CN1929374A

CN1929374A - Dynamic password number theft-prevention

Info

Publication number: CN1929374A
Application number: CN 200510098312
Authority: CN
Inventors: 赵志鹏
Original assignee: Individual
Current assignee: Individual
Priority date: 2005-09-08
Filing date: 2005-09-08
Publication date: 2007-03-14

Abstract

This invention relates to dynamic order anti-theft system with low cost, which solves current Internet identification test problem and adopts independent computer hardwires through codes signal formula and integrates with servo random codes to generate dynamic order to make the order with large discrete to achieve one update order.

Description

Dynamic password number theft-prevention

Technical field

When the present invention relates under insecure environments user identity confirmed; make the Change Password that the user can be simple, effective, frequent; prevent that the password fixed from being stolen by wooden horse, virus or other rogue programs or people with malicious motive; especially the user account number that carries out online transaction, object for appreciation online game in the Internet bar is protected, be mainly used in the account number security fields.

Background technology

Along with Internet development, various tradition are used and have been moved on the network, because the inborn deficiency in the Internet, give some lawless persons with opportunity, they utilize wooden horse, virus or other rogue programs to steal other people account, reach the purpose of making profit with this, annual because of the stolen case that causes of online game account number grows with each passing day, endangered users' interests greatly.

At present, at this problem, many solutions have been arranged, but the scheme technology that has is too complicated, it is too high to popularize equipment cost difficult, that have, the clear-cut information of just encrypting input that the user can't stand, have by software, and the result causes being absorbed in a long-term technology seasaw battle because of the opening of operating system eventually, do not have good anti-theft effect, the still user who finally stands to lose.

In fact, effective method is to use the password of the each input in family all different, and the password that need to import next time is at random, unpredictable, and also can't reduce according to the password of intercepting and capturing, dynamic password card is exactly typical scheme, but because shortcomings such as high, the time synchronized precision prescribed height of its manufacturing cost can't promote always.

Summary of the invention

After the present invention is exactly the merits and demerits of antitheft scheme more than having taken into full account, in conjunction with modern electronic technology, network technology, a kind of novel, cheap, easy-to-use, the safe antitheft scheme of proposition.

This scheme has related to the equipment E1 of similar and a calculator, can when using E1 for the first time, import a unique identifier KEY, E1 is by algorithm F (X, Y) with the input the irreversible S3 of being converted into of information S2 and be shown to the user, because this equipment and computer are independent, so whole conversion process wooden horse or virus can't be stolen, this point also is the core of this programme;

Procedure involved in the present invention can embody in order to following scheme, and step comprises:

A. suppose that the user is in advance with among the unique identifying number KEY input equipment E1 who distributes to he (she);

B. the user sets up related with the account of oneself KEY in the steps A;

The user imports account S1 when C. logining;

D. system gives user prompt random information S2;

E. the user imports S2 among the E1, and (X Y) changes S2 into S3 to E1 in conjunction with predefined KEY and by non-reversible algorithm F;

F. the user imports S3 as password, confirms that the correctness of S3 is promptly finished identity validation;

Security declaration:

A. because S2 is a random information, so the S3 that calculates is unpredictable;

B. because each user's KEY is inequality, so even identical S2 also can produce different S3;

C. owing to adopting one-way algorithm, so (X Y) also can't obtain KEY by intercepting and capturing S3 and cracking F;

D. under the situation that can't obtain KEY, just can't crack the value of S3 according to S2;

E. because the character of composition S2, S3, KEY is a lot,, nearly 4,300,000,000 kinds of variations are arranged also even only use numeral;

If F. adopt the mode of conjecture, the probability that cracks is less than 1/1000000000th;

The invention characteristics:

1.E1 algorithm is open;

2.E1 need not to solidify different KEY, can produce in batches, with low cost;

3. the clock synchronization issue that does not have common dynamic password card;

4. use simply, fail safe is good;

Description of drawings

Fig. 1 is for using the step schematic diagram of this invention in the Figure of description;

Embodiment

1. produce a kind of equipment E1 of similar and calculator, can when using E1 for the first time, allow the user import a unique identifier KEY who distributes to him;

2. the user at first set up related by WEB mode and the account number of oneself KEY before login system;

3. in the login interface of system, import the account S1 of oneself;

4. system produces an identifying code S2 at random according to S1 and be shown to user's (can just show) on the current display screen of user;

5. the user imports the S2 that sees among the E1, and has obtained the S3 that E1 calculates;

6. again S2 is input in the password input frame of login interface;

7. system's usefulness account form identical with E1 calculates a value and S3 comparison, if identical, the expression user identity is legal, otherwise promptly is illegal user;

The computational methods that above step relates to are a lot, can adopt here CRC check, MD5 etc. can, so long as unidirectional just passable;

Claims

1. dynamic password number theft-prevention is used for preventing that in fly-by-night network environment the encrypted message that causes when using single password to carry out identity validation is stolen, and is characterized in that:

B. the user sets up related with the account of oneself KEY in the steps A;

The user imports account S1 when C. logining;

D. system gives user prompt random information S2;

F. the user imports S3 as password, confirms that the correctness of S3 is promptly finished identity validation.

2. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: steps A, B can carry out one or many, but each KEY value must be identical.

3. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: do not have inevitable order requirement between described step D, E, F and the described step C.

4. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: (X Y) can adopt any transfer algorithm, checking algorithm and cryptographic means to S2 to the algorithm F of S3 in the described step e.

5. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: described each step can be finished in same equipment, also can finish in distinct device.

6. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: among the described step C among S1, the step D in S2, the step e S3 comprise and be not limited only to the ASC character.

7. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: among the described step C among S1, the step D in S2, the step e demonstration of S3 be not limited only to mode word.

8. dynamic password number theft-prevention as claimed in claim 1 is characterized in that: S2 confirms the correctness of S3 in the conversion of S3 and the step F in the described step e, can adopt identical algorithms or algorithms of different, also can adopt asymmetric arithmetic.