TW201249158A - Producing and application method for one time password - Google Patents

Abstract

A producing and application method for one time password (OTP) first sends a request by a web-bank server to an OTP server when an even is asked to execute on a website of web-bank. The OTP server is then produces an OTP according to request data. After the OTP is produced by the OTP server, a SMS server produces a SMS which includes the OTP and sends to user. User can then replies the OTP in the received SMS to the web-bank via different route by using different terminals. Finally, the web-bank permits to execute the asked even when the OTP the user replied is verified. For the different ways to replies the OTP to the web-bank, the present invention can not only increase security of network behavior, but also increase convenience of using OTP.

Description

201249158 VI. Description of the Invention: [Technical Field] [0001] The present invention relates to a dynamic password, and more particularly to a method and a method for generating a dynamic password for use on a network. [Prior Art] [0002] In recent years, the electronics industry has flourished, and various electronic devices are flooding the lives of the general public. Moreover, with the popularization of the Internet, users can use the electronic devices such as desktop computers, tablet computers, and smart mobile phones at home to make online shopping through the Internet. , appointment registration, online transactions and other actions, quite convenient. [0003] However, when a user conducts a money-related transaction through the Internet, it is often related to an individual's bank account or credit card information. For the user, security issues cannot be ignored. For example, when using the online banking service provided by the bank to conduct online transactions such as transfer, exchange, payment, etc., it is often necessary to input the user's personal account number, password, transaction account number, credit card information, etc., if the information is quite private, if Security issues such as interception by Internet hackers or side-by-side recording of computer y virus programs can cause significant damage to users. [0004] Therefore, some people have proposed dynamic passwords (also known as one-time passwords).

One Time Password (OTP) is a way to increase the security of online trading behavior. Mainly using a dynamic password generator, combined with the user's credit card, ATM card and other chip cards, after entering the card password, a set of dynamic passwords is generated. When the user conducts trading on the Internet, in addition to inputting the above personal account number, password and transaction data, 100117126 is also required. Form No. A0101 Page 4 / Total 24 Page 1002028792-0 201249158 [0005] Ο [0006] The dynamic password is entered under the condition, and the online bank can confirm the dynamic password correctly before the transaction can be successfully executed. However, dynamic password generators require additional purchases, which are additional expenses for the user. Users who do not trade frequently through the Internet often cannot accept this secret. Moreover, the personal account number, password, transaction data and secret code of the time-keeping are all through-pipeline (usually the Internet), when (4) the customer _, or (4) the (4) child device has a virus, as long as When a user enters the above information on the website, it will be easily stolen or even tampered by the person concerned. In this way, the generation and use of dynamic passwords will be ineffective. In summary, the 'real market should provide - Lai _ _ _ code generation and application, * but can use dynamic passwords to improve the security of online transactions or non-transactions' and also allow dynamic passwords Τ It has considerable flexibility so that users can easily learn and be happy to make = ❹ [0(8)7] [0008]

SUMMARY OF THE INVENTION A primary object of the present invention is to provide a method for generating and using a dynamic password. Another major goal of the present invention is to generate a dynamic password for the user to perform a specific event on the network to be verified. . The user can select a variety of different usage and transmission channels to reply the network password to the network fee, so as to improve the convenience of use. T [0009] For the above purposes, the present invention is applied to a user on the Internet Banking website 100117126 Form No. 1010101 Page 5 / Total 24 Page 1002028792-0 201249158 When an event is requested, an online banking server The device makes a request to a dynamic password server, and the dynamic password server generates a dynamic password based on the requested data. Then, a short message server generates a short message in which the dynamic password is recorded, and transmits the short message to the user. The user can reply the dynamic password recorded in the newsletter to the online bank through different channels through various user terminals. After the replying dynamic password is verified, the online bank can allow the user to execute the requested event. [0010] The method for generating and applying a dynamic password according to the present invention mainly enables a user to use different terminal devices, such as a computer, a mobile phone, a fax machine, etc., through different pipes, such as an internet or a mobile communication network. , reply the received dynamic password to be verified to the online bank. In this way, the convenience of using the dynamic password can be greatly improved without reducing the security of the dynamic password. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0011] A preferred embodiment of the present invention, in conjunction with the drawings, is described in detail below. [0012] Referring first to the first figure, a system architecture is a preferred embodiment of the present invention. Figure. The method and application method of the dynamic password (also known as One Time Password, OTP) of the present invention are mainly applied to an online banking 10, an online banking server 1, a dynamic password server 2, A short message server 3 and at least one user terminal 4. [0013] The at least one user terminal 4 can mainly include a first terminal 41, a second terminal 42, and a third terminal 43, the first terminal 41, the second terminal 42, and the third terminal 43. Can be the same electronic device, can also be two or three different electronic devices (to be detailed), to achieve 100117126 respectively Form No. A0101 Page 6 / 24 Page 1002028792-0 201249158 [0014]

Different functions should not be limited. Please also refer to the first section, which is a flow chart of a preferred embodiment of the present invention. First, the user of the field κ uses the first terminal 41 to log in to the online bank 10 (step S200), * θ more specifically, using the first terminal 41, through the Internet a 、 , ' The website of the online banking 10, and operate on the first page of the website (for example, the web page 100 shown in the third figure). Then, the company bank executes an event (step S202), which is mainly a special event that is ''f' and is verified to be allowed to execute', for example, querying account details, logout, etc. , or transfer money, change foreign currency, etc., the behavior of the Internet is a special event that needs to be executed after the expedited test, which can be set by the administrator of the online bank; t, or by the user Customized, should not be limited. [_Worth-mentioned is that this (4) makes it easier for behaviors to judge whether or not to allow execution through dynamic passwords, which can greatly improve the security of network behavior. And in the non-transaction behavior, the user does not need to input any information, so the operation will be faster and more intuitive.

[0016] After the step S202, the _ road bank lQ requests the dynamic password server 2 to generate a set of dynamic passwords ρι (4S204) t by the lang bank feeding device i, and the network bank The server sends a request data R1 to the dynamic secret server 2, thereby requesting the dynamic password server 2 to generate the dynamic password pi. The online banking server 1 is mainly capable of transmitting the request through the Secure Sockets Layer (SSL) packet format, and the R1 to the dynamic password server 2, but not Limited. 100117126 Form No. A0101 Page 7 / Total 24 Page 1002028792-0 201249158 [0017] It is worth mentioning that if the above event is a non-user rotation, for example, to query account details, logout and other non-transaction lines ^^ Ma Shi's online banking server 1 only sends the request data R1 to the dynamic $.

2; However, if the event is a need to enter the transaction data Tl DD 乂 · 易 ^ (Yu Wei >, then the user enters the transaction data T1 and requests to perform the matter ~ the online banking server 1 the transaction The data T1 and the request = the poor material R1 (ie, the SSL packet) are simultaneously transmitted to the dynamic password server 2. The production data T1 can be, for example, the transaction account number T11 and the upper amount T12 shown in the third figure B. [0018] After receiving the request data R1, the dynamic password server 2 generates the dynamic password P1 by the team expiring the request data R1 (step S206). More specifically, in this embodiment, the dynamic cryptographic server 2 mainly adopts a time-based OATH (initiative f〇r 〇pen Authentication) specification, and according to the section code of the SSL packet (Section) ID) as a parameter to generate the dynamic password P1, but not limited thereto. After the step 32〇6, the dynamic password server 2 transmits the generated dynamic password P1 to the short message server 3 (step S208). Further, if the generation of the transaction data T1 is performed in the above step, the dynamic MME server 2 simultaneously transmits the transaction data T1 and the dynamic password P1 to the short message server 3. After receiving the data, the short message server 3 generates a short message S1 according to the received data content (step S210), and more specifically, the dynamic password pi is recorded in the short message S1, and if the short message server 3 is simultaneously Receiving the transaction data T1 and the dynamic password P1, the transaction data T1 and the dynamic password P1 are simultaneously recorded in the SMS S1. Next, the newsletter feed 100117126 Form No. A0101 Page 8 / Total 24 pages 1002028792-0 201249158 The server 3 transmits the generated SMS si to the second terminal 42 (step S212), more specifically, the SMS servo The device 3 transmits the short message S1 to the second terminal 42 via the mobile communication network. [0022] [0022] After the step S212, the user can obtain the content of the dynamic password P1 through the SMS S1 received by the second terminal 42. Moreover, if the transaction data T1 is simultaneously recorded in the message S1, the user can reconfirm the transaction data T1 entered in the online bank 1 by the short message S1 to avoid potential risks. Then, the user replies to the dynamic password P1 recorded in the SMS S1 to the online bank through the third terminal 43 (step S214). It is worth mentioning that the third terminal 43 can be the same electronic device as the first terminal 41 and/or the second terminal 42 or be a completely different electronic device, thereby being available through the Internet or a mobile communication network. Reply to the dynamic password? 1 to the online bank 10 ’ should not be limited. After the online bank 10 receives the dynamic password P1 replied by the user, the online banking server 1 receives the dynamic password. The message is forwarded to the dynamic password server 2 (step S216). Therefore, the dynamic password cipher 2 performs the verification operation of the dynamic password pi that the user replies (step S218). That is, in the embodiment, the online bank 10 only receives and forwards the dynamic password P1 replied by the user, but cannot directly determine whether the dynamic password P1 is correct. Thus, the dynamic password can be improved. 1 security. Finally, the dynamic password server 2 returns the verification result to the online bank server 1 (step S220) 'by the network bank to determine the motion 100117126 form number A0101 page 9 / total 24 page 1002028792- [0023] 201249158 Whether the state password P1 passes the verification (step S222). If the dynamic password P1 replied by the user fails to pass the verification, the online bank 10 does not allow the execution of the event (step S224); otherwise, if the dynamic password P1 replied by the user passes the verification, the online bank 10 The execution of the event is allowed (step S226). [0024] Referring to FIG. 3A and FIG. BB, FIG. 3 is a schematic diagram of an event request according to a first embodiment and a second embodiment of the present invention. The first terminal 41 is mainly an electronic device having an Internet function, such as a desktop computer, a personal digital assistant, a tablet computer, a mobile phone, etc., but is not limited. The first terminal 41 is mainly connected to the online bank 10 via the Internet, and is used to display and operate the webpage 100 of the online bank 10. As shown in the third figure A, the user requests to perform a non-transaction behavior at the online bank 10 through the first terminal 41, as shown in the figure, requesting to query the account details, when the user presses the OK button. The online bank 10 then requests the dynamic password server 2 to generate the dynamic password P1. As shown in the third figure B, the online terminal 10 requests to perform a transaction behavior through the first terminal 41. As shown in the figure, the web page 100 displays the user inputting the transaction behavior. The transaction account number T11 and the transaction amount T12 are used to confirm or cancel the transaction after the user confirms again. However, the transaction data T1 may contain other information, such as appointments, transfer to banks, etc., and cannot be limited. [0025] Referring to FIG. 4A and FIG. 24B, FIG. 4 is a schematic diagram showing the contents of the first embodiment and the second embodiment of the present invention. The second terminal 42 is mainly connected to the SMS server 3 via a mobile communication network to receive the SMS S1 generated and transmitted by the SMS server 3. 100117126 Form No. A0101 Page 10 of 24 1002028792-0 201249158 100261 It is worth mentioning that the second terminal 42 can be the same electronic device as the first terminal 41, for example, having both Internet functions and The mobile phone or tablet computer of the mobile communication function, the user can use the electronic device to log in to the online bank through the Internet to request the execution of the event' and receive the newsletter S1 through the mobile communication network; The second terminal 42 can be a completely different electronic device from the first terminal 41. For example, the first terminal 41 is an Internet-connected notebook computer, and the first terminal 42 is an action capable of sending and receiving a short message. Phone, but not limited. Q [〇〇2?] As shown in the fourth figure A, if the user requests to perform a non-transactional behavior, only the dynamic password pi is recorded in the short message S1; and as shown in the fourth figure B If the user requests to perform a transaction, the newsletter S1 also records the transaction data T1 and the dynamic password ρι. It is worth mentioning that the dynamic password server 2 mainly passes the oath specification of TIME MSED. To generate this dynamic password? 1, so each group of dynamic passwords? 1 There is a period of use. 'The dynamic Mima can be recorded in the newsletter 51 at the same time? 1 period of use.闺 闺 Finally, please refer to FIG. 5B, FIG. 5B and FIG. 5C, which are schematic diagrams showing the use of the dynamic male code of the first embodiment, the second embodiment, and the third embodiment of the present invention. The third terminal 43 is mainly connected to the online bank 1Q through a predetermined pipe, so that the dynamic password P1 recorded in the SMS S1 is replied to the online bank 1 () for verification. The third terminal 43 can have the following types: [0029] i The third terminal 43 can be the same electronic device as the first terminal 41, for example, an Internet-enabled computer. When the user passes the computer and asks the online bank 10 to perform the event, the online bank requests 100117126 form number face U heart 24 i __ 201249158 The dynamic password server 2 generates the dynamic password pi, and The online banking 10 transmits a dynamic password wheeled page and displays it on the computer. After the user receives the newsletter S1 through the second terminal 42, the computer can be used to input the dynamic password P1 recorded in the newsletter S1 on the input page of the dynamic password; [0030] 2. The third The terminal 43 can be the same electronic device as the second terminal 42, for example, a mobile phone with mobile communication function. When the user receives the newsletter S1 via the mobile phone, the short message S1 can be forwarded directly to the online bank 10, and more specifically, to the number designated by the online bank 10. In this way, the online bank 10 can transmit the dynamic password P1 recorded in the SMS S1 to the dynamic password server 2 for verification after receiving the forwarded message S1; [〇〇31] 3 The first terminal 41, the second terminal 42, and the third terminal 43 can be the same electronic device, for example, a mobile phone having both an Internet function and a mobile communication function. In this embodiment, the user can use a single mobile phone to perform the request for the event, the reception of the message, and the reply of the dynamic MME P1 through the Internet and the mobile communication network. [〇〇32] 4. The third terminal 43 can be an independent electronic device, such as a facsimile machine, connected to the online bank 10 via a mobile communication network. Thus, the user can use the second terminal. After receiving the short message S1, the terminal 42 fills in the dynamic timma P1 recorded in the short message S1 on a file F1, and then uses the third terminal 43 to fax the file to the online bank through the mobile communication network. Form No. A0101 Page 12 of 24 201249158 [0033] In the present invention, the reply mode and the reply pipe of the dynamic password pi are not limited, and the first terminal 41, the second terminal 42, and the first terminal 41 are not limited. The type and number of the third terminal 43, therefore, the user can have greater convenience when using the dynamic password. And, the user of the dynamic password is not lowered because the convenience in use is improved. The above is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention, and equivalent changes to the present invention are included in the present invention. BRIEF DESCRIPTION OF THE DRAWINGS [0036] The first figure is a system architecture diagram of a preferred embodiment of the present invention. [0036] The second figure is one of the present invention. A flowchart of a specific embodiment of the present invention is a schematic diagram of an event request according to a first embodiment of the present invention. [0038] FIG. 3B is an event request of a second embodiment of the present invention. 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 _1] Figure 5 is a schematic diagram of the use of dynamic passwords in the first embodiment of the present invention. [0042] Fig. B is a schematic diagram of the use of dynamic smatter in the second embodiment of the present invention. [0043] FIG. 5C is a diagram of the dynamic mega-use use of the third embodiment of the present invention. [Main component symbol description] 1002028792-0 100117126 Form number A0101 Page 13 of 24 201249158 [0044] 1...Internet banking server [0045] 10...Internet banking [0046] 1 00...Webpage [0047] 2 ...Dynamic Password Server [0048] 3...SMS Server [0049] 4...User Terminal [0050] 41...First Terminal [0051] 42···Second Terminal [0052] 43...Third Terminal [0053] T1···Transaction Information [0054] T11...Transaction Account [0055] T12...Transaction Amount [0056] R1...Request Information [0057] P1 · · Dynamic Mum [0058] S1...Newsletter [0059] F1...File [ 0060] S200~S226...Step 100117126 Form No. A0101 Page 14 of 24 1002028792-0

Claims (1)

201249158 VII. Patent application scope: 1. A method for generating and applying dynamic passwords, comprising: a) using a first terminal to log in to an online bank via the Internet; b) requesting an event on the webpage of the online bank; c) After step b, the online banking server requests the dynamic password server to generate a dynamic password; • d) the dynamic password server generates a dynamic password according to the request data; • e) generates a short message according to the content of the dynamic password;传送 transmitting the short message to the second terminal through the mobile communication network; 1 ' g) after step f, replying the dynamic password recorded in the short message to the online bank through the third terminal; h) the online bank will receive The dynamic password is forwarded to the dynamic password server; i) the dynamic password server verifies the dynamic password; j) after step i, the dynamic password server returns the verification result to the online bank; k) After j, if the verification is passed, the execution of the event is allowed. 2. The method for generating and applying a dynamic password according to claim 1, wherein the first terminal and the second terminal are the same electronic device, and the step a uses the electronic device to log in to the network through the Internet. The bank, the step f, transmits the short message to the electronic device through the mobile communication network. The method for generating and applying a dynamic password according to claim 2, wherein the first terminal, the second user, and the third terminal are the same electronic device, and the step g is to use the mobile communication network to connect the electronic device. The received newsletter is forwarded to the online bank. 100117126 Form No. A0101 Page 15 of 24 1002028792-0 201249158 4. The method of generating and applying a dynamic password as claimed in claim 3, wherein the electronic device is a mobile phone. The dynamic password generation and application method of claim 1, wherein the first terminal and the third terminal are the same electronic device, and the step a uses the electronic device to log in to the online banking through the Internet. In the step g, the electronic device is used to input the dynamic password recorded in the newsletter on the webpage of the online bank through the Internet. 6. The dynamic password generation and application method according to claim 1, wherein the third terminal is a facsimile machine, and the step g is to fax the file filled in the dynamic password to the online bank through the mobile communication network. 7. The method for generating and applying a dynamic password according to claim 1, wherein in the step c, the online banking server transmits the request data to the dynamic password server through a Secure Sockets Layer (SSL) packet. Device. 8. The method for generating and applying a dynamic password according to claim 7, wherein in the step d, the dynamic password server adopts a time based OATH specification and is based on a segment code of the SSL packet. (Section ID) as a parameter to generate the dynamic password. 9. The method for generating and applying a dynamic password according to claim 7, wherein in the step b, a transaction data is input to the webpage of the online bank, and in the step c, the online banking server uses the transaction. The data is transmitted to the dynamic password server along with the SSL packet. 10. The method of generating and applying a dynamic password according to claim 9, wherein the dynamic password and the transaction data are simultaneously recorded in the message. 11. A method for generating and applying a dynamic password, comprising: a) using a first terminal to log in to an online bank via the Internet; 100117126 Form No. A0101 Page 16 of 24 1002028792-0 201249158 b) The bank's webpage requests to execute an event and enters a transaction data; c) the online banking server transmits the transaction data and a request data to the dynamic password server; d) the dynamic password server generates a group according to the request data a dynamic password; e) the dynamic password server transmits the dynamic password and the transaction data to the simple server; - f) the short message server generates a short message, wherein the dynamic password and the transaction are recorded in the newsletter Data; ^g) transmitting the short message to the second terminal through the mobile communication network; h) after step g, replying the dynamic password recorded in the newsletter to the online bank through the third terminal; i) the online banking Forwarding the received dynamic password to the dynamic password server; j) the dynamic password server verifies the dynamic password; k) after step j, the action Password server to return a verification result the bank network; after ^ 1) step k, if verified, the event is allowed to execute. 12. The method for generating and applying a dynamic password according to claim 11, wherein in the step c, the online banking server transmits the request data to the dynamic password server through a secure socket layer packet. 13. The method for generating and applying a dynamic password according to claim 12, wherein in the step d, the dynamic cryptographic server adopts a time-based OATH specification, and generates a section according to the SSL packet as a parameter. The dynamic password 〇14. The method and the application method of the dynamic password according to claim 13, wherein the terminal is the same electronic device as the second terminal, and the terminal is numbered as A01101, page 17 of 241002028792-0 201249158 And the electronic device is a mobile phone. The dynamic password generating and applying method according to claim 13, wherein the second terminal and the third terminal are the same electronic device, and the step h is through a mobile communication network. The method for forwarding the short message received by the electronic device to the online banking device. The dynamic password generating and applying method according to claim 13, wherein the first terminal and the third terminal are the same electronic device, the step h is to use the third terminal to input the dynamic password recorded in the newsletter on the webpage of the online bank via the Internet. The method for generating and applying a dynamic password according to 13, wherein the third terminal is a facsimile machine, and the step h is to fax, by using a mobile communication network, a file filled with the dynamic password recorded in the short message to the online bank. 100117126 Form No. A0101 Page 18 of 24 1002028792-0