset password generation algorithm according to a time synchronization form, and generate and display a second dynamic password.
  • the token application loading module 21 includes a current fingerprint information acquiring unit 211, a fingerprint recognition similarity acquiring unit 212, and a token application loading unit 213.
  • the current fingerprint information acquiring unit 211 is configured to acquire current fingerprint information.
  • the fingerprint identification similarity obtaining unit 212 is configured to perform fingerprint identification according to current fingerprint information and pre-stored standard fingerprint information, and acquire fingerprint recognition similarity.
  • the token application loading unit 213 is configured to load the token application if the fingerprint recognition similarity is greater than the preset similarity threshold.
  • the second dynamic password generating module 23 includes a time string obtaining unit 231, a digest feature acquiring unit 232, and a second dynamic password generating unit 233.
  • the time string obtaining unit 231 is configured to acquire a time string based on a time synchronization form with the first terminal.
  • the summary feature obtaining unit 232 is configured to perform a digest operation based on the token seed information and the time string to obtain the digest feature.
  • the second dynamic password generating unit 233 is configured to extract the feature value from the digest feature to generate a second dynamic password.
  • the embodiment provides a computer readable storage medium, where the computer readable storage medium is stored with the computer readable instructions, and the computer readable instructions are executed by the processor to implement the password management method in Embodiment 1. Let me repeat. Alternatively, when the computer readable instructions are executed by the processor, the functions of the modules/units in the password management apparatus in Embodiment 2 are implemented. To avoid repetition, details are not described herein again.
  • FIG. 6 is a schematic diagram of a terminal device in this embodiment.
  • terminal device 60 includes a processor 61, a memory 62, and computer readable instructions 63 stored in memory 62 and operative on processor 61.
  • the processor 61 implements the various steps of the password management method of Embodiment 1 when the computer readable instructions 63 are executed, such as steps S11-S18 shown in FIG.
  • the processor 61 executes the computer readable instructions 63
  • the functions of the modules/units of the password management apparatus in the second embodiment are implemented, for example, the random two-dimensional code generating module 11 and the first dynamic password generating module 12 shown in FIG.
  • the functions of the unlock password acquisition module 13, the password acquisition interface entry module 14 and the destination password acquisition module 15, or the token application loading module 21, the token seed information acquisition module 22, and the second dynamic password generation module 23 are provided.
  • computer readable instructions 63 may be partitioned into one or more modules/units, one or more modules/units being stored in memory 62 and executed by processor 61 to complete the application.
  • the one or more modules/units may be an instruction segment of a series of computer readable instructions 63 capable of performing a particular function for describing the execution of computer readable instructions 63 in the terminal device 60.
  • the computer readable instructions 63 may be divided into the random two-dimensional code generation module 11, the first dynamic password generation module 12, the unlock password acquisition module 13, the password acquisition interface entry module 14, and the destination password acquisition module 15 in Embodiment 2.
  • Or can be divided into a token application loading module 21, a token seed information obtaining module 22, and a second dynamic password generating module 23, and the specific functions of each module are as shown in Embodiment 2, in order to avoid duplication, here is not the case.
  • a narrative can be divided into a token application loading module 21, a token seed information obtaining module 22, and a second dynamic password generating module 23, and the specific functions of each module are
  • the terminal device 60 can be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server.
  • the terminal device may include, but is not limited to, a processor 61, a memory 62. It will be understood by those skilled in the art that FIG. 6 is only an example of the terminal device 60, and does not constitute a limitation on the terminal device 60, and may include more or less components than those illustrated, or combine some components, or different components.
  • the terminal device may further include an input/output device, a network access device, a bus, and the like.
  • the processor 61 may be a central processing unit (CPU), or may be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the memory 62 may be an internal storage unit of the terminal device 60, such as a hard disk or memory of the terminal device 60.
  • the memory 62 may also be an external storage device of the terminal device 60, such as a plug-in hard disk provided on the terminal device 60, a smart memory card (SMC), a Secure Digital (SD) card, and a flash memory card (Flash). Card) and so on.
  • the memory 62 may also include both an internal storage unit of the terminal device 60 and an external storage device.
  • the memory 62 is used to store computer readable instructions as well as other programs and data required by the terminal device.
  • the memory 62 can also be used to temporarily store data that has been or will be output.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • An integrated module/unit if implemented in the form of a software functional unit and sold or used as a stand-alone product, can be stored in a computer readable storage medium.
  • the present application implements all or part of the processes in the foregoing embodiments, and may also be implemented by computer-readable instructions to instruct related hardware, and the computer readable instructions may be stored in a computer readable storage medium.
  • the computer readable instructions when executed by a processor, can implement the steps of the various method embodiments described above.
  • the computer readable instructions comprise computer readable instruction code, which may be in the form of source code, in the form of an object code, an executable file or some intermediate form or the like.
  • the computer readable medium may comprise any entity or device capable of carrying computer readable instruction code, a recording medium, a USB flash drive, a removable hard drive, a magnetic disk, an optical disk, a computer memory, a Read-Only Memory (ROM), a random Access memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals, and software distribution media.
  • ROM Read-Only Memory
  • RAM Random Access Memory

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种密码管理方法、装置、终端设备及存储介质。该密码管理方法，包括：获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；获取用户输入的解锁密码；若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。该密码管理方法能够有效地对密码进行管理和存储，并保证密码的安全性。

Description

密码管理方法、装置、终端设备及存储介质
本专利申请以2018年1月8日提交的申请号为201810014164.8，名称为“密码管理方法、装置、终端设备及存储介质”的中国发明专利申请为基础，并要求其优先权。
技术领域
本申请涉及密码安全管理领域，尤其涉及一种密码管理方法、装置、终端设备及存储介质。
背景技术
在用户拥有多个银行卡账户和各种互联网应用账户的场景下，用户需要设置和记住对应账户的密码。若使用单一的密码将会面临一个密码泄漏导致全部账户的密码泄漏的重大风险；若将每个银行卡账户或者应用账户的密码都设置成不一样的密码，将会加大用户负担，使得用户难以同时记住多个账户的密码。因此往往有大部分人会将密码通过文本方式存储到邮件、电脑或者手机等上，但是该做法同样存在当文件被窃取时导致批量密码泄漏的严重风险。
发明内容
本申请实施例提供一种密码管理方法、装置、终端设备及存储介质，以解决当前用户容易忘记密码且容易出现密码泄露的问题。
第一方面，本申请实施例提供一种密码管理方法，包括第一终端执行的如下步骤：
获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
获取用户输入的解锁密码；
若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密 码。
第二方面，本申请实施例提供一种密码管理方法，包括第二终端执行的如下步骤：
加载令牌应用程序；
采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
第三方面，本申请实施例提供一种密码管理装置，包括第一终端，所述第一终端包括：
随机二维码生成模块，用于获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
第一动态密码生成模块，用于基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
解锁密码获取模块，用于获取用户输入的解锁密码；
密码获取界面进入模块，用于若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
目的密码获取模块，用于获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
第四方面，本申请实施例提供一种密码管理装置，包括第二终端，所述第二终端包括：
令牌应用程序加载模块，用于加载令牌应用程序；
令牌种子信息获取模块，用于采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
第二动态密码生成模块，用于基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
第五方面，本申请实施例提供一种终端设备，所述终端设备为第一终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，所述处理器执行所述计算机可读指令时实现如下步骤：
获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
获取用户输入的解锁密码；
若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
第六方面，本申请实施例提供一种终端设备，所述终端设备为第二终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，所述处理器执行所述计算机可读指令时实现如下步骤：
加载令牌应用程序；
采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
第七方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，所述计算机可读指令被第一终端的处理器执行时实现如下步骤：
获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
获取用户输入的解锁密码；
若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
第八方面，本申请实施例提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，所述计算机可读指令被第二终端的处理器执行时实现如下步骤：
加载令牌应用程序；
采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
本申请实施例所提供的密码管理方法、装置、终端设备及存储介质中，基于时间同步形式和随机二维码包括的令牌种子信息，对令牌种子信息按预设的密码生成算法进行处理，使得第一终端生成的第一动态密码和第二终端生成的第二终端密码在同一时间变化周期内能够匹配成功，并进入密码获取界面，在密码获取界面中通过密码获取指令获取目的 密码。第一终端能够有效安全地存储用户的密码。用户获取存储的密码，需通过第二终端扫描随机二维码生成第二动态密码，利用第二动态密码获取存储在第一终端中的密码。该过程需结合两个终端进行密码验证，有效保证密码的安全性，使得用户可以安全有效地管理和存储密码。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对本申请实施例的描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例1中密码管理方法的一流程图。
图2是图1中步骤S13的一具体流程图。
图3是图1中步骤S15的一具体流程图。
图4是图1中步骤S17的一具体流程图。
图5是本申请实施例2中密码管理装置的一原理框图。
图6是本申请实施例4中终端设备的一示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
实施例1
该密码管理方法具体包括第一终端执行的如下步骤：
获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
获取用户输入的解锁密码；
若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
该密码管理方法具体包括第二终端执行的如下步骤：
加载令牌应用程序；
采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
该密码管理方法可通过内置有密码保险箱的第一终端和内置有令牌应用程序的第二终端实现，通过第一终端和第二终端的配置，能够实现安全有效地管理和存储密码。第一终端包括但不限于本实施例中的智能手表，第二终端包括但不限于本实施例中的智能手机。
图1示出本实施例中密码管理方法的一流程图。如图1所示，通过以下详细示例说明该密码管理方法的实现过程：
S11：第一终端获取随机二维码生成指令，每隔一时间变化周期自动生成并显示随机二维码，随机二维码包括令牌种子信息。
其中，该第一终端可以是内置有密码保险箱的智能手表。随机二维码生成指令是指用户向第一终端输入的用于触发第一终端并使第一终端生成随机二维码的指令。可以理解地，第一终端不会一直处于生成随机二维码的状态，故需要获取随机二维码指令触发第一终端，令第一终端基于随机二维码生成指令生成随机二维码。时间变化周期即每个随机二维码存在的时间，如每个二维码存在的时间为30秒，则该时间变化周期为30秒。令牌种子信息具体可以是指承载64字节的随机字符串。可以理解地，该令牌种子信息可以通过随机二维码的形式保存，即令牌种子信息对应的随机二维码包括该令牌种子信息的64字节信息。
本实施例中，第一终端获取用户输入的随机二维码生成指令，触发第一终端，使得第一终端开始生成随机二维码。随机二维码每隔一时间变化周期(如30秒)将重新生成新的随机二维码，并将每次生成的随机二维码显示在第一终端的显示界面上。生成的随机二维码包括令牌种子信息，该令牌种子信息可以是承载64字节的随机字符串。通过获取随机二维码生成指令，可以利用第一终端生成随机二维码，为后续第二终端获取该随机二维码承载的令牌种子信息提供了基础。
S12：第一终端基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理， 生成第一动态密码。
其中，时间同步形式是指第一终端的服务器时钟和第二终端的服务器时钟关于时间同步。可以理解地，即第一终端和第二终端的时间相同且同步，不存在时间上的差异，第一终端和第二终端的现时时间(即系统当前时间)相同。
本实施例中，基于时间同步形式，第一终端将生成的随机二维码保存的令牌种子信息按预设的密码生成算法进行处理。具体地，该处理过程可以是首先第一终端生成与第二终端基于时间同步形式的时间串，该时间串具体可以是取现时时间和生成时间(第一终端开始生成随机二维码的时间)的时间差值，并采用该时间差值除以时间变化周期所获取的与时间相关的字符串。然后基于令牌种子信息和该时间串进行摘要运算，获取摘要特征，即对时间串和令牌种子信息(随机字符串)作摘要运算，获取相应的摘要特征。其中，该摘要运算的算法可以是单向散列函数中的HMAC-SHA-1等其他算法。最后，从摘要特征中抽取特征值，生成第一动态密码。该摘要特征中抽取特征值的处理具体可以是通过Features＝Truncate(X)mod 10^d公式实现，其中，Features即特征值，Truncate为动态截短函数，能够对通过HMAC-SHA-1算法获取的过长的摘要特征进行处理，得到一个32位(4字节)的无符号整数，mod为取模符运算，d为特征值的长度，X为摘要特征。特征值d的取值长度可以为任意正整数，如d的取值长度为6时，最后抽取的特征值可以是123456。第一终端经过运算生成的特征值即第一动态密码。
本实施例中，基于时间同步形式，第一终端将令牌种子信息按预设的密码生成算法进行处理，生成的第一动态密码将在一时间变化周期内存储在第一设备中，作为解锁第一设备的验证密码。
S13：第二终端加载令牌应用程序。
其中，该第二终端可以是内置有令牌应用程序的智能手机。令牌应用程序是指能够将令牌种子信息按预设的密码生成算法生成动态密码的应用程序。本实施例中，将第二终端的令牌应用程序生成的动态密码称为第二动态密码，第二终端的令牌应用程序中预设的密码生成算法与第一终端的中预设的密码生成算法相同。
本实施例中，第二终端加载令牌应用程序，为后续能够通过第一终端获取的令牌种子信息，并对令牌种子信息按预设的密码生成算法生成第二动态密码提供了运行环境基础。
S14：第二终端采用令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息。
其中，令牌应用程序拥有包括但不限于二维码扫描的扫描功能。
本实施例中，第二终端的令牌应用程序获取用户输入的扫描指令，进入扫描状态界面， 将第二终端在扫描状态界面对准第一终端显示界面显示的随机二维码，获取保存在随机二维码中的令牌种子信息。通过第二终端采用令牌应用程序扫描第一终端的随机二维码的步骤，可以保证第二终端获取的令牌种子信息与第一终端生成的令牌种子信息是一致的。
S15：第二终端基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
本实施例中，基于时间同步形式，第二终端将通过第一终端扫描获取的令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。其中，第二终端的令牌应用程序中预设的密码生成算法与第一终端中预设的密码生成算法是相同的，为第一终端生成的第一动态密码和第二终端生成的第二动态密码在同一时间变化周期下是相同的提供基础。
可以理解地，当第二终端的令牌应用程序中的预设的密码生成算法与第一终端中的预设的密码生成算法相同时，且第一终端和第二终端的服务器时钟相同(即时间同步形式)，第一终端和第二终端采用的令牌种子信息相同，第一动态密码和第二动态密码处在同一时间变化周期内时，生成的第二动态密码与第一动态密码将会是相同的，能够后续利用第二动态密码解锁第一终端，以进入第一终端的密码获取界面。
S16：第一终端获取用户输入的解锁密码。
其中，解锁密码是指尝试解锁第一终端，以进入第一终端的密码获取界面的任意密码。
本实施例中，第一终端的显示界面上显示有随机二维码，可以理解地，在该显示界面上还可以显示有密码解锁框。该密码解锁框用于获取用户输入的解锁密码。第一终端基于该密码解锁框获取用户输入的解锁密码，以尝试解锁第一终端，进入第一终端的密码获取界面的密码。本实施例中，解锁密码可以是第二终端生成的第二动态密码，也可以是其他任意输入的密码。
S17：第一终端在解锁密码与第一动态密码相匹配时，进入第一终端的密码获取界面。
第一终端根据密码解锁框输入的解锁密码，与保存在第一终端的第一动态密码进行匹配，若解锁密码和第一动态密码相匹配(即相同)，则解锁成功，成功进入第一终端的密码获取界面。特别地，当输入的解锁密码连续错误达到一预设次数(如5次)，第一终端将在一预设时间段内(如1小时)锁定，此时将无法对第一终端进行任何操作。
可以理解地，第一终端每隔一时间变化周期会生成一随机二维码和对应的第一动态密码，第二终端扫描该随机二维码并基于随机二维码生成的第二动态密码是相同的，用户根据显示的第二动态密码在第一终端上输入解锁密码，即可解锁第一终端。由于第一终端上 的第一动态密码每隔一时间变化周期会更新，若用户在该时间变化周期内未能及时输入相匹配的解锁密码(即显示的第二动态密码)，将导致其无法解锁第一终端。
S18：第一终端获取目的密码获取指令，根据目的密码获取指令在密码获取界面获取目的密码。
其中，目的密码是指用户最终想要获取的密码。目的密码可以包括多个属性，如密码名称和备注信息等属性。若目的密码是以文件形式存储，则以文件形式存储的密码文件即为目的密码文件。目的密码获取指令具体可以是目的密码选择指令或目的密码查询指令等指令，目的密码获取指令是一个概括性的概念，可以包括多种用于获取目的密码的具体指令。
本实施例中，当目的密码获取指令具体是指目的密码选择指令时，第一终端的密码获取界面将显示密码文件列表，用户可以根据该密码文件列表获取目的密码文件，通过目的密码文件获取目的密码。当目的密码获取指令具体是指目的密码查询指令时，第一终端的密码获取界面将显示查找框，用户可以根据目的密码的属性(如目的密码名称)查找目的密码。例如查询“平安车险”时，若“平安车险”为一存在的密码名称，则会在密码获取界面显示与该密码名称相同的密码文件，该密码文件即目的密码文件，通过该目的密码文件获取目的密码。若“平安寿险”和“平安车险”都为存在的密码名称，且“平安”不是密码名称时，查询“平安”将会显示该与平安相关的所有账号密码文件(即支持模糊查询)。用户可以在显示的所有有关“平安”账号的密码文件中获取目的密码文件，通过目的密码文件获取目的密码。通过在密码获取界面获取目的密码，可以快速、便捷地获取目的密码。
在一具体实施方式中，如图2所示，步骤S13中，第二终端加载令牌应用程序，具体包括如下步骤：
S131：第二终端获取当前指纹信息。
其中，第二终端为具有指纹识别功能的设备。当前指纹信息是指用户在第二终端上录入的用于验证的指纹信息。本实施例中，第二终端获取用户输入的当前指纹信息，以进行关于用户指纹的身份验证。
S132：第二终端根据当前指纹信息和预先存储的标准指纹信息进行指纹识别，获取指纹识别相似度。
其中，标准指纹信息是指用户预先在第二终端录入并存储的用于验证用户身份合法性的指纹信息。本实施例中，第二终端根据获取的当前指纹信息，调用预先存储的标准指纹信息。其中，该标准指纹信息可以以文件形式存储。第二终端根据预先设置的指纹识别模 型，将当前指纹信息与标准指纹信息进行比对识别，在预先设置的指纹识别模型中获取基于该当前指纹信息与标准指纹信息的指纹识别相似度。该指纹识别相似度可以通过一概率值表示，如获取的指纹识别相似度可以为0.98。
S133：若指纹识别相似度大于预设相似度阈值，则第二终端加载令牌应用程序。
其中，预设相似度阈值是指预先设置的用于判断指纹识别相似度能否通过用户身份验证的评判参考值。本实施例中，预设相似度阈值可以设置为0.95，则当指纹识别相似度小于或等于0.95时，认为该当前指纹信息与标准指纹信息不属于同一用户的指纹，不能够通过用户身份验证。第二终端将无法加载令牌应用程序。相对地，若指纹识别相似度大于0.95时，才认为该当前指纹信息与标准指纹信息都属于同一用户的指纹，能够通过用户身份验证。在身份验证成功后第二终端随即加载令牌应用程序。
第二终端通过基于指纹的用户身份验证机制，可以有效保证令牌应用程序加载的安全性和唯一性，确保只有第二终端相对应的所属用户才能加载并使用第二终端的令牌应用程序。
在一具体实施方式中，如图3所示，步骤S15中，第二终端基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码，具体包括如下步骤：
S151：第二终端获取与第一终端基于时间同步形式的时间串。
其中，时间同步形式是指第一终端的服务器时钟和第二终端的服务器时钟关于时间同步。可以理解地，即第一终端和第二终端的时间相同且同步，不存在时间上的差异，第一终端和第二终端的现时时间(即系统当前时间)相同。
本实施例中，第二终端获取与第一终端基于时间同步形式的时间串。其中，第二终端基于时间同步形式的时间串具体可以是通过取现时时间和生成时间(第一终端开始生成随机二维码的时间)的时间差值，并采用该时间差值除以时间变化周期所获取的与时间相关的字符串。由于是时间同步形式，第二终端生成的时间串和第一终端生成的时间串是相同的，保证了第二终端和第一终端生成的时间串的一致性。
S152：第二终端基于令牌种子信息和时间串进行摘要运算，获取摘要特征。
其中，摘要运算可以通过单向散列函数实现。单向散列函数又称为单向哈希函数，能够把任意长的输入消息串变化成固定长的输出串，且由输出串难以得到输入串的一种函数。这个输出串称为该消息的散列值，即摘要特征。
本实施例中，第二终端基于令牌种子信息和时间串进行摘要运算，获取摘要特征。其 中，该摘要运算的算法可以是单向散列函数中的HMAC-SHA-1等其他算法。HMAC是密钥相关的哈希运算消息认证码，HMAC运算利用哈希算法(如SHA-1)，以一个密钥和一个消息为输入，生成一个消息摘要作为输出，在本实施例中，HMAC中输入的密钥即令牌种子信息，输入的消息即时间串。SHA-1(安全哈希算法，也称为SHS、安全哈希标准)是一种加密哈希算法。
S153：第二终端从摘要特征中抽取特征值，生成第二动态密码。
本实施例中，由于摘要特征的长度过长不便于输入，需通过第二终端从摘要特征中抽取特征值，生成第二动态密码。具体地，该从摘要特征中抽取特征值的处理具体可以是通过Features＝Truncate(X)mod 10^d公式实现，其中，Features即特征值，Truncate为动态截短函数，能够对通过HMAC-SHA-1等算法获取的过长的摘要特征进行处理，得到一个32位(4字节)的无符号整数，mod为取模符运算，d为特征值的长度，X为摘要特征。特征值d的取值长度可以为任意正整数，如d的取值长度为6时，最后抽取的特征值可以是123456。第二终端运算生成的特征值即第二动态密码。
可以理解地，步骤S151-S153和步骤S12是相关联的，区别在于执行主体的不同，为避免赘述，在此不重复表述第一终端生成第一动态密码的过程。本实施例中，基于时间同步形式，时间串在第一终端和第二终端上是相同的，基于扫描随机二维码的机制，令牌种子信息在第一终端和第二终端上也是相同的。则根据时间串和令牌种子信息在经过相同的摘要运算之后获取的摘要特征也必定相同，对该摘要特征抽取的特征值也相同。即在同一时间变化周期内，第一终端生成的第一动态密码和第二终端生成的第二动态密码是相同的，使得用户可以通过第一终端和第二终端的有序交互，实现在同一时间变化周期内各自生成的动态密码相同的效果，为有效验证解锁密码，解锁第一终端以获取存储在第一终端中的密码提供了基础。
在一具体实施方式中，如图4所示，步骤S17中，包括如下步骤：
S171：第一终端基于第一动态密码的生成时间和系统当前时间，确定第一动态密码是否处于时间变化周期内。
其中，该系统当前时间即第一终端服务器时钟的现时时间，第一动态密码的生成时间和系统当前时间均可以用时间戳的形式表示，其中，时间戳，是一个能表示一份数据在某个特定时间之前已经存在的、完整的和可验证的数据，通常是一个字符序列，能够唯一地标识某一刻的时间。
本实施例中，第一终端获取并基于第一动态密码的生成时间和系统当前时间，计算两 者的时间差值(取绝对值)。根据时间差值确定第一动态密码是否处于时间变化周期内。例如，第一动态密码的生成时间以时间戳表示为1514346507，系统当前时间以时间戳表示为1514346538，假设时间变化周期为30秒，则时间差值为1514346538-1514346507＝31(秒)，该时间差值已超过时间变化周期，则可以确定第一动态密码不处于时间变化周期内；若第一动态密码的生成时间以时间戳表示为1514346509，系统当前时间以时间戳表示为1514346538，假设时间变化周期为30秒，则时间差值为1514346538-1514346509＝29(秒)，该时间差值没有超过时间变化周期，则可以确定第一动态密码处于时间变化周期内。
S172：在第一动态密码处于时间变化周期内，且解锁密码为第二动态密码时，第一动态密码与解锁密码相匹配。
其中，解锁密码是指尝试解锁第一终端，以进入第一终端的密码获取界面的任意密码。本实施例中，若第一动态密码处于时间变化周期内，且解锁密码采用的是第二动态密码时，才能完成匹配。可以理解地，用户输入的解锁密码可以是由任意字符组成的密码，即解锁密码可以是第二动态密码，也可以不是第二动态密码。当用户根据第二终端显示的第二动态密码，在第一动态密码处于时间变化周期内时将第二动态密码作为解锁密码输入到第一终端进行匹配校验。此时由于第一动态密码和第二动态密码都是按预设的密码生成算法生成的，基于时间同步形式以及第一终端和第二终端之间的信息交互使得令牌种子信息相同(通过扫描随机二维码实现)，在第一动态密码处于时间变化周期内时，第一动态密码和第二动态密码必定相同，即第一动态密码与解锁密码相匹配。完成第一终端的密码验证过程，从而解锁第一终端。
在一具体实施方式中，第一终端内置有防拆保护电路，该防拆保护电路用于检测第一终端是否遭到拆解并会在第一终端遭到拆解时发送与防拆相关(如清空密码)的控制信号。该密码管理方法还可以包括如下步骤：第一终端获取防拆保护电路发送的控制信号；若控制信号为密码清空信号，则根据密码清空信号清空第一终端存储的密码。
本实施例中，第一终端获取防拆保护电路发送的控制信号，在第一终端没遭到拆解的情况下，该控制信号只传递当前电路情况为正常的信号给第一终端，而不会对第一终端作任何处理。若第一终端遭到拆解破坏，该防拆保护电路将检测到第一终端的电路异常，会立即发送密码清空信号。此时第一终端获取的防拆保护电路发送的控制信号即为密码清空信号，第一终端将根据该密码清空信号执行清空第一终端存储的密码的指令，通过内置防拆保护电路可以保证第一终端存储的密码的安全性。
本实施例所提供的密码管理方法中，基于时间同步形式，时间串在第一终端和第二终端上是相同的，基于扫描随机二维码的机制，令牌种子信息在第一终端和第二终端上也是相同的。则根据时间串和令牌种子信息在经过相同的摘要运算之后获取的摘要特征也必定相同，对该摘要特征抽取的特征值也相同。即在同一时间变化周期内，第一终端生成的第一动态密码和第二终端生成的第二动态密码是相同的，使得用户可以通过第一终端和第二终端的有序交互，实现在同一时间变化周期内各自生成的动态密码相同的效果，为有效验证解锁密码，解锁第一终端以获取存储在第一终端中的密码提供了基础，使得第一终端生成的第一动态密码和第二终端生成的第二终端密码在同一时间变化周期内能够匹配成功，并进入密码获取界面，在密码获取界面中通过密码获取指令获取目的密码。第一终端能够有效安全地存储用户的密码。用户获取存储的密码，需通过第二终端扫描第一终端的随机二维码生成第二动态密码，利用第二动态密码获取存储在第一终端中的密码。该过程需结合两个终端进行密码验证，有效保障用户存储在第一终端的密码的安全性，使得用户可以安全有效地管理和存储密码。
应理解，上述实施例中各步骤的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
实施例2
图5示出与实施例1中密码管理方法一一对应的密码管理装置的原理框图。如图5所示，该密码管理装置包括第一终端10和第二终端20。其中，第一终端10包括随机二维码生成模块11、第一动态密码生成模块12、解锁密码获取模块13、密码获取界面进入模块14和目的密码获取模块15。其中，随机二维码生成模块11、第一动态密码生成模块12、解锁密码获取模块13、密码获取界面进入模块14和目的密码获取模块15的实现功能与实施例1中密码管理方法中第一终端对应的步骤一一对应，为避免赘述，本实施例不一一详述。
随机二维码生成模块11，用于获取随机二维码生成指令，每隔一时间变化周期自动生成并显示随机二维码，随机二维码包括令牌种子信息。
第一动态密码生成模块12，用于基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码。
解锁密码获取模块13，用于获取用户输入的解锁密码。
密码获取界面进入模块14，用于若解锁密码与第一动态密码相匹配，则进入密码获取界面。
目的密码获取模块15，用于获取目的密码获取指令，根据目的密码获取指令在密码获取界面获取目的密码。
优选地，密码获取界面进入模块14包括第一动态密码确定单元141和密码匹配单元142。
第一动态密码确定单元141，用于基于第一动态密码的生成时间和系统当前时间，确定第一动态密码是否处于时间变化周期内。
密码匹配单元142，用于若第一动态密码处于时间变化周期内，且解锁密码为第二动态密码，则第一动态密码与解锁密码相匹配，其中，第二动态密码为第二终端基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理后生成并显示的。
优选地，该密码管理装置中第一终端10还包括防拆保护电路模块16，优选地，该防拆保护电路模块16包括控制信号获取单元161和密码清空单元162。
控制信号获取单元161，用于获取防拆保护电路发送的控制信号。
密码清空单元162，用于若控制信号为密码清空信号，则根据密码清空信号清空第一终端存储的密码。
如图5所示，该密码管理装置包括第一终端10和第二终端20。其中，第二终端20包括令牌应用程序加载模块21、令牌种子信息获取模块22和第二动态密码生成模块23。其中，令牌应用程序加载模块21、令牌种子信息获取模块22和第二动态密码生成模块23的实现功能与实施例1中密码管理方法中第二终端对应的步骤一一对应，为避免赘述，本实施例不一一详述。
令牌应用程序加载模块21，用于加载令牌应用程序。
令牌种子信息获取模块22，用于采用令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息。
第二动态密码生成模块23，用于基于时间同步形式，将令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
优选地，令牌应用程序加载模块21包括当前指纹信息获取单元211、指纹识别相似度获取单元212和令牌应用程序加载单元213。
当前指纹信息获取单元211，用于获取当前指纹信息。
指纹识别相似度获取单元212，用于根据当前指纹信息和预先存储的标准指纹信息进行指纹识别，获取指纹识别相似度。
令牌应用程序加载单元213，用于若指纹识别相似度大于预设相似度阈值，则加载令 牌应用程序。
优选地，第二动态密码生成模块23包括时间串获取单元231、摘要特征获取单元232和第二动态密码生成单元233。
时间串获取单元231，用于获取与第一终端基于时间同步形式的时间串。
摘要特征获取单元232，用于基于令牌种子信息和时间串进行摘要运算，获取摘要特征。
第二动态密码生成单元233，用于从摘要特征中抽取特征值，生成第二动态密码。
实施例3
本实施例提供一计算机可读存储介质，该计算机可读存储介质上存储有计算机可读指令，该计算机可读指令被处理器执行时实现实施例1中密码管理方法，为避免重复，这里不再赘述。或者，该计算机可读指令被处理器执行时实现实施例2中密码管理装置中各模块/单元的功能，为避免重复，这里不再赘述。
实施例4
图6是本实施例中终端设备的示意图。如图6所示，终端设备60包括处理器61、存储器62以及存储在存储器62中并可在处理器61上运行的计算机可读指令63。处理器61执行计算机可读指令63时实现实施例1中密码管理方法的各个步骤，例如图1所示的步骤S11-S18。或者，处理器61执行计算机可读指令63时实现上述实施例2中密码管理装置的各模块/单元的功能，例如图5所示随机二维码生成模块11、第一动态密码生成模块12、解锁密码获取模块13、密码获取界面进入模块14和目的密码获取模块15，或者令牌应用程序加载模块21、令牌种子信息获取模块22和第二动态密码生成模块23的功能。
示例性的，计算机可读指令63可以被分割成一个或多个模块/单元，一个或者多个模块/单元被存储在存储器62中，并由处理器61执行，以完成本申请。一个或多个模块/单元可以是能够完成特定功能的一系列计算机可读指令63的指令段，该指令段用于描述计算机可读指令63在终端设备60中的执行过程。例如，计算机可读指令63可被分割成实施例2中的随机二维码生成模块11、第一动态密码生成模块12、解锁密码获取模块13、密码获取界面进入模块14和目的密码获取模块15，或者可以被分割成令牌应用程序加载模块21、令牌种子信息获取模块22和第二动态密码生成模块23，各模块的具体功能如实施例2所示，为避免重复，此处不一一赘述。
终端设备60可以是桌上型计算机、笔记本、掌上电脑及云端服务器等计算设备。终端设备可包括，但不仅限于，处理器61、存储器62。本领域技术人员可以理解，图6仅 仅是终端设备60的示例，并不构成对终端设备60的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如终端设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器61可以是中央处理单元(Central Processing Unit，CPU)，还可以是其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器62可以是终端设备60的内部存储单元，例如终端设备60的硬盘或内存。存储器62也可以是终端设备60的外部存储设备，例如终端设备60上配备的插接式硬盘，智能存储卡(Smart Media Card，SMC)，安全数字(Secure Digital，SD)卡，闪存卡(Flash Card)等。进一步地，存储器62还可以既包括终端设备60的内部存储单元也包括外部存储设备。存储器62用于存储计算机可读指令以及终端设备所需的其他程序和数据。存储器62还可以用于暂时地存储已经输出或者将要输出的数据。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，仅以上述各功能单元、模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元、模块完成，即将装置的内部结构划分成不同的功能单元或模块，以完成以上描述的全部或者部分功能。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机可读指令来指令相关的硬件来完成，的计算机可读指令可存储于一计算机可读存储介质中，该计算机可读指令在被处理器执行时，可实现上述各个方法实施例的步骤。其中，计算机可读指令包括计算机可读指令代码，计算机可读指令代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。计算机可读介质可以包括：能够携带计算机可读指令代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM，Read-Only Memory)、随机存 取存储器(RAM，Random Access Memory)、电载波信号、电信信号以及软件分发介质等。需要说明的是，计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括是电载波信号和电信信号。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种密码管理方法，其特征在于，包括第一终端执行的如下步骤：
    获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
    获取用户输入的解锁密码；
    若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
    获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
  2. 根据权利要求1所述的密码管理方法，其特征在于，所述若所述解锁密码与所述第一动态密码相匹配，包括：
    基于所述第一动态密码的生成时间和系统当前时间，确定所述第一动态密码是否处于所述时间变化周期内；
    若所述第一动态密码处于所述时间变化周期内，且所述解锁密码为第二动态密码，则所述第一动态密码与所述解锁密码相匹配，其中，所述第二动态密码为第二终端基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理后生成并显示的。
  3. 根据权利要求1所述的密码管理方法，其特征在于，所述第一终端内置有防拆保护电路，所述密码管理方法还包括：
    获取所述防拆保护电路发送的控制信号；
    若所述控制信号为密码清空信号，则根据所述密码清空信号清空所述第一终端存储的密码。
  4. 一种密码管理方法，其特征在于，包括第二终端执行的如下步骤：
    加载令牌应用程序；
    采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
  5. 根据权利要求4所述的密码管理方法，其特征在于，所述加载令牌应用程序，包括：
    获取当前指纹信息；
    根据所述当前指纹信息和预先存储的标准指纹信息进行指纹识别，获取指纹识别相似度；
    若所述指纹识别相似度大于预设相似度阈值，则加载所述令牌应用程序。
  6. 根据权利要求4所述的密码管理方法，其特征在于，所述基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码，包括：
    获取与所述第一终端基于所述时间同步形式的时间串；
    基于所述令牌种子信息和所述时间串进行摘要运算，获取摘要特征；
    从所述摘要特征中抽取特征值，生成所述第二动态密码。
  7. 一种密码管理装置，其特征在于，包括第一终端，所述第一终端包括：
    随机二维码生成模块，用于获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
    第一动态密码生成模块，用于基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
    解锁密码获取模块，用于获取用户输入的解锁密码；
    密码获取界面进入模块，用于若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
    目的密码获取模块，用于获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
  8. 一种密码管理装置，其特征在于，包括第二终端，所述第二终端包括：
    令牌应用程序加载模块，用于加载令牌应用程序；
    令牌种子信息获取模块，用于采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
    第二动态密码生成模块，用于基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
  9. 一种终端设备，所述终端设备为第一终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现如下步骤：
    获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一 动态密码；
    获取用户输入的解锁密码；
    若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
    获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
  10. 根据权利要求9所述的终端设备，其特征在于，所述若所述解锁密码与所述第一动态密码相匹配，包括：
    基于所述第一动态密码的生成时间和系统当前时间，确定所述第一动态密码是否处于所述时间变化周期内；
    若所述第一动态密码处于所述时间变化周期内，且所述解锁密码为第二动态密码，则所述第一动态密码与所述解锁密码相匹配，其中，所述第二动态密码为第二终端基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理后生成并显示的。
  11. 根据权利要求9所述的终端设备，其特征在于，所述第一终端内置有防拆保护电路，所述计算机可读指令被所述处理器执行时还实现如下步骤：
    获取所述防拆保护电路发送的控制信号；
    若所述控制信号为密码清空信号，则根据所述密码清空信号清空所述第一终端存储的密码。
  12. 一种终端设备，所述终端设备为第二终端，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现如下步骤：
    加载令牌应用程序；
    采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
  13. 根据权利要求12所述的终端设备，其特征在于，所述加载令牌应用程序，包括：
    获取当前指纹信息；
    根据所述当前指纹信息和预先存储的标准指纹信息进行指纹识别，获取指纹识别相似度；
    若所述指纹识别相似度大于预设相似度阈值，则加载所述令牌应用程序。
  14. 根据权利要求12所述的终端设备，其特征在于，所述基于时间同步形式，将所述 令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码，包括：
    获取与所述第一终端基于所述时间同步形式的时间串；
    基于所述令牌种子信息和所述时间串进行摘要运算，获取摘要特征；
    从所述摘要特征中抽取特征值，生成所述第二动态密码。
  15. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，其特征在于，所述计算机可读指令被第一终端的处理器执行时实现如下步骤：
    获取随机二维码生成指令，每隔一时间变化周期自动生成并显示所述随机二维码，所述随机二维码包括令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成第一动态密码；
    获取用户输入的解锁密码；
    若所述解锁密码与所述第一动态密码相匹配，则进入密码获取界面；
    获取目的密码获取指令，根据所述目的密码获取指令在所述密码获取界面获取目的密码。
  16. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述若所述解锁密码与所述第一动态密码相匹配，包括：
    基于所述第一动态密码的生成时间和系统当前时间，确定所述第一动态密码是否处于所述时间变化周期内；
    若所述第一动态密码处于所述时间变化周期内，且所述解锁密码为第二动态密码，则所述第一动态密码与所述解锁密码相匹配，其中，所述第二动态密码为第二终端基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理后生成并显示的。
  17. 根据权利要求15所述的计算机可读存储介质，其特征在于，所述第一终端内置有防拆保护电路，所述计算机可读指令被所述处理器执行时还实现如下步骤：
    获取所述防拆保护电路发送的控制信号；
    若所述控制信号为密码清空信号，则根据所述密码清空信号清空所述第一终端存储的密码。
  18. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，其特征在于，所述计算机可读指令被第二终端的处理器执行时实现如下步骤：
    加载令牌应用程序；
    采用所述令牌应用程序扫描第一终端的随机二维码，获取令牌种子信息；
    基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码。
  19. 根据权利要求18所述的计算机可读存储介质，其特征在于，所述加载令牌应用程序，包括：
    获取当前指纹信息；
    根据所述当前指纹信息和预先存储的标准指纹信息进行指纹识别，获取指纹识别相似度；
    若所述指纹识别相似度大于预设相似度阈值，则加载所述令牌应用程序。
  20. 根据权利要求18所述的计算机可读存储介质，其特征在于，所述基于时间同步形式，将所述令牌种子信息按预设的密码生成算法进行处理，生成并显示第二动态密码，包括：
    获取与所述第一终端基于所述时间同步形式的时间串；
    基于所述令牌种子信息和所述时间串进行摘要运算，获取摘要特征；
    从所述摘要特征中抽取特征值，生成所述第二动态密码。
PCT/CN2018/077332 2018-01-08 2018-02-27 密码管理方法、装置、终端设备及存储介质 WO2019134236A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810014164.8 2018-01-08
CN201810014164.8A CN108460262B (zh) 2018-01-08 2018-01-08 密码管理方法、装置、终端设备及存储介质

Publications (1)

Publication Number Publication Date
WO2019134236A1 true WO2019134236A1 (zh) 2019-07-11

Family

ID=63220533

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/077332 WO2019134236A1 (zh) 2018-01-08 2018-02-27 密码管理方法、装置、终端设备及存储介质

Country Status (2)

Country Link
CN (1) CN108460262B (zh)
WO (1) WO2019134236A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109636553B (zh) * 2018-11-13 2024-05-07 平安科技（深圳）有限公司 凭证管理方法、装置、计算机设备及存储介质
CN109547196B (zh) * 2018-11-16 2021-11-02 飞天诚信科技股份有限公司 一种手表令牌系统的实现方法及手表令牌系统和装置
CN111127710B (zh) * 2019-12-19 2021-11-23 深圳市凯迪仕智能科技有限公司 一种智能锁安全离线开锁密码生成方法
CN111859367A (zh) * 2020-07-28 2020-10-30 中移（杭州）信息技术有限公司 锁屏密码设置方法、终端及计算机可读存储介质
CN113329008B (zh) * 2021-05-26 2022-04-08 深圳聚创致远科技有限公司 一种智能电网环境计算和防护并行的可信计算平台

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739404A (zh) * 2012-06-29 2012-10-17 浪潮(北京)电子信息产业有限公司 一种密码管理方法和系统
CN103501228A (zh) * 2013-08-01 2014-01-08 沈阳华矿新能源装备科技有限公司 一种动态二维码令牌及动态二维码口令认证方法
CN104836660A (zh) * 2014-02-12 2015-08-12 中国银联股份有限公司 密码管理方法及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0210692D0 (en) * 2002-05-10 2002-06-19 Assendon Ltd Smart card token for remote authentication
CN102487322B (zh) * 2010-12-03 2015-10-14 腾讯科技（深圳）有限公司 实现动态口令认证的注册方法、装置和系统
CN104917766B (zh) * 2015-06-10 2018-01-05 飞天诚信科技股份有限公司 一种二维码安全认证方法
CN107180351A (zh) * 2017-04-13 2017-09-19 上海动联信息技术股份有限公司 一种脱机动态二维码生成方法、支付方法及设备

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102739404A (zh) * 2012-06-29 2012-10-17 浪潮(北京)电子信息产业有限公司 一种密码管理方法和系统
CN103501228A (zh) * 2013-08-01 2014-01-08 沈阳华矿新能源装备科技有限公司 一种动态二维码令牌及动态二维码口令认证方法
CN104836660A (zh) * 2014-02-12 2015-08-12 中国银联股份有限公司 密码管理方法及系统

Also Published As

Publication number Publication date
CN108460262B (zh) 2019-11-05
CN108460262A (zh) 2018-08-28

Similar Documents

Publication Publication Date Title
WO2019134236A1 (zh) 密码管理方法、装置、终端设备及存储介质
US20240022420A1 (en) Public/Private Key Biometric Authentication System
TWI667586B (zh) 用以核對ｕｅｆｉ認證變量變化之系統及方法
AU2013101034A4 (en) Registration and authentication of computing devices using a digital skeleton key
WO2020233373A1 (zh) 一种应用程序的配置文件管理方法及装置
US20160365978A1 (en) Making cryptographic claims about stored data using an anchoring system
US10079855B2 (en) Password breach registry
WO2019200799A1 (zh) 短信验证码的推送方法、电子装置及可读存储介质
CN111698088B (zh) 密钥轮换方法、装置、电子设备及介质
WO2021114614A1 (zh) 应用程序安全启动方法、装置、计算机设备和存储介质
EP3627796B1 (en) Dynamic and private security fingerprinting
CN105550626B (zh) 一种虹膜识别方法及装置
CN114238874A (zh) 数字签章验证方法、装置、计算机设备和存储介质
CN115982761A (zh) 敏感信息处理方法、装置、电子设备和存储介质
CN116132149A (zh) 防篡改通信方法、装置、服务器、智能家居及终端设备
EP3586264B1 (en) Securely performing cryptographic operations
CN114710274A (zh) 数据调用方法、装置、电子设备及存储介质
US7853793B2 (en) Trusted signature with key access permissions
CN116579026A (zh) 一种云数据完整性审计方法、装置、设备及存储介质
CN111294209A (zh) 一种基于区块链的智能终端安全验证方法及装置
CN115361198A (zh) 解密方法、加密方法、装置、计算机设备和存储介质
CN114745173A (zh) 登陆验证方法、装置、计算机设备、存储介质和程序产品
US20220053123A1 (en) Method and apparatus for independent authentication of video
US9882879B1 (en) Using steganography to protect cryptographic information on a mobile device
CN112966306A (zh) 一种盲验证文件的处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18898508

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 13/10/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18898508

Country of ref document: EP

Kind code of ref document: A1