WO2007087748A1

WO2007087748A1 - A theft protection system for network account and a method thereof

Info

Publication number: WO2007087748A1
Application number: PCT/CN2007/000294
Authority: WO
Inventors: Tao Huang
Original assignee: Tao Huang
Priority date: 2006-01-26
Filing date: 2007-01-26
Publication date: 2007-08-09
Also published as: CN1808975B; CN1808975A

Abstract

A theft protection system for network account and a method thereof are provided, the technical method mainly includes: a. An external theft protection apparatus with a unique sequence number is connected to the client; b. The external theft protection apparatus generates the account verification information cryptograph for requesting logon to the server after the encryption of the account verification information; c. The external theft protection apparatus transmits the verification information cryptograph and the account to the application server over the network through the client; d. The application server decrypts the verification information cryptograph, and verifies the account verification information; e. The application server checks all of the information to determine whether there is any error. In the above, the task schedule of the encryption and decryption, the calculation, the storing of the intermediate result, the result verification, and the combination and separation of the text and cryptograph are all processed within the apparatus.

Description

Network account anti-theft system and method thereof

The invention belongs to the field of computer and network information security, and relates to a network identity authentication system and a method thereof, and in particular to a network account anti-theft system and a method thereof. Background technique

Currently available identity products are: USB Key, USB Token, RSA SecurlD Authentication Token and Smart Cards and USB Authenticators, SafeNet's iKey System! ], Smart Key, Datakey, Gemplus smart card, Epass authentication lock, etc. The most commonly used are the RSA SecurlD authentication token and SafeNet's iKey series.

The RSA SecurlD identity authentication token adopts a dynamic password system, which is composed of a password token of the client side and an authentication server of the application system end. The authentication server is the core part of the entire system. It is connected to the application server through the LAN to authenticate all Internet users. When the user logs in to the application system, the authentication system generates a dynamic password on the dedicated chip of the password token and the authentication server according to the security algorithm. After comparison, if the two passwords are the same, the user is a legitimate user, otherwise it is an illegal user. Dynamic passwords change every minute. When the user logs in, he or she can log in according to the current dynamic password displayed on the token, plus a personal identification number. However, the RSA SecurlD authentication token also has the following drawbacks:

1. It is necessary to keep the token synchronized with the clock on the server side. If the token is slightly deviated from the server's clock source and cannot maintain good synchronization, the problem of legitimate users being unable to log in occurs when the accumulated deviation is as large as the preset value (typically 60 seconds). Since there is no communication channel between the token and the server, it is not possible to synchronize automatically on a regular basis, and it is necessary to log in manually on the server. The deviation of the usual consumption level clock from the standard clock from a few seconds to a dozen seconds per month is a very general allowable error distribution.

2. Each time the user logs in, he or she needs to input a long series of random random numbers through the keyboard. Once the error is entered, it is necessary to re-operate. Moreover, it is particularly easy to log in due to clock misalignment or network delay when operating near the time when the dynamic password changes, which is very inconvenient to use.

3. Since the password continues to be valid within a certain time window after the user logs in, there is a danger that the hacker uses the Trojan software to track the record and log in with the password in the time window. This danger has been clearly pointed out by foreign experts.

The USB token represented by SafeNet's iKey series generally uses the following methods: 1. The server or client obtains a random number and sends it to the other party.

6 2. Take out the algorithm factors stored separately.

3. Perform operations on these two numbers.

4. See if the results of the operation are consistent. If they are consistent, the algorithm factors at both ends are consistent (because random numbers are shared, only the algorithm factors are affected). In turn, the algorithmic factor of the client is the agreed number -- the client is a legitimate user. ■

However, the above authentication method has the following drawbacks:

♦ Encryption and decryption task calls, operations, intermediate result storage, result checking, ciphertext synthesis, or decomposition are not all done within the iKey, requiring client application software to participate.

♦ The configuration of the iKey can be directly operated by the merchant's software on the client, and there are various dangers caused by hackers breaking the merchant software.

♦ Only one layer of hash algorithm encryption is used in the iKey, and no dynamic encryption is used. It is assumed that the hacker repeatedly uses the Trojan software on the client to track the random number sent by the server and the result of the iKey postback (ie, plaintext and ciphertext), which is easier to crack the algorithm factors and obtain the means of illegal access.

Most other USB KEY technologies have implemented hash algorithms, public key algorithms, random number generation, and symmetric key algorithms in some or all of the devices. However, the invocation of the encryption and decryption process, the decomposition of the plaintext and ciphertext, the result verification, the algorithm selection, and the parameter configuration all involve part or all of the client software participation.

Summary of the invention

The technical problem to be solved by the present invention is to provide a network account anti-theft system and a method thereof, which can effectively prevent a hacker from illegally entering a user account by bypassing the encryption authentication under the premise of being convenient to use.

In order to solve the above technical problem, the technical solution adopted by the present invention is to provide a network account anti-theft method, which includes the following steps: a, connecting an external network account anti-theft device having a unique serial number to the client;

b. The external network account anti-theft device encrypts the account verification information (such as the account user password, the serial number of the network account anti-theft device, etc., and the account user password is generally the account user's 髙 intensity password or the second-level password). Requesting the account verification information ciphertext of the login to the server;

c. The network account anti-theft device uploads the information such as the account verification information ciphertext and the account number of the account to be uploaded to the application server through the client;

d. The application server decrypts the account verification information cipher from the external network account anti-theft device, and checks the account verification information (the account user password, the serial number, etc., the account user password is generally an account number).

7 07 000294 User's strength code or secondary password); '

e. The application server checks whether all the information is correct. If it is correct, the access is allowed. If there is an error, the access is stopped.

The task call, operation, storage of intermediate results, result check, synthesis or decomposition of plaintext and ciphertext of the encryption and decryption itself are completely carried out inside the user's external network account anti-theft device.

Further, the present invention further includes the following method for periodically confirming valid online, comprising the following steps: the application server periodically sends a verification handshake signal encrypted by a dynamic encryption and a public key algorithm; and the external network account anti-theft device decrypts the verification handshake signal. ;

The network account anti-theft device generates an encrypted response handshake response ciphertext;

The external network account anti-theft device uploads the handshake response ciphertext and the account number to the application server through the client through the network;

The application server decrypts the handshake response ciphertext;

The application server checks whether all the information is correct, and continues to service if there is no error. If it is wrong, the connected application service is stopped.

Further, the network account anti-theft method of the present invention further includes a method for exiting the service, including the following steps: when the client application login needs to be logged out, the client sends an exit service request to the application server, and the application server stops the accessed service;

The client prompts the user to remove the external network account anti-theft device.

Further, the network account anti-theft method of the present invention further includes a method for synchronously adjusting the dynamic encryption/decryption circuit, which is specifically:

The network authentication server or the application server sends a synchronization adjustment signal to the external network account anti-theft device, thereby triggering the external network account anti-theft device to perform synchronization adjustment to maintain synchronization with the network authentication management server or the application server.

Further, the network account anti-theft method of the present invention further includes a multi-application, multi-account simple login method, including the following steps: calling a client application login program;

The client login program sends an application service code or feature word corresponding to the currently logged-in application to the external network account anti-theft device;

The external network account anti-theft device sends all the accounts under the application service code or feature word stored in the internal to the client;

The client login program displays all accounts received from the external network account anti-theft device for the user to select;

8 The user selects the login account on the client and enters the login password.

The client login program sends the selected account information and login password to the external network account anti-theft device; the external network account anti-theft device checks whether the account information and the login password sent by the client are correct, and if there is an error, the login is stopped, if not, then Continue with step b.

The login password may be the owner password of the external network account anti-theft device or the primary password that the user can easily remember.

Further, storing, in the external network account anti-theft device, a plurality of application service codes or feature words, and allowing some or all of the application service codes or feature words to be sold or issued to the network account in the external network account anti-theft device. The application service is not bound. After the external network account anti-theft device is sold or issued to each user of the network account, the application service is additionally bound without changing the core confidential data area.

The network authentication server or the application server sends the encrypted synchronization adjustment signal to the external network account anti-theft device, and the external network account anti-theft device receives the synchronization adjustment.

Meanwhile, the present invention also provides a network account anti-theft system, including: a client; and:

The external network account anti-theft device is connected to the client, and is used for encrypting the account verification information and the like by the dynamic encryption and the public key algorithm to generate an account verification information ciphertext for requesting login to the server; The information ciphertext and the account number are uploaded to the application server on the network through the client; each of the external network account anti-theft devices has a unique serial number, and the core confidential data area that the client cannot access in any mode is internally provided. 'Application server, which decrypts and dynamically decrypts the account verification information ciphertext requested by the external network account anti-theft device through the public key algorithm, checks the account verification information, checks whether all the information is correct, and allows access without error. If there is an error, stop accessing;

The special programming device is configured to program the core confidential data area and other areas in the non-volatile memory in the external network account anti-theft device after being checked by the secure handshake communication protocol.

The network authentication server can be used to provide synchronization adjustment and other account anti-theft system management services.

Further, the external network account anti-theft device includes:

a first random sequence generator for generating a configurable random sequence;

a non-volatile memory for storing serial number, account information, user password of an account (generally an account user's strength password or secondary password), a local public key, a private key, a coefficient factor of a random sequence, and the like;

Dynamic encryption circuit for dynamic encryption;

Public key algorithm encryption circuit, performing public key algorithm encryption;

The control unit is mainly used to call the related information to synthesize the account verification information, the encryption operation call, and configure the first

9 The machine sequence generator performs synchronous adjustment according to the decrypted synchronization signal, and communicates with the client through the peripheral interface. a second random sequence generator for generating a configurable random sequence;

The public key algorithm decryption circuit decrypts the information by using a private key stored in the non-volatile memory;

Dynamic decryption circuit for dynamically decrypting information;

The control unit is mainly used for decrypting the operation call, configuring the second random sequence generator, etc., and verifying whether the serial number included in the signal sent by the application server after decryption is consistent with the serial number stored in the non-volatile memory. According to the decrypted synchronization signal, the synchronization is adjusted, and the client communicates through the peripheral interface.

Correspondingly, the network account anti-theft device may also include a first random sequence generator for generating a configurable random sequence;

a non-volatile memory for storing serial number, account information, user password of an account (generally a high-strength password or a secondary password of an account user), a local public key, a private key, a coefficient factor of a random sequence, and the like;

The public key algorithm encryption circuit encrypts the account verification information and the account information stored in the non-volatile memory by a public key algorithm;

The dynamic encryption circuit dynamically encrypts the encryption result of the public key algorithm by using a random sequence generated by the first random sequence generator;

The control unit is mainly used for calling related information to synthesize account verification information, encrypting operation call, configuring the first random sequence generator, performing synchronous adjustment on the first random sequence generator according to the decrypted synchronization signal, and the client through the peripheral interface communication.

a second random sequence generator for generating a configurable random sequence;

The dynamic decryption circuit dynamically decrypts the verification handshake signal encrypted by the dynamic encryption and public key algorithm periodically sent by the application server by using a random sequence generated by the second random sequence generator;

The public key algorithm decryption circuit decrypts the dynamically decrypted information by using a private key stored in the non-volatile memory;

The control unit is mainly used for decrypting the operation call, configuring the second random sequence generator, etc., and verifying whether the serial number included in the signal sent by the application server after decryption is consistent with the serial number stored in the non-volatile memory. And synchronizing the second random sequence generator according to the decrypted synchronization signal from the application server, communicating with the client through the peripheral interface, and the like. Further, the external network account anti-theft device further includes:

An oscillator and a phase locked loop for generating a desired clock signal for each frequency;

a memory for storing intermediate data and working with the control unit;

10 A path selector for selecting different interface control circuits to communicate with the client.

The network account anti-theft device may further comprise: a programming peripheral interface connected to the programming device, the interface needs to be activated by the communication protocol and the programming device verification handshake authentication;

The core confidential data area is disposed in a non-volatile memory, and is used for storing core confidential data such as a private key, a serial number, and the like that are not allowed to be accessed by an external device other than the programming device;

The control unit can be used to verify the handshake communication protocol between the programming peripheral interface and the programming device, and only allow the allowed specific module to access the core confidential data area in the non-volatile memory, and prohibit the interface that can be connected with the client. The circuit accesses the core confidential data area and certain registers of each encryption and decryption circuit. The invention combines the dynamic sequence agreed by the application server end and the external encryption anti-theft device for dynamic encryption and public key algorithm encryption, and the task call, the operation, the storage of the intermediate result, the result check, the plaintext and the encryption and decryption of the client itself. The synthesis or decomposition of the ciphertext is completely carried out in the device (even in a single SOC chip in the device), regardless of the client software, and does not leave traces of data on the client hard disk, and there are any modes inside the chip. The core confidential data area in the non-transparent memory that the client cannot access, so it can strictly prevent the network hacker from stealing the client and network communication, or modifying the client software, thereby obtaining the method of stealing and illegally entering the user account. , to maximize the protection of personal network accounts and the security of tangible and intangible assets in the account. The user has one device at hand, and can log in to multiple accounts on servers of different or the same service content on a client such as any PC or laptop connected to the network. Don't worry about the account password being illegally recorded and eavesdropped. According to the invention, the network account anti-theft device can display on the client according to the specific application number corresponding to the currently logged-in client software and let the client select the account currently required to log in, and input a password for confirming the identity of the device owner, without inputting an account. , random numbers, etc., so login is easy to use. DRAWINGS

1 is a schematic structural diagram of a network account anti-theft system of the present invention.

2 is a schematic structural diagram of an external network account anti-theft device of the present invention.

3 is a flow chart of the network account anti-theft method of the present invention. detailed description

As shown in FIG. 1 , the network account anti-theft system of the present invention includes: an external network account anti-theft device 1, a client 2,

11 The application server 4, the network authentication management server 5, the programming device 6, the external network account anti-theft device and the client are connected through various communication interfaces such as USB, serial port, infrared, Bluetooth, etc., the client and the application server, and the network authentication management The servers are connected via a network 3 (Internet, local area network, wireless network, etc.).

The external network account anti-theft device is connected to the client, and is used for verifying account information (such as an internally stored account user password (generally an account user's high-intensity password or a second-level password), a serial number, and an account information. After the dynamic encryption and public key encryption, the account verification information ciphertext that requests the login to the server is generated; the account verification information ciphertext and the account number that are requested to log in to the server are uploaded to the network through the client. application server;

The application server, which requests the login account verification information ciphertext from the server to be decrypted and dynamically decrypted by the public key algorithm, and checks the user password of the account (generally the high-strength password or the secondary password of the account user) and the sequence. No information, etc., to check whether all information is correct, if it is correct, access is allowed, and if there is an error, access is stopped.

The programming device is configured to program the core confidential data area and other areas in the non-volatile memory in the external network account anti-theft device after being checked by the secure handshake communication protocol.

As shown in FIG. 2, the external network account anti-theft device includes:

The non-volatile memory 11 is configured to store a coefficient component of the random sequence, a serial number, account information, a user password of the account (generally an account strength password or a secondary password of the account user), a local public key, a private key, and the like;

The first random sequence generator 7 is configured to generate a configurable random sequence according to a coefficient factor stored in the nonvolatile memory 11;

The dynamic encryption circuit 8 dynamically encrypts the serial number, account information, and the like stored in the nonvolatile memory 11 by using a random sequence generated by the first random sequence generator 7.

The public key encryption circuit 9 performs the public key encryption on the dynamically encrypted information;

a second random sequence generator 19, configured to generate a configurable random sequence according to a coefficient factor stored in the nonvolatile memory 11;

The public key decryption circuit 16 performs a public key algorithm decryption on the verification handshake signal encrypted by the dynamic encryption and public key algorithm periodically sent by the application server by using the private key stored in the nonvolatile memory 11;

The dynamic decryption circuit 17, the information decrypted by the public key is dynamically decrypted by the random sequence generated by the second random sequence generator 19;

The control circuit 10 is configured to be used for calling the related information to synthesize the account verification information, and the encryption and decryption operation is called to configure the first random sequence generator to verify the serial number and the nonvolatile state of the signal sent by the application server after being decrypted. Whether the serial numbers stored in the sexual memory 11 are identical. Configuring a first random sequence generator Ί and a second random sequence The generator 19 and other modules trigger the first random sequence generator 7 and the second random sequence generator 19 to perform synchronization adjustment according to the synchronization adjustment signal, and the control interface circuit completes the communication protocol with the client.

An oscillator and phase-locked loop 21 for generating a desired clock signal for each frequency _f

The memory 18 is configured to store intermediate data and cooperate with the control unit 10.

The path selector 12 is configured to select a different interface control circuit 13, 14 to communicate with the client 2, and a programming peripheral interface 15 connected to the programming device, the interface needs to be authenticated by the communication handshake protocol and the programming device to be activated, The core data area 20 and other data areas in the nonvolatile memory 11 are accessed and burned using the account security system dedicated programming device 6 in the secure mode. - the core confidential data area 20 is disposed in the non-volatile memory 11 for storing core secret data such as a private key, a serial number, and the like that are not allowed to be accessed by an external device other than the dedicated programming device;

The control unit 10 can also be used to verify the communication handshake protocol of the programming peripheral interface 15 and the dedicated programming device, and only allow the specific module to be allowed (such as the activated programming peripheral interface 15, the random sequence generator, the public key). The encryption and decryption circuit, the dynamic encryption/decryption circuit, etc. can access the core confidential data area 20 in the non-volatile memory 11, and prohibit the interface circuit that can be connected to the client from accessing the core confidential data area 20 and some registers of the encryption and decryption circuits. .

With the present invention, the core secret data area in the non-volatile memory cannot be accessed through the client interface 13 or 14 in any mode. Therefore, hackers cannot access, steal, or tamper with data in core secret areas through the network and clients.

Further, the network authentication server or the application server is configured to send a synchronization adjustment signal (transmitted by the public key algorithm to encrypt the ciphertext mode) to the external network account anti-theft device, thereby triggering the first random sequence generator 7 Synchronizing with the second random sequence generator 19 (e.g., resetting at the synchronization point state) to maintain synchronization with the random sequence of the network authentication management server 5 or the application server 4 (i.e., causing the random sequencer to be in a consistent state, such as Both are reset to their initial state).

The order of the dynamic encryption circuit 8 and the public key encryption circuit 9 in the data path may be interchanged, and the order of the public key decryption circuit 16 and the dynamic decryption circuit 17 in the data path may also be interchanged, but The encryption and decryption order of the server corresponds. As shown in Figure 3, the main process of the network account anti-theft method of the present invention is as follows:

Each external network anti-theft device 1 has a unique serial number burned in the internal non-volatile memory 11. The serial number between any two external network anti-theft devices 1 is different. The non-volatile memory 11 in the external network account anti-theft device also stores an application number, a key, a random sequence generator factor, and the like, and a plurality of network accounts of the user,

13 Password and related information.

Step 1. The user connects the external network account anti-theft device 1 to the client 2,

Step 2. The control unit 10 configures other modules in the external network account anti-theft device 1

Step 3. User client 2 Open the client application login interface.

Step 4: The client login program sends the application service code or feature word to the external network account anti-theft device, and informs the external network account anti-theft device 1 which application is currently logged in (such as the service platform B provided by the operator A), step 5, the external network The account anti-theft device sends all the accounts under the application service code or feature word stored internally to the client:

The external network account anti-theft device 1 sends all the network accounts under the non-volatile storage port 11 (such as the service platform B provided by the operator A) to the client 2;

Step 6. The client login program displays the network account anti-theft device 1 for all accounts under the application, and the user selects the account to be logged in. (If there is only one, it can be automatically selected):

Step 7. The user fills in the login password (multiple accounts can use the same password, or different passwords, which can also be the owner password of the external network account anti-theft device or the primary password that the user can easily remember);

Step 8. The client login program of the client 2 transmits the password of the account selected by the user to the external network account anti-theft device through the interface. ■

Step 9, external network account anti-theft device 1 check to confirm whether the account password is correct; if there is a mistake, stop logging in, if the password is correct, continue to step 10;

Step 10, the control unit 10, the serial number stored in the non-volatile memory 11, the user password corresponding to the selected account (generally the high-intensity password or the second-level password of the account user, not the owner password of the device), and the account The necessary information, the check sequence, and the like constitute account verification information, and together with the random sequence generated by the first random sequence generator 7, are dynamically encrypted by the dynamic encryption circuit 8, and the encrypted result is further subjected to the public key algorithm encryption circuit 9. After the encryption, the login request ciphertext is generated; (the dynamic encryption algorithm and the public key encryption algorithm are both prior art and can be implemented in various manners. For example, in the specific embodiment, the dynamic encryption method is specifically The configurable random series generated by the first random sequence generator 7 is subjected to a bitwise exclusive OR operation with data such as a serial number stored in the nonvolatile memory port, necessary information in the corresponding account, and the like. (The order of the public key algorithm and the dynamic encryption algorithm can be exchanged, but it needs to correspond to the application server decryption operation order)

Step 11, the external network account anti-theft device will request the login account verification information ciphertext and account number to the server 2 to the client 2;

Step 12: The application login program of the client 2 passes the network 3 to check the account verification information ciphertext and account of the login.

14 The number is transmitted to the application server 4;

Step 13: The application server 4 passes the public key algorithm and dynamic decryption of the account verification information cipher requesting to log in, and checks the user password of the account (generally the high-strength password or the secondary password of the account user), the serial number, and the like. Step 14. The application server 4 checks whether all the information is correct. If there is an error, stop logging in, if it is correct, continue with step 15;

Step 15. The application server notifies the client, and the client software of the client 2 and the server software of the application server 4 normally serve the user.

Further, the present invention may further include: the application server 4 may select whether to time and the external network account anti-theft device connected to the client 2 according to the needs of the operator. 1 The handshake is confirmed by an encrypted method to confirm that the login is always valid.

Step 16. The application server 4 periodically sends the verification handshake signal encrypted by the dynamic encryption and the public key algorithm to the external network account anti-theft device through the client 2;

Step 17: The external network account anti-theft device decrypts and verifies the verification handshake signal: first, the public key decryption circuit 16 decrypts the private key in the non-volatile memory 11 with a public key algorithm, and then uses the dynamic decryption circuit 17 The sequence generated by the second random sequencer generator 19 is dynamically decrypted. The control unit 10 confirms that the serial number contained in the data sent by the application server 4 is confirmed in comparison with the serial number of the current local external network account anti-theft device 1 used by the user; (the order of the public key algorithm and the dynamic decryption algorithm can be exchanged, But it needs to correspond to the application server encryption operation order)

Step 18: The external network account anti-theft device 1 dynamically encrypts the random sequence generated by the first random sequence generator 7, the serial number stored in the non-volatile memory 11, and the necessary information in the corresponding account through the dynamic encryption circuit 8. The public key encryption circuit 9 generates a handshake response message after public key encryption; (the order of the public key algorithm and the dynamic encryption algorithm can be exchanged, but needs to correspond to the application server decryption operation order)

Step 19: The external network account anti-theft device uploads the generated handshake response ciphertext and account number from the network 3 to the application server 4 through the client 2;

Step 20: The application server 4 decrypts the handshake response ciphertext through the public key algorithm and the dynamic decryption step 21, and the application server 4 checks whether all the information is correct. If the error is correct, the normal login is maintained; otherwise, the login is stopped, and the client is stopped. Software for user service.

The server can select whether to synchronize with the external network account of the user terminal according to the needs of the network application. The anti-theft device uses an encrypted method to confirm that the login is always valid. The handshake should be automatically performed. In the case that the external network account anti-theft device is normal and effective, it is not required. The user manually intervenes and does not interfere with the application running.

When the application software of client 2 logs out, the user will be prompted to take the external network account anti-theft device 1 and properly

15 Custody, and notify the application server 4 that the user has logged out of this service.

The external encryption anti-theft device reserves and provides a plurality of application service codes or feature words in the non-volatile memory 11, wherein some or all of the application service codes or feature words are sold or issued to the network account anti-theft device for each user's fashion. No application services are bound. After the network account anti-theft device is sold or issued to each user of the network account, the application service may be additionally bound and the account information related to the application service may be saved without changing the core confidential data area.

16

Claims

Rights request

A network account anti-theft method, characterized in that the method comprises the following steps:

a. Connect an external network account anti-theft device with a unique serial number on the client;

b. The external network account anti-theft device encrypts the account verification information to generate an account verification information ciphertext requesting to log in to the server;

c. The external network account anti-theft device uploads the account verification information ciphertext and the account number that are requested to log in to the application server through the client;

d. The application server decrypts the account verification information cipher that is requested to be logged in from the external network account anti-theft device, and checks the account verification information;

e. The application server checks whether all the information is correct. If it is correct, the access is allowed. If there is an error, the access is stopped. Among them, the task of the encryption and decryption itself, the operation, the storage of the intermediate result, the result check, the synthesis of the plaintext and the ciphertext or Decomposition, completely inside the external network account anti-theft device.

2. The network account anti-theft method according to claim 1, wherein the account verification information comprises: an account user password, a serial number of the external network account anti-theft device, or a verification sequence.

3. The network account anti-theft method according to claim 1, further comprising the steps of: the application server periodically transmitting a verification handshake signal encrypted by a dynamic encryption and a public key algorithm; the external network account anti-theft device will verify Handshake signal decryption verification;

The external network account anti-theft device generates an encrypted handshake response ciphertext generated by the encryption;

The application server decrypts the handshake response ciphertext;

The network account anti-theft method according to claim 1 or 3, further comprising the following steps: when the client application login needs to be logged out, the client sends an exit service request to the application server, and the application server stops the access. Service

The client prompts the user to take the external network account anti-theft device.

2

The network account anti-theft method according to claim 1, wherein the step a and the step b further comprise the following steps:

Call the client application login program;

The client login program displays all the accounts received from the external network account anti-theft device for the user to select; the user selects the login account on the client, and inputs the login password;

The client login program sends the selected account information and login password to the external network account anti-theft device; the external network account anti-theft device checks whether the account information and the login password sent by the client are correct, and if not, stop logging in, if not, Then proceed to step b.

The network account anti-theft method according to claim 5, wherein the login password is a master password of the external network account anti-theft device or a primary password that is more easily remembered by the user.

The network account anti-theft method according to claim 1, wherein a plurality of application service codes or feature words are stored in the external network account anti-theft device, and part or all of the application service codes or feature words are allowed to be When the external network account anti-theft device is sold or issued to each user of the network account, no application service is bound, and after the external network account anti-theft device is sold or issued to each user of the network account, without changing the core confidential data area, , append the binding application service.

The network account anti-theft method according to claim 1, wherein the network authentication server or the application server sends the encrypted synchronization adjustment signal to the external network account anti-theft device, and the external network account anti-theft device receives the synchronization adjustment. .

9. A network account anti-theft system, comprising: a client; and:

The external network account anti-theft device is connected to the client, and is used for encrypting the account verification information and the like by the dynamic encryption and the public key algorithm to generate an account verification information ciphertext for requesting login to the server; The information ciphertext and the account number are uploaded to the application server on the network through the client; each of the external network account anti-theft devices has a unique serial number, and the core confidential data area that the client cannot access in any mode is internally provided.

The application server, which decrypts and dynamically decrypts the account verification information ciphertext requested by the external network account anti-theft device through the public key algorithm, checks the account verification information, checks whether all the information is correct, and allows access without error. Stop accessing;

3 The programming device is configured to program the core confidential data area in the non-volatile memory in the external network account anti-theft device after checking by the secure handshake communication protocol.

The network account anti-theft system according to claim 9, wherein the external network account anti-theft device comprises:

a first random sequence generator (7) for generating a configurable random sequence;

a non-volatile memory (11) for storing serial number, account information, user password of an account, a local public key, a private key, a coefficient factor of a random sequence, and the like;

Dynamic encryption circuit (8) for dynamic encryption;

Public key algorithm encryption circuit (9), which will perform public key algorithm encryption;

The control unit (10) is mainly used for calling related information to synthesize account verification information, encrypting the operation call, configuring the first random sequence generator, performing synchronous adjustment on the first random sequence generator according to the decrypted synchronization signal, and the client Communication via the peripheral interface.

The network account anti-theft system according to claim 9, wherein the network account anti-theft device comprises:

The public key algorithm encryption circuit (9) encrypts the account verification information and the account information stored in the non-volatile memory (11) by a public key algorithm;

Dynamic encryption circuit (8) for dynamic encryption;

The control unit (10) is mainly used to call the related information to synthesize the account verification information, the encryption operation call, configure the first random sequence generator, perform synchronous adjustment according to the decrypted synchronization signal, and communicate with the client through the external interface. The network account anti-theft system according to claim 14, wherein the external network account anti-theft device further comprises:

a second random sequence generator (19) for generating a configurable random sequence;

The public key algorithm decryption circuit (16) decrypts the information by using a private key stored in the non-volatile memory (11);

a dynamic decryption circuit (17) for dynamically decrypting information;

The control unit (10) is mainly used for decrypting the operation call, configuring the second random sequence generator, etc., and verifying the serial number contained in the signal sent by the application server after being decrypted and the sequence stored in the non-volatile memory. Number is

4 No, the synchronization is adjusted according to the decrypted synchronization signal, and the client communicates with the peripheral interface.

The network account anti-theft system according to claim 10, wherein the external network account anti-theft device further comprises:

The dynamic decryption circuit (17) dynamically decrypts the verification handshake signal sent by the application server and dynamically encrypted by the dynamic encryption and public key algorithm by using a random sequence generated by the second random sequence generator (19);

a public key algorithm decryption circuit (16) for decrypting the dynamically decrypted information by a public key algorithm using a private key stored in the non-volatile memory (11);

The control unit (10) is mainly used for decrypting the operation call, configuring the second random sequence generator, etc., and verifying the serial number contained in the signal sent by the application server after being decrypted and the sequence stored in the non-volatile memory. Whether the numbers are consistent, the second random sequence generator is synchronized according to the decrypted synchronization signal from the application server, and the client communicates through the peripheral interface.

The network account anti-theft device according to claim 9 or 10, wherein the external network account anti-theft device further comprises:

An oscillator and a phase locked loop (21) for generating a desired clock signal for each frequency;

The memory (18) is used for storing intermediate data and works with the control unit; the path selector (12) is for selecting different interface control circuits to communicate with the client.

The network account anti-theft system according to claim 13, wherein the network account anti-theft device comprises:

a programming peripheral interface (15) connected to the programming device (6) for connecting the programming device (6), which requires activation of the communication protocol and the programming device verification handshake authentication;

The core confidential data area (20) is disposed in the non-volatile memory (11) for storing core confidential data such as a private key and a serial number that are not allowed to be accessed by an external device other than the programming device (6);

The control unit (10) can be used to verify the handshake communication protocol between the programming peripheral interface (15) and the programming device, and only allow the allowed specific module to access the core confidential data area in the non-volatile memory (11). (20), prohibiting the interface circuit that can be connected to the client to access the core confidential data area (20) and some registers of each encryption and decryption circuit.