TWI529641B - System for verifying data displayed dynamically by mobile and method thereof - Google Patents

Description

System and method for verifying data dynamically displayed on the mobile terminal

A data verification system and method thereof, in particular, a system and method for verifying data dynamically displayed on an action end.

Today, bar codes are commonly used in the management of data. Regardless of the type of bar code, most of the applications so far have only been printed on articles such as papers, and then read by a reading device to obtain the data contained in the bar code.

With the advancement of wireless communication technology, today's personalized mobile devices are almost indispensable items in life. If the electronic barcode is displayed on the display of the mobile device held by the specific person, or the barcode obtained by the specific person is transmitted to the barcode interpretation device, it can be used for various discrimination or interpretation purposes. For example, a specific person may order a desired item, such as a ticket, via a mobile device such as a mobile phone or a personal electronic secretary device (PDA), and the ticketing unit may use an electronic barcode. The ordered ticket is sent to the mobile device of the person. After the electronic barcode displayed on the mobile device is interpreted, the interpreted data can be used as a voucher for the person to enter the venue.

However, if the person copies the electronic barcode received by him and transmits it to other people, other people can also display the electronic barcode as the admission ticket through the mobile device they hold when entering the venue. It can be seen that if the electronic barcode is copied, it may be fraudulently used.

In summary, it can be seen that there has been a problem in the prior art that the use of duplicated electronic barcodes can be fraudulently used, and therefore it is necessary to propose an improved technical means to solve this problem.

In view of the prior art, there is a problem that a duplicated electronic barcode can be used for fraudulent use, and the present invention discloses a system and method for verifying the dynamic display of the mobile terminal, wherein:

The system for verifying the dynamic display of the information on the mobile terminal disclosed by the present invention comprises at least: a verification device and a verification server. The verification device is configured to scan the data to be authenticated displayed on the mobile terminal and decode the data to be authenticated to obtain the target data, the time stamp, the identity identification data, and the action authentication data, wherein the data to be authenticated is the action authentication key. Generating, and corresponding to the target data and time stamp; the verification server is connected to the verification device for loading the servo authentication key according to the identity identification data, and verifying the action authentication data with the servo authentication key to generate the verification result, and Used to transmit the verification result to the verification device display.

The method for verifying the dynamic display of the information on the mobile terminal includes at least: the mobile terminal acquires the target data and the identity identification data; the mobile terminal loads the pre-stored action authentication key; and the mobile terminal generates the action authentication key. Action authentication data corresponding to the target data and time stamp; the mobile terminal generates corresponding data to be authenticated based on at least the target data, time stamp, action authentication data, and identity identification data; the mobile terminal displays the data to be authenticated; and the verification device scan is acted upon. The verification device reads the authentication data to obtain the target data, the time stamp, the identity identification data, and the action authentication data; the verification device transmits the target data, the time stamp, the identity identification data, and the action authentication data to the verification server. The verification server loads the servo authentication key according to the identity identification data; the verification server verifies the action authentication data with the servo authentication key and generates a verification result; the verification server transmits the verification result to the verification device; and the verification device displays the verification result.

The system and method disclosed in the present invention are as above, and the difference between the prior art and the prior art is that the present invention generates the action authentication data corresponding to the target data by using the action authentication key, and according to the target data, time stamp, action authentication data, And the identity identification data generates corresponding data to be authenticated, and after the verification device scans the data to be authenticated displayed by the mobile terminal, the authentication data is decoded to obtain the target data, the time stamp, the identity identification data, and the action authentication data, and the verification server is based on the verification data. After the identity identification data is loaded into the servo authentication key, the action authentication data is verified by the servo authentication key and the verification result is generated, thereby solving the problems existing in the prior art, and the dynamic provision of the information to be authenticated can be achieved, and the authentication can be performed quickly and easily. Technical efficacy.

The features and embodiments of the present invention will be described in detail below with reference to the drawings and embodiments, which are sufficient to enable those skilled in the art to fully understand the technical means to which the present invention solves the technical problems, and The achievable effects of the present invention.

The invention can generate and display the data to be authenticated by the mobile terminal, and after the verification device scans the data to be authenticated displayed on the mobile terminal, the parsed target data, time stamp, identity identification data and action authentication data are transmitted to the verification server. Verification to provide an authentication mechanism that is anti-counterfeiting, anti-copy, and time-sensitive.

The "target data" mentioned in the present invention is the information to be verified, and may be the identity data of the user, the ticket data of the electronic ticket, or the transaction data of the electronic transaction, etc., but the present invention proposes The "target data" is not limited to the above, and any information that needs to be verified can be used as the target data for the present invention.

The "time stamp" proposed by the present invention is data that can represent time. For example, the data described in a specific format such as "2014/7/8 17:39:13", or the number of seconds elapsed from a specific time to a certain time, is not particularly limited.

The "data to be authenticated" mentioned in the present invention is data generated by performing specific operations on the data, and can analyze the data to be authenticated to obtain the original calculation data, for example, a one-dimensional barcode or a two-dimensional barcode, a fast response matrix code ( Quick Response Code, QR-Code, pictures, etc., but the information to be authenticated mentioned in the present invention is not limited to the above.

The "identity identification data" mentioned in the present invention may be an account number, an email address, a machine code of a mobile device, a device identification code, or a phone number that the user has established in advance, and may correspond to the user, but the present invention proposes The identity identification information is not limited to the above. In addition, the "action authentication data" proposed by the present invention is data generated after a specific coding operation, and may be any combination of characters, numbers, and symbols.

In the following, the system operation of the present invention will be described with reference to the system architecture diagram of the data of the dynamic display of the verification mobile terminal proposed by the present invention. As shown in FIG. 1, the system of the present invention includes a mobile terminal 100, a verification server 200, and a verification device 290. The mobile terminal 400 can be connected to the verification server 200 through the Internet 400. The verification device 290 and the verification server 200 can be directly connected, for example, connected to the verification server 200 through a serial line, and the verification device 290 is connected. The present invention is also not particularly limited by a network connection such as a local network or an intranet.

The mobile terminal 100 may be a mobile device or an application executed on the mobile device, and the present invention is not particularly limited. The mobile terminal 100 can include a reading module 120, an authentication data generating module 150, an encoding module 160, a display module 180, and an additional transmission module 110 and an input module, as shown in FIG. 2A. Group 130, encryption and decryption module 140.

The transmission module 110 can be connected to the verification server 200, so that the user of the mobile device can go to the verification server 200 to perform the registration process. For example, the verification data transmitted by the verification server 200 and the servo authentication key, the identity identification data and the verification data are transmitted to the verification server 200, and the transmission module 110 can also perform the servo authentication transmitted by the verification server 200. The key is stored as a mobile authentication key in a storage medium on which the mobile device of the present invention is executed.

Generally, the transmission module 110 is connected to the verification server 200 through a secure channel generated by using a Secure Sockets Layer (SSL) or a Virtual Private Network (VPN) technology, but The invention is not limited to this.

The reading module 120 is responsible for reading the target data, the identity identification data, and the action authentication key. In some embodiments, the target data is identity identification data, but the invention is not limited thereto. In some embodiments, the input module 130 can also read the communication data of the user of the mobile terminal 100. The communication data is information that can be contacted by the user, including but not limited to an email address, a mobile phone number, an instant messaging account, and the like.

The target data, the identity identification data, the communication data, and the mobile authentication key are usually stored in advance in a storage medium for executing the mobile device of the present invention. The storage medium of the mobile device may be a random access memory (RAM), a read only memory (ROM), a rewritable programmable read only memory (RPROM), or a flash memory (Flash) embedded in the mobile device. The memory may also be a storage device connected to the mobile device. The present invention is not particularly limited, and any person who can store the data can be used as the storage medium of the present invention.

The "action authentication key" proposed by the present invention can be arbitrarily combined by a specific number of characters, numbers, and symbols. In some embodiments, the action authentication key may be the data generated by the authentication server, and in some embodiments, the action authentication key may be the private key in the electronic voucher applied by the user (Private) Key). In addition, in some embodiments, the mobile authentication key is usually stored after being encrypted, but the invention is not limited thereto.

Target data, identity identification data, communication data, and mobile authentication keys are not necessarily stored in the same storage medium. For example, target data can be stored in random access memory, and identity identification data can be stored in rewritable. The programmable read-only memory, communication data and mobile authentication keys can be stored in the flash memory, so that the reading module 120 respectively goes to the random access memory, the rewritable programmable vocal memory Read target data, identity identification data, communication data, and action authentication key in body and flash memory.

In practice, the reading module 120 does not necessarily read the target data, the identity identification data, the communication data, and the action authentication key from the storage medium of the mobile terminal 100, and can also read the transmission module 110. The target data provided by the external server or application can even parse the 1D barcode, 2D barcode, or image to obtain the data, or provide the user interface so that the user can directly input the data. The present invention does not In particular, any manner in which the reading module 120 can obtain data can be used in the present invention.

The input module 130 can provide a password for inputting the encryption and decryption of the mobile authentication key. For example, when the action authentication key read by the reading module 120 is encrypted, the input module 130 can provide a user interface for the user to input the decrypted password. When the transmission module 110 receives the action authentication key, the input module 130 can also provide a user interface for the user to input a password for encrypting the action authentication key.

The encryption and decryption module 140 can decrypt the action authentication key read by the reading module 120 according to the input password provided by the input module 130, and provide the decrypted action authentication key to the authentication data generation module 150. The encryption and decryption module 140 may also encrypt the action authentication key received by the transmission module 110 according to the input password provided by the input module 130, and store the encrypted action authentication key to the mobile device executing the invention. In the storage medium.

The authentication data generation module 150 is responsible for generating action authentication data using the action authentication key. When the action authentication key is the data generated by the authentication server, the authentication data generating module 150 can be based on a message authentication code (MAC), a hash message authentication code (HMAC), and an RFC 4226: HMAC-Based One-Time Password (HOPT), or RFC 6238: Time-based One-Time Password (TOPT) algorithm, using the action authentication key to target data The operation, and the hack code generated after the operation is used as the action authentication data; and when the action authentication key is the private key applied by the user, the authentication data generating module 150 can use the conventional signature algorithm to perform the target data. The operation, and the signature generated after the operation is used as the action authentication data.

In some embodiments, when the authentication data generation module 150 uses the action authentication key to generate the action authentication data, the data to be operated is not only the target data, but also includes a time stamp indicating the current time. That is to say, the action authentication data may also be generated by the authentication data generating module 150 using the action authentication key to calculate the data including the target data and the time stamp, and thus, the authentication authentication generated by the authentication data generating module 150 each time. The data will be different, that is, the authentication data generation module 150 can dynamically generate the action authentication data.

The encoding module 160 is responsible for generating the data to be authenticated. In general, the encoding module 160 generates the action authentication based on the target data and the identity identification data read by the reading module 120, the action authentication data generated by the authentication data generating module 150, and the authentication data generating module 150. The timestamp used by the data generates the data to be authenticated.

The display module 180 is responsible for displaying the data to be authenticated generated by the operation of the encoding module 160, so that the data to be authenticated generated by the encoding module 160 is displayed on the display screen of the mobile device executing the present invention.

The verification server 200 will be further explained below. The verification server 200 is responsible for verifying the data. The verification server 200 can include a storage medium 201, a transmission module 210, an identification loading module 220, an authentication data verification module 230, and an additional verification data generation module 250, as shown in FIG. 2B. The data checking module 260, the key generating module 270, and the credential verification module 280.

The storage medium 201 is responsible for storing data. Among the data stored in the storage medium 201, each of the data includes the identity identification data and the corresponding servo authentication key. The "servo authentication key" proposed by the present invention can be arbitrarily combined by a specific number of characters, numbers, and symbols. In some embodiments, the servo authentication key may be the data generated by the key generation module 270, and in some embodiments, the servo authentication key may be the public one of the electronic credentials applied by the user. Key (Public key). In addition, in some embodiments, the servo authentication key will be stored after being encrypted, but the invention is not limited thereto.

The transmission module 210 is connected to the verification device 290 and is responsible for exchanging data with the verification device 290 to complete verification of the target data.

The transmission module 210 can also be connected to the mobile terminal 100, and can exchange data with the mobile terminal 100, thereby completing the registration procedure of the user of the mobile terminal 100. In general, the transmission module 210 can be connected to the mobile terminal 100 via the Internet 400.

The identification loading module 220 is responsible for loading the servo authentication key corresponding to the identity identification data received by the transmission module 210 after the transmission module 210 receives the identity identification data transmitted by the verification device 290. For example, the identification loading module 220 can search the storage medium 201 for the identity identification data received by the transmission module 210, and read the corresponding servo authentication key, so as to complete the loading of the servo authentication key.

In some embodiments, if the servo authentication key is stored after being encrypted, the identification loading module 220 may first decrypt the servo authentication key before providing the authentication data verification module 230.

The authentication data verification module 230 is responsible for verifying the action authentication data by the servo authentication key loaded by the identification data loading module 220, and generating a corresponding verification result after verification.

In general, the authentication data verification module 230 can generate the servo authentication data by using the servo authentication key, and then compare the generated servo authentication data with the action authentication data received by the transmission module 210, thereby generating a comparison result. Validation results. The authentication data verification module 230 needs to perform an operation using the same algorithm as the algorithm used by the authentication data generation module 150 of the mobile terminal 100 to generate the action authentication key, that is, regardless of the authentication data generation module 150. According to the algorithms such as MAC, Hash-MAC, HOTP, or TOPT, or according to the signature algorithm, the action authentication key is used to calculate the target data to generate the action authentication data, and the authentication data verification module 230 also needs to be based on the same The algorithm uses the servo authentication key to calculate the target data to generate the servo authentication data.

When the server authentication data generated by the authentication data verification module 230 is different from the action authentication data received by the transmission module 210, it indicates that the action authentication data is verified, and the authentication data verification module 230 can generate the verification that the action authentication data is verified. The verification result, and if the servo authentication data is different from the action authentication data, indicating that the action authentication data cannot be verified, the authentication data verification module 230 may generate a verification result indicating that the action authentication data has not passed the verification.

In some embodiments, after the authentication data verification module 230 determines that the action authentication data has passed the verification, the authentication data verification module 230 does not directly generate the verification result, but further determines the current time and transmission module 210. Whether the time difference of the time indicated by the received time stamp is within a predetermined time range, and if so, the authentication data verification module 230 generates a verification result indicating that the action authentication data passes the verification, and if the current time and time stamp are used The time difference of the indicated time does not fall within the predetermined time range, and the authentication data verification module 230 still generates a verification result indicating that the action authentication data has not passed the verification. However, the manner in which the authentication data verification module 230 generates the verification result is not limited to the above. The predetermined time range is, for example, 10 minutes, half an hour, etc., but the invention is not limited thereto.

The verification data generation module 250 may generate verification data after the transmission module 210 receives the user data transmitted by the mobile terminal 100, and use the user data received by the transmission module 210 and the generated verification data as a The data is stored in the storage medium 201. The user data received by the transmission module 210 includes the identity identification data, or the identity identification data and the communication data. If the user data only includes the identity identification data, it indicates that the user identification data is sufficient to communicate with the user according to the identity identification data. For example, the email account or the mobile phone number, etc.; the verification data generated by the verification data generation module 250 is a randomly generated one-time data, and has timeliness, but the invention is not limited thereto.

The verification data generation module 250 can also transmit the generated verification data to the mobile terminal 100 through the transmission module 210. Generally, the transmission module 210 can select to use the short message, email, or instant message to transmit the verification data according to the identity identification data or the communication data in the user data, but the invention is not limited thereto.

After the transmission module 210 receives the identity identification data and the verification data transmitted by the mobile terminal 100, the verification data checking module 260 can read the verification data according to the identity identification data received by the transmission module 210 to the storage medium 201, and The verification data read out and the verification data received are compared to determine whether the verification data transmitted by the mobile terminal 100 is correct. When the verified verification data is the same as the received verification data, it indicates that the verification data transmitted by the mobile terminal 100 is correct, and if the verification verification data is different from the received verification data, it indicates that the verification data is transmitted by the mobile terminal 100. The verification information is incorrect.

The key generation module 270 can generate a servo authentication key when the verification data inspection module 260 determines that the verification data transmitted by the mobile terminal 100 is correct. In general, the key generation module 270 can generate a servo authentication key using a specific algorithm. However, the present invention is not limited thereto. For example, the key generation module 270 can also randomly generate a servo authentication key. The algorithm used by the key generation module 270 can be used, for example, but not limited to, a Key Derivation algorithm proposed in documents such as RFC 5968, NIST SP 800-108, NIST SP 800-132, and the like.

The key generation module 270 can also store the generated servo authentication key and the user data received by the transmission module 210 as a piece of data and store it in the storage medium 201. Generally, the key generation module 270 encrypts the servo authentication key and then stores the encrypted servo authentication key and the identity identification data into the storage medium 201. However, the present invention is not limited thereto.

The key generation module 270 can also transmit the generated servo authentication key to the mobile terminal 100 through the transmission module 210, so that the mobile terminal 100 uses the received servo authentication key as the action authentication key. The transmission module 210 may select to use a short message, an email, or an instant message to transmit a servo authentication key according to the identity identification data stored in the storage medium 201 or the communication data stored together with the identity identification data, but The invention is not limited thereto. For example, the transmission module 210 can directly transmit the servo authentication key to the mobile terminal 100 by using the SSL or VPN connection established by the mobile terminal 100.

The voucher verification module 280 can receive the identity identification data transmitted by the mobile terminal 100, the identification data, and the electronic voucher applied by the user, and the verification data checking module 260 determines the verification transmitted by the mobile terminal 100. When the data is correct, it is further determined whether the electronic certificate received by the transmission module 210 is correct.

If the voucher verification module 280 determines that the electronic voucher received by the transmission module 210 is correct, the voucher verification module 280 can use the public key in the electronic voucher received by the transmission module 210 as the servo authentication key, and The public key in the electronic voucher and the identity identification data received by the transmission module 210 are stored as a piece of data in the storage medium 201. Similar to the key generation module 270, the credential verification module 280 may first encrypt the servo authentication key before storing the encrypted servo authentication key and the identity identification data in the storage medium 201, but the present invention does not This is limited to this.

The verification device 290 will continue to be described below. The verification device 290 is responsible for scanning the data to be authenticated displayed by the mobile terminal 100. The verification device 290 may use different scanning technologies depending on the data to be authenticated. For example, when the data to be authenticated is a one-dimensional barcode, the verification device 290 may scan the data to be authenticated by using the one-dimensional barcode scanning device. When the authentication material is a QR-code or an image, the verification device 290 is a device having an imaging lens to scan the data to be authenticated.

The verification device 290 is also responsible for decoding the scanned data to be authenticated, and obtaining the target data, time stamp, identity identification data, and action authentication data after decoding.

The verification device 290 is also responsible for transmitting the target data, the time stamp, the identity identification data, the action authentication data and the like obtained by decoding the data to be authenticated to the verification server 200 for verification, and displaying the verification result returned by the verification server 200.

In some embodiments, the data to be authenticated may also obtain the transaction identification data after the decoding, and the verification device 290 may, after verifying that the verification result generated by the verification server 200 indicates that the action authentication data passes the verification, according to the decoding of the data to be authenticated. The acquired transaction identification data is used for the corresponding transaction.

Next, the operation system and method of the present invention will be explained in the first embodiment, and the flow chart of the user registration method and the "3C chart" proposed by the present invention will be described with reference to "3A". A flow chart of the method of dynamically displaying the data. In the present embodiment, it is assumed that the member system external to the present invention intends to verify the identity of the member through the present invention.

First, members of the member system (hereinafter referred to as users) need to install an application (action terminal 100) supporting the present invention on a mobile device such as a mobile phone used, and complete the registration process.

After the user installs and executes the application supporting the present invention, the input module 130 of the mobile terminal 100 can provide the user to input the identity identification data, or the user identification data and the communication data, and after the user completes the input. The user data input by the user is transmitted to the verification server 200 via SSL or VPN through the transmission module 110 of the mobile terminal 100 (step 312). In the present embodiment, it is assumed that the identity identification material is an account number of the user in the member system, for example, an email address.

After the transmission module 210 of the verification server 200 receives the user data transmitted by the mobile terminal 100, the verification data generation module 250 of the verification server 200 can generate a one-time verification data, and generate the verification data and The user data received by the transmission module 210 is temporarily stored in the storage medium 201 of the verification server 200, and the generated verification data is transmitted to the mobile terminal 100 through the transmission module 210 (step 316). In this embodiment, it is assumed that the transmission module 210 transmits the verification data to the user's email mailbox (that is, the user's account number in the member system) via email.

After the user-to-email mailbox reads the email containing the verification data transmitted by the verification server 200, the user can input the verification data through the input module 130 of the mobile terminal 100. Thus, the transmission module 110 of the mobile terminal 100 The authentication module input by the input module 130 and the identity identification data previously input by the user may be transmitted to the verification server 200 via the SSL or VPN connection (step 318a).

After the transmission module 210 of the verification server 200 receives the verification data and the identity identification data transmitted by the mobile terminal 100, the verification data inspection module 260 of the verification server 200 can determine whether the verification data received by the transmission module 210 is Correct (step 321). In this embodiment, it is assumed that the verification data inspection module 260 searches the storage medium 201 of the verification server 200 for the identity identification data received by the transmission module 210, and reads the same identity identification data when it is searched. The verification data stored together with the identified identity identification data, and then the verification data inspection module 260 compares the verification data received by the transmission module 210 with the verified verification data. If the two are the same, it means that the verification data received by the transmission module 210 is correct; if the two are different, it means that the verification data received by the transmission module 210 is incorrect, and the verification server 200 will not perform subsequent processing.

When the verification data check module 260 of the verification server 200 determines that the verification data received by the transmission module 210 of the verification server 200 is correct, the key generation module 270 of the verification server 200 can generate a servo authentication key (step 323). In this embodiment, it is assumed that the key generation module 270 generates a servo authentication key using a derivative key algorithm.

After the key generation module 270 of the verification server 200 generates the servo authentication key (step 323), the key generation module 270 can receive the generated servo authentication key and the transmission module 210 of the verification server 200. The obtained identity identification data is stored as a piece of data, stored in the storage medium 201 of the verification server 200 (step 327), and the generated servo authentication key is transmitted to the mobile terminal 100 through the transmission module 210 (step 328). In this embodiment, it is assumed that the transmission module 210 transmits the servo authentication key to the mobile terminal 100 through the SSL and VPN connection established by the mobile terminal 100.

After receiving the servo authentication key transmitted by the verification server 200, the transmission module 110 of the mobile terminal 100 can use the received servo authentication key as an action authentication key and store it in the mobile device that executes the present invention ( In the storage medium of the mobile phone used by the user (step 329), the registration process is completed. In this embodiment, it is assumed that the mobile terminal 100 further includes an encryption and decryption module 140. Before the mobile authentication key is stored in the storage medium, the encryption and decryption module 140 can further encrypt the mobile authentication key by using a password, so that the storage medium is stored. Encrypted action authentication key. The encryption and decryption module 140 is used to encrypt the password of the mobile authentication key. The encryption and decryption module 140 requests the user to input through the input module 130 of the mobile terminal 100.

After the user completes the registration process, when the member system requests the user to perform the identity verification, the user can execute the application supporting the invention on the mobile phone, so that the reading module 120 of the mobile terminal 100 can execute the present invention. The target device and the identity identification data are retrieved from the storage medium of the mobile device (step 332), and the action authentication key previously stored in the registration process is loaded (step 336). In this embodiment, the target data obtained by the reading module 120 may be the user's personal data or the same member account number as the identity identification data; in addition, since the mobile authentication key is encrypted, the encryption and decryption are performed. The module 140 can request the user to input the same password as that when encrypting the action authentication key through the input module 130, and decrypt the action authentication fund read by the reading module 120 by using the password input by the user through the input module 130. key.

After the reading module 120 of the mobile terminal 100 obtains the target data and the identity identification data (step 332), and loads the action authentication key (step 336), the authentication data generating module 150 of the mobile terminal 100 can use the action authentication fund. The key generates action authentication data corresponding to the target data and a timestamp indicating the current time (step 340). In this embodiment, it is assumed that the authentication data generation module 150 performs the calculation of the RFC 4226 or RFC 6238 on the data composed of the target data and the current time (time stamp) using the action authentication key to generate a one-time action authentication data. .

After the authentication data generation module 150 of the mobile terminal 100 generates the action authentication data with the action authentication key (step 340), the encoding module 160 of the mobile terminal 100 can generate the data to be authenticated (step 350). In this embodiment, since the authentication data generation module 150 calculates the data composed of the target data and the time stamp by using the action authentication key to generate the action authentication data, the encoding module 160 reads the mobile terminal 100. The target data acquired by the module 120, the identity identification data, the action authentication data generated by the authentication data generation module 150, and the timestamp used by the authentication data generation module 150 are encoded to generate a corresponding QR-code. (to be certified).

After the encoding module 160 of the mobile terminal 100 generates the data to be authenticated (step 350), the display module 180 of the mobile terminal 100 can display the data to be authenticated generated by the encoding module 160 (step 361), so that the data to be authenticated is displayed. On the display screen of the mobile device of the present invention.

After the display module 180 of the mobile terminal 100 displays the data to be authenticated (step 361), the user can display the display screen of the mobile device of the present invention close to the verification device 290, so that the verification device 290 can be scanned and displayed on the display screen. The information to be certified (step 363). In the present embodiment, since the to-be-certified material is QR-code, the verification device 290 needs to include an imaging lens to scan the QR-code displayed by the mobile device of the present invention.

After the verification device 290 scans the data to be authenticated (step 363), the verification device 290 can decode the authentication data to obtain the target data, time stamp, and identity identification data used by the encoding module 160 of the mobile terminal 100 to generate the data to be authenticated. And the information such as the action authentication data (step 367), and the decoded data is transmitted to the verification server 200.

After the transmission module 210 of the verification server 200 receives the data transmitted by the verification device 290, the identification loading module 220 of the verification server 200 can load the servo authentication fund according to the identity identification data received by the transmission module 210. Key (step 372). In this embodiment, it is assumed that the identification loading module 220 searches the storage medium 201 of the verification server 200 for the identity identification data received by the transmission module 210, and searches for the identity received by the transmission module 210. After identifying the data, the servo authentication key stored in the registration program along with the identified identity identification data is read.

In practice, in the registration procedure, the key generation module 270 of the verification server 200 stores the servo authentication key (step 327), encrypts the servo authentication key before storing the encrypted servo authentication key, and recognizes The load module 220 needs to decrypt the encrypted servo authentication key after reading the encrypted servo authentication key, thereby loading the servo authentication key.

After the identification loading module 220 of the verification server 200 loads the servo authentication key (step 372), the authentication data verification module 230 of the verification server 200 can receive the transmission module 210 of the verification server 200. The action certification data is verified and a verification result is generated after verification (step 376). In this embodiment, it is assumed that the authentication data verification module 230 first uses the servo authentication key loaded by the recognition loading module 220 to generate the same calculation algorithm as the authentication authentication data generated by the authentication data generation module 150 of the mobile terminal 100. The method calculates the target data and the time stamp received by the transmission module 210, so as to generate the servo authentication data after the operation. Then, the authentication data verification module 230 compares the generated servo authentication data with the action authentication data received by the transmission module 210.

If the servo authentication data is different from the action authentication data, the authentication data verification module 230 generates a verification result indicating that the action authentication data has not passed the verification; and when the servo authentication data is the same as the action authentication data, the authentication data verification mode of the verification server 200 is verified. The group 230 can further determine whether the time difference between the current time and the time indicated by the timestamp received by the transmission module 210 is within a predetermined time range. If so, the authentication data verification module 230 generates a verification that the action authentication data is verified. The verification result, and if the time difference between the current time and the time indicated by the time stamp does not fall within the predetermined time range, the authentication data verification module 230 will generate a verification result indicating that the action authentication data has not passed the verification.

After the authentication data verification module 230 of the verification server 200 generates the verification result, the transmission module 210 of the verification server 200 can transmit the verification result generated by the authentication data verification module 230 to the verification device 290 (step 381). After receiving the verification result transmitted by the verification server 200, the verification device 290 can display the received verification result. Thus, with the present invention, the user can complete the identity verification.

In the following, the operation system and method of the present invention will be explained in the second embodiment. Please refer to the "3B diagram" for another method of user registration and "C3C". In the present embodiment, it is assumed that there is a ticketing system external to the present invention to verify the correctness of the ticket using the present invention.

First, as in the first embodiment, the user of the ticket needs to complete the registration process on the mobile phone (mobile terminal 100) that he is using.

The user can first operate the mobile terminal 100 to apply for and download the electronic voucher. After the user completes the download of the electronic voucher, the reading module 120 of the mobile terminal 100 can read the phone door number (identity identification data) used by the mobile terminal 100, and the transmission module 110 of the mobile terminal 100 can transmit the SSL or VPN. The secure channel is transmitted to the authentication server 200 (step 312).

After the transmission module 210 of the verification server 200 receives the identity identification data transmitted by the mobile terminal 100, the verification data generation module 250 of the verification server 200 can generate a one-time verification data, and generate the verification data and The identity identification data received by the transmission module 210 is temporarily stored in the storage medium 201 of the verification server 200, and the generated verification data is transmitted to the mobile terminal 100 through the transmission module 210 (step 316). In this embodiment, it is assumed that the transmission module 210 transmits the verification data to the mobile terminal 100 using the received identity identification data (telephone number) through the short message.

After the mobile terminal 100 receives the short message including the verification data, the reading module 120 of the mobile terminal 100 can read the verification data in the short message, or the input module 130 of the mobile terminal 100 can provide the user input record in the short message. The verification data, in this way, the transmission module 110 of the mobile terminal 100 can again transmit the verification data in the SMS, the identity identification data previously read by the reading module 120, and the action in the action through the SSL or VPN connection. The electronic voucher in the storage medium of the terminal 100 is transmitted to the authentication server 200 (step 318b).

After the transmission module 210 of the verification server 200 receives the verification data, the identity identification data and the electronic certificate transmitted by the mobile terminal 100, the verification data inspection module 260 of the verification server 200 can be as described in the first embodiment. It is judged whether the verification data received by the transmission module 210 is correct (step 321). And when the verification data checking module 260 determines that the verification data received by the transmission module 210 is correct, the voucher verification module 280 of the verification server 200 can further determine whether the electronic voucher received by the transmission module 210 is correct (step 325). ).

The verification data check module 260 of the verification server 200 determines the verification data received by the transmission module 210 of the verification server 200 and the certificate verification module of the verification server 200 determines that the electronic certificate received by the transmission module 210 is When correct, the credential verification module 280 of the verification server 200 can store the identity identification data received by the transmission module 210 and the public key (servo authentication key) in the electronic voucher as a piece of data, and store it in the verification server 200. In the storage medium 201 (step 327), the registration process is completed.

After the registration process is completed, when the ticketing system wants to verify the ticket owned by the user, the user can operate on the mobile phone (the mobile terminal 100), so that the external server or the external application that generated the ticket can vote. Volume data is provided to the mobile terminal 100. In the present embodiment, the ticket data is provided to the mobile terminal 100 in clear text.

In this way, the reading module 120 of the mobile terminal 100 can obtain the target data and the identity identification data into the storage medium of the mobile terminal 100 (step 332), and load the private key (the action authentication key) in the electronic certificate (step 336). ). In this embodiment, the target data acquired by the reading module 120 includes ticket data and transaction identification data.

After the reading module 120 of the mobile terminal 100 obtains the target data and the identity identification data (step 332), and loads the action authentication key (step 336), the authentication data generating module 150 of the mobile terminal 100 can use the action authentication fund. The key generates action authentication data corresponding to the target data (step 340). In this embodiment, it is assumed that the authentication data generation module 150 uses the action authentication key (private key) to sign the target data and the time stamp indicating the current time to generate the action authentication data.

After the authentication data generating module 150 of the mobile terminal 100 generates the action authentication data corresponding to the target data by using the action authentication key (step 340), the encoding module 160 of the mobile terminal 100 can be configured according to the reading module 120 of the mobile terminal 100. The acquired target data, the time stamp used by the authentication data generation module 150, and the action authentication data generated by the authentication data generation module 150 generate the data to be authenticated (step 350). In this embodiment, it is assumed that the data to be authenticated generated by the encoding module 160 is QR-code.

After the encoding module 160 of the mobile terminal 100 generates the data to be authenticated (step 350), the display module 180 of the mobile terminal 100 can display the data to be authenticated generated by the encoding module 160 (step 361), so that the data to be authenticated is displayed. On the display screen of the mobile device of the present invention.

After the display module 180 of the mobile terminal 100 displays the data to be authenticated (step 361), the user can display the display screen of the mobile device of the present invention close to the verification device 290, so that the verification device 290 can be scanned and displayed on the display screen. The information to be certified (step 363).

Thereafter, the verification device 290 can decode the authentication data to obtain the target data, the time stamp, the identity identification data, and the action authentication data used by the encoding module 160 of the mobile terminal 100 to generate the data to be authenticated (step 367), and decode the data. The acquired target data, time stamp, identity identification data, and action authentication data are transmitted to the verification server 200.

After the transmission module 210 of the verification server 200 receives the target data, the time stamp, the identity identification data, and the action authentication data transmitted by the verification device 290, the identification loading module 220 of the verification server 200 can be based on the transmission module. The identity identification data received by 210 is loaded into the servo authentication key (step 372). In this embodiment, it is assumed that the identification loading module 220 searches the storage medium 201 of the verification server 200 for the identity identification data received by the transmission module 210, and searches for the identity received by the transmission module 210. After identifying the data, the servo authentication key stored in the registration program together with the identified identity identification data is read, that is, the public key applied by the user.

After the identification loading module 220 of the verification server 200 loads the servo authentication key (step 372), the authentication data verification module 230 of the verification server 200 can receive the transmission module 210 of the verification server 200. The action certification data is verified and a verification result is generated after verification (step 376). In this embodiment, it is assumed that the authentication data verification module 230 first uses the servo authentication key (the public key applied by the user) loaded by the recognition loading module 220 to access the target data received by the transmission module 210. Check with the timestamp. If the verification fails, that is, the target data and the time stamp do not pass the verification servo authentication data and the action authentication data, the authentication data verification module 230 generates a verification result indicating that the action authentication data has not passed the verification; and when the servo authentication data is obtained If the authentication is successful, the authentication data verification module 230 of the verification server 200 can further determine whether the time difference between the current time and the time indicated by the time stamp received by the transmission module 210 is within a predetermined time range. If yes, the authentication data verification module 230 generates a verification result indicating that the action authentication data passes the verification, and if the time difference between the current time and the time indicated by the time stamp does not fall within the predetermined time range, the authentication data verification module 230 can also produce verification results indicating that the verification has not been verified.

After the authentication data verification module 230 of the verification server 200 generates the verification result, the transmission module 210 of the verification server 200 can transmit the verification result generated by the authentication data verification module 230 to the verification device 290 (step 381).

After receiving the verification result transmitted by the verification server 200, the verification device 290 may display the received verification result (step 385), and may perform the corresponding transaction according to the transaction identification data included in the to-be-certified data (step 390). ). Thus, through the present invention, the verification of the ticket can be completed.

In summary, it can be seen that the difference between the present invention and the prior art is that after the mobile terminal generates the action authentication data corresponding to the target data by using the action authentication key, the target data, the time stamp, the action authentication data, and the identity identification data are obtained. The corresponding information to be authenticated is generated, and after the verification device scans the data to be authenticated displayed by the mobile terminal, the authentication data is decoded to obtain the target data, the time stamp, the identity identification data, and the action authentication data, and the verification server carries the identification information according to the identity. After entering the servo authentication key, the method of verifying the action authentication data by using the servo authentication key and generating the verification result, the technical means can solve the problem that the prior art can use the duplicated electronic barcode to take the identity, and then Achieve dynamic technical solutions that provide information to be certified and that can be quickly and easily certified.

Furthermore, the method for verifying the dynamic display of the data on the mobile terminal can be implemented in hardware, software or a combination of hardware and software, or can be implemented in a centralized manner in a computer system or spread over several different components by different components. Even the decentralized way of implementing computer systems.

While the embodiments of the present invention have been described above, the above description is not intended to limit the scope of the invention. Any modification of the form and details of the practice of the present invention, which is a matter of ordinary skill in the art to which the present invention pertains, is a patent protection of the present invention. range. The scope of the invention is to be determined by the scope of the appended claims.

100 mobile terminal 110 transmission module 120 reading module 130 input module 140 encryption and decryption module 150 authentication data generation module 160 encoding module 180 display module 200 verification server 201 storage medium 210 transmission module 220 recognition loading Module 230 authentication data verification module 250 verification data generation module 260 verification data inspection module 270 key generation module 280 certificate verification module 290 verification device 400 internet Step 301: The mobile terminal downloads the electronic certificate including the action authentication key and the server authentication key. Step 312: The mobile terminal transmits the identity identification data to the verification server. Step 316: The verification server transmits the verification data to the mobile terminal. Step 318a: The mobile terminal transmits the verification data to the verification. Server Step 318b The mobile terminal transmits the verification data and the electronic certificate to the verification server. Step 321 Verify that the server determines whether the verification data is correct. Step 323 Verify that the server generates the servo authentication key. Step 325 Verify that the server verifies that the electronic certificate is correct. Step 327 Verify the servo. The device stores the identity identification data and the servo authentication key. Step 328: The verification server transmits the servo authentication key to the mobile terminal. Step 329: The mobile terminal uses the servo authentication key as the action authentication key. Step 332: The action end acquires the target data and the identity identification data step 336 The mobile terminal loads the pre-stored action authentication key step 340 The action end generates the action authentication data corresponding to the target data and the time stamp by using the action authentication key. Step 350: The action end generates the corresponding data to be authenticated according to the target data, the time stamp, the action authentication data, and the identity identification data. Step 361 The authentication data step 363: the verification device scans the data to be authenticated displayed by the mobile terminal. Step 367: The verification device decodes the authentication data to obtain the target data, the time stamp, the identity identification data, and the action authentication data. Step 369: The verification device transmits the target data, the time stamp, The identity identification data and the action authentication data to the verification server step 372. The verification server loads the servo authentication key according to the identity identification data. Step 376. The verification server verifies the action authentication data with the servo authentication key and generates a verification result. Step 381. Verify the server transmission. Verification result to verification device step 385 verification device displays verification result step 390 verification installation The corresponding transactions carried out based transaction authentication data identifying information to be contained in the

FIG. 1 is a system architecture diagram of the information for verifying the dynamic display of the mobile terminal according to the present invention. Figure 2A is a schematic diagram of the components of the mobile terminal of the present invention. FIG. 2B is a schematic diagram of components of the verification server according to the present invention. FIG. 3A is a flow chart of a method for user registration proposed by the present invention. FIG. 3B is a flow chart of another method for user registration proposed by the present invention. FIG. 3C is a flow chart of a method for verifying dynamic display of information on the mobile terminal according to the present invention.

Step 332: Obtain the target data and the identity identification data on the mobile terminal. Step 336: Load the pre-stored action authentication key on the mobile terminal. Step 340. The mobile terminal generates the action authentication data corresponding to the target data and the time stamp by using the action authentication key. Step 350 The target data, the time stamp, the action authentication data, and the identity identification data generate corresponding data to be authenticated. Step 361: The mobile terminal displays the data to be authenticated. Step 363. The verification device scans the data to be authenticated displayed by the mobile terminal. Step 367: The verification device decodes the authentication data. In order to obtain the target data, the time stamp, the identity identification data, and the action authentication data, step 369, the verification device transmits the target data, the time stamp, the identity identification data, and the action authentication data to the verification server. Step 372: The verification server loads the servo authentication according to the identity identification data. Key step 376 verifies that the server verifies the action authentication data with the servo authentication key and generates a verification result step Step 381, the verification server transmits the verification result to the verification device. Step 385. The verification device displays the verification result. Step 390 The verification device performs the corresponding transaction according to the transaction identification data included in the data to be authenticated.

Claims (10)

A method for verifying data displayed dynamically by an action terminal, the method comprising at least the following steps: an action end acquires a target data and a identity identification data; the action end loads a pre-stored action authentication key; the action end uses the action The action authentication key generates one of the action authentication data corresponding to the target data and a time stamp; the action end generates a corresponding one to be authenticated according to at least the target data, the time stamp, the action authentication data, and the identity identification data. The action end displays the to-be-certified data; a verification device scans the to-be-certified data displayed by the mobile terminal; the verification device decodes the to-be-certified data to obtain the target data, the time stamp, and the identity identification data And the action authentication data; the verification device transmits the target data, the time stamp, the identity identification data and the action authentication data to a verification server; the verification server loads a servo authentication key according to the identity identification data; The verification server verifies the action authentication data with the servo authentication key and generates a verification result The verification server transmits the verification result to the verification device; and the verification device displays the verification result. The method for verifying the information dynamically displayed by the mobile terminal according to the first aspect of the patent application, wherein the method further comprises the verification device according to the data to be authenticated after the step of transmitting the verification result to the verification device by the verification server The step of including one transaction identification data in the corresponding transaction. The method for verifying the information dynamically displayed by the mobile terminal according to the first aspect of the patent application, wherein the method further comprises the mobile terminal transmitting the identity identification before the step of loading the pre-stored mobile authentication key on the mobile terminal. Data to the verification server, the verification server transmits a verification data to the mobile terminal, and the mobile terminal transmits the verification data to the verification server, and the verification server determines that the verification data is correct, and generates the servo authentication key, The step of storing the identity identification data and the servo authentication key and transmitting the servo authentication key to the mobile terminal as the action authentication key. The method for verifying the dynamic display of the information of the mobile terminal according to the first aspect of the patent application, wherein the method includes the action download before the step of loading the pre-stored action authentication key on the mobile terminal An authentication key and an electronic voucher of the server authentication key, the mobile terminal transmits the identity identification data to the verification server, the verification server transmits a verification data to the mobile terminal, and the mobile terminal transmits the verification data and the The electronic credential is sent to the verification server, and the verification server determines the correctness of the verification data and verifies the step of storing the identity identification data and the servo authentication key after the electronic certificate is correct. The method for verifying the information dynamically displayed by the mobile terminal according to the first aspect of the patent application, wherein the step of obtaining the target data by the mobile terminal is to read the data stored in the mobile terminal, and receive the external server or the application program. Provide information, parse 1D barcodes, 2D barcodes, or images to obtain information and/or provide input. The method for verifying the information dynamically displayed by the mobile terminal according to the first aspect of the patent application, wherein the step of the verification server verifying the action authentication data is that the verification server generates the corresponding data corresponding to the target data by using the servo authentication key. A servo authentication data, and a step of comparing the action authentication data with the servo authentication data. A system for verifying data dynamically displayed on a mobile terminal, the system comprising: at least: a verification device for scanning one of the information to be authenticated displayed by an action terminal, and for decoding the data to be authenticated to obtain a target data, a time stamp, a identity identification data, and an action authentication data, wherein the data to be authenticated is generated by the action authentication key and corresponding to the target data and the time stamp; and a verification server, and The verification device is connected to load a servo authentication key according to the identity identification data, and verify the action authentication data by using the servo authentication key to generate a verification result, and send the verification result to the verification device to display . The system for verifying the information dynamically displayed by the mobile terminal according to the seventh aspect of the patent application, wherein the verification device is further configured to perform a corresponding transaction according to one of the transaction identification data included in the to-be-certified data. The system for verifying the information dynamically displayed by the mobile terminal according to the seventh aspect of the patent application, wherein the verification server is further configured to receive the identity identification data transmitted by the mobile terminal, and send a verification data to the After the action end, and determining that the verification data transmitted by the mobile terminal is correct, generating the servo authentication key, storing the identity identification data and the servo authentication key, and transmitting the servo authentication key to the mobile terminal The key to the action certification. The system for verifying the information dynamically displayed by the mobile terminal according to the seventh aspect of the patent application, wherein the verification server is further configured to: after receiving the identity identification data transmitted by the mobile terminal, transmitting a verification data to the action And determining, after determining that the verification data transmitted by the mobile terminal is correct, and the electronic certificate corresponding to the action authentication key and the servo authentication key transmitted by the mobile terminal is correct, storing the identity identification data and the Servo authentication key.