WO2009018685A1

WO2009018685A1 - The device and the method of encrypting and authenticating against trojan horse with one time key

Info

Publication number: WO2009018685A1
Application number: PCT/CN2007/002384
Authority: WO
Inventors: Kamfu Wong
Original assignee: Kamfu Wong
Priority date: 2007-08-08
Filing date: 2007-08-08
Publication date: 2009-02-12
Also published as: CN101933287B; HK1151402A1; CN101933287A

Abstract

The device, the system and the method of encrypting and authenticating against Trojan horse includes the following steps, the user information including the password, the sum of the transaction, and the number of the account is inputted using the keyboard (102). The user information is encrypted by the key (A), and is sent to the server (4) through the user device (2) and the network (3). The server decrypts the received information with the key (B). Because the key (A) used each time has no relations with other key (A), the information is safe even if it is obtained by the hacker in the process of being transmitted. At the same time, the information is inputted through the keyboard (102) of the device of the encrypting and authenticating (1). The hacker can not obtain the information inputted through the keyboard (102) of the device of the encrypting and authenticating (1) even if the Trojan horse invades into the user's computer.

Description

Encrypted authentication device and method for spoofing a disposable key for a Trojan horse [Technical Field]

The present invention relates to the field of information transmission security, and in particular to an encryption authentication apparatus for authentication and a corresponding authentication method.

【Background technique】

With the advancement of the times, the application of information technology is very popular. In particular, financial institutions such as banks provide many services that use information technology, such as online banking services, mobile banking services, online securities trading services, etc. These services are generally The user's transaction information is transmitted to the financial institution through the network. After the financial institution verifies the user's transaction information, the corresponding operation is performed according to the information content.

Due to the current security problems of the general network, there are often incidents of hackers stealing other people's accounts. Therefore, some financial institutions use some two-factor authentication methods to combat hackers, such as using a Token Device, when a user logs into a financial institution's server. The security encoder generates a code. In addition to entering the correct user password, the user must enter the correct code to log in to the financial institution's server. These security encoders usually have a built-in key. When used, the security coder generates a security code by complex algorithm calculation according to factors such as time, and uses the same key in the financial institution's server, according to time. The factor is calculated by the same algorithm to generate a code. If the code generated by the financial institution's server is the same as the security code generated by the security codec, the identity of the security coder can be authenticated, and the user password is checked. At the same time, the security code and user password can be authenticated to log in successfully. Although this two-factor authentication method can improve the problem of network security, there are still some departments. The network security problem has not been properly solved. For example, some hackers use various intrusion methods to place the Trojan horse on the user's computer. When the user connects to the financial institution's server, the Trojan is used to steal the user's data, including the account number. , the account password and the security code entered by the user, etc. Some hackers even create a fake financial institution's website, tricking the user into entering the transaction information on the counterfeit financial institution's website, and then the hacker logs in to the financial institution based on the stolen data. The server, then stealing money from the user's account.

In addition, with the development of computer technology, the computer's computing power is getting stronger and stronger. Some information encryption measures that were previously considered to be safe and reliable and unbreakable may also be cracked by computers with powerful computing power, so that they can be encrypted with these information. The security of financial institutions is a major challenge. In order to protect the security of user accounts, many financial institutions have adopted more complex encryption algorithms for keys and algorithms, which increase operating costs, and with the development of computer technology, In the year, the information encryption measures that are currently regarded as safe and reliable may also be completely cracked, which poses considerable risks for financial institutions and users, so many people are afraid to use the online trading services of financial institutions. This is a pole. The problem to be solved.

[Summary of the Invention]

It is an object of the present invention to provide an encryption authentication apparatus for authenticating a user's identity and transaction information.

The object of the present invention is achieved by using such an encryption authentication device for identity authentication, characterized in that the main structure of the encryption authentication device (1) comprises a main chip (101) and a keyboard (102). The display screen (103) and the communication interface (104), wherein the main chip (101) is provided with a CPU and a memory, and is connected with other components, and operates according to a predetermined program to realize the identity of the authenticated user in the server (4). And various scheduled functions, including encrypting data, storing data, Reading the data input by the user through the keyboard (102), displaying the prompt information through the display screen (103), sending the authentication data to the server (4) through the communication interface (104), and encrypting the authentication device

(1) Encrypt the data entered by the user through the keyboard (102), including the user password, operation command, account number, etc., with the key (A), and then transmit it to the terminal (2) and the network (3). The server (4), the server (4) uses the paired key (B) to decrypt the data and restore the data input by the user, and check the data content, and after verifying, the user's identity authentication is successful, and then the server (4) The corresponding operation is performed according to the data content; and, the main chip (101) further includes a unique device number (105) and a plurality of keys (A) and a plurality of index numbers (C), each index number (C) corresponds to a key (A), and, each index number

(C) are different from each other.

The encryption authentication device (1) of the present invention uses a disposable key (A) as an encryption and authentication means, and a keyboard (102) is provided on the encryption authentication device (1) for the user to input data. Including the user password, operation instructions, account number and other data, and then encrypt the data with the key (A), and then transmitted to the server (4) via the network (3) through the terminal (2), which is used by the server (4) The key (B) paired with the key (A) decrypts the data and restores the user password, operation instruction, account number and other data, so that even if the data is intercepted by the hacker during the transmission process, the data is encrypted and used. End-of-life key (A) encryption, there is no connection between each key (A) and other keys (A), so that the hacker can not crack, plus the data is from the keyboard of the encryption authentication device (1) (102) Input, the encrypted authentication device (1) is physically separated from the user's computer. Even if the hacker uses a Trojan to invade the user's computer, the Trojan can't read the encryption. Means (1) a keyboard on the key input data (102).

In terms of setting, the server (4) is provided with a plurality of authentication accounts (401), and each authentication account (401) corresponds to an encrypted authentication device (1), and the account is stored in the authentication account (401) Corresponding cryptographic authentication device (1) device number (105) and an account password, each authentication account (401) stores multiple keys (B) and multiple index numbers (C), each index number

(C) corresponds to a key (B), and the key (B) in each authentication account (401) is paired with the key (Α) in the encrypted authentication device (1) of the account, each The key (Β) has a paired key (Α), and each pair of paired keys (Α) and key (Β) have the same index number (C). Before using the cryptographic authentication apparatus (1) of the present invention, a plurality of pairs of keys and a plurality of sequential index numbers are generated in a random manner by the server (4) in advance by various methods.

(C), each pair of keys is assigned an index number (C), and then each pair of keys is stored together with the assigned index number (C) to the main chip (101) and authentication of the encrypted authentication device (1) Account

(401), the key (Α) stored in the main chip (101) and the key (Β) stored in the authentication account (401), if the encryption algorithm used is an asymmetric cryptographic algorithm, dense The key (Α) and the key (Β) are a pair of keys that are paired with each other. If the encryption algorithm used is a symmetric cryptographic algorithm, the key (Α) and the key (Β) are the same pair of keys. One of the keys (Α), after encrypting the data, can decrypt the data using the key (Β) paired with the key (Α).

Another feature of the present invention is that, each time the main chip (101) of the encryption authentication device (1) encrypts the data, an unused key (Α) is extracted from the main chip (101) according to a predetermined program. Encryption, and, after the main chip (101) encrypts the data, the key (Α) is deleted or discarded or marked as used, so that the key (Α) will not be used again by the main chip (101). use. And, each time the server (4) decrypts the data, a key (()) paired with the data is decrypted from the authentication account (401) according to a predetermined program, and the server (4) decrypts the data. After that, the key (Β) will be deleted or discarded or marked as used, so that the key (Β) will not be used by the server (4) again. And, using such an encrypted authentication telecommunications system for user identity authentication purposes, particularly for the financial industry, including using the aforementioned encryption authentication device (1), terminal (2), network (3), server (4) , wherein the encryption authentication device (1) is independent of the terminal (2) and is disposed separately from the terminal (2), and each encryption authentication device (1) in the system is registered in the server (4) and is respectively The server (4) recognizes that a paired key (A, B) is respectively provided in the encryption authentication device (1) and the server (4), and the encryption process is performed in the encryption authentication device (1), using the key ( A) forming a ciphertext, which is transmitted to the server (4) via the terminal (2) and the network (3), and the server (4) decrypts the ciphertext by using the paired key (B), and the decryption succeeds, and the system is successfully identified. Enter the next scheduled program.

And adopting such an encryption authentication method, using the encryption authentication device described above for identity authentication and the like, wherein the method includes the user logging in to the server (4) by using the terminal (2), The user inputs the account authentication password (1) into the data to be authenticated, and the encrypted authentication device (1) encrypts the data to be authenticated into the ciphertext, and then passes the terminal (2) via the network (3). The ciphertext is transmitted to the server (4), and the server (4) decrypts the ciphertext to restore the data that needs to be authenticated. After the server (4) checks that the data to be authenticated is correct, the user's identity authentication is successful, and the server can be logged in (4).

This achieves the object of the present invention.

The advantage of the encryption authentication device (1) of the present invention is that each key is used only once, and is used up and down, and is not reused, so that the hacker cannot crack the key or data content from the encrypted data, and encrypts The authentication device (1) is provided with a keyboard (102) for the user to input important data. Even if the hacker uses a Trojan horse to invade the user's computer, the hacker cannot steal important data input by the user, and is particularly suitable for applications such as online banking and online transactions. [Description of the Drawings]

1 is a schematic explanatory diagram of the cryptographic authentication apparatus (1) of the present invention;

2 is a schematic explanatory view showing the outline of another outline of the encryption authentication apparatus (1) of the present invention; FIG. 3 is a schematic explanatory diagram of the encryption authentication apparatus (1) having the USB interface (104); FIG. 5 is a block diagram showing an encrypted authentication device (1) having an English keyboard (102); FIG. 5 is a block diagram showing an encrypted authentication device (1) of the present invention;

Fig. 6 is a schematic explanatory view showing the steps of the encryption authentication device (1) of the present invention and the server (4) in use. '

In the figures, the same numerals represent the same systems, devices, and components. The method steps are indicated by the number of the circle and the line with the arrow. The drawings are schematic for explaining the main features of the encryption authentication device (1) of the present invention and the operational steps in use.

【detailed description】

The method of the present invention will be further described in detail below with reference to the accompanying drawings.

1 to 4, FIG. 1 is a schematic explanatory view of the cryptographic authentication apparatus (1) of the present invention, and FIG. 2 is a schematic explanatory diagram of another outline of the cryptographic authentication apparatus (1) of the present invention. 3 is a schematic explanatory view of the encryption authentication device (1) including the USB interface (104), and FIG. 4 is a schematic explanatory view of the encryption authentication device (1) having the English keyboard (102). 1 to 4 show an avatar schematic illustration of an embodiment of a different configuration of the cryptographic authentication device (1), the cryptographic authentication device (1) shown in the figure, except for the different shapes, their keyboards (102) There are also buttons, and the keyboard (102) of the encryption authentication device (1) may be a keyboard (102) containing numeric keys, or a keyboard (102) containing English alphabetic keys, or a keyboard (102) containing numbers and English letters. Referring to FIG. 5, FIG. 5 is a block diagram showing the structure of the encryption authentication apparatus (1) of the present invention. The main structure of the encryption authentication apparatus (1) shown in the figure includes a main chip (101), a keyboard (102), a display screen (103), a communication interface (104), wherein the main chip (101) is provided with a CPU and a memory, and is connected with other components, and operates according to a predetermined program to implement authentication of the user on the server.

(4) The identity and various predetermined functions, including encrypting the data, storing the data, reading the data input by the user through the keyboard (102), displaying the prompt information through the display screen (103), and sending the authentication data through the communication interface (104) To the server (4), and, the encrypted authentication device (1) passes the user through the keyboard

(102) Input data, including user password, operation instruction, account number, etc., with key

(A) Encrypt the data and transmit it to the server (4) through the terminal (2) and the network (3). The server (4) decrypts the data using the paired key (B) to restore the data entered by the user. , and check the content of the data, after verifying that the user's identity is authenticated successfully, then the server

(4) will perform corresponding operations according to the data content; and, the main chip (101) also includes a unique device number ( ₁₀₅₎ and a plurality of keys ( _A) and a plurality of index numbers (C), each An index number (C) corresponds to a key (A), and each index number (C) is different from each other.

With continued reference to FIG. 5, the communication interface (104) shown may be a wireless communication device, or a wired communication device, or a Bluetooth device, or an infrared device, or a USB interface, or an SD memory card interface, or a MINI-SD memory. Card interface, or MMC memory card interface, or RS-MMC memory card interface, or RS-232 interface, or PS2 keyboard interface.

Referring to FIG. 6, FIG. 6 is a schematic diagram showing the steps of the encryption authentication apparatus (1) and the server (4) in use of the present invention. The server (4) shown in the figure is provided with a plurality of authentication accounts (401). Each authentication account (401) corresponds to an encrypted authentication device (1), and the authentication account (401) stores the device number (105) of the encrypted authentication device (1) corresponding to the account and an account password, and each authentication account (401) stores multiple keys (B) and multiple index numbers (C), Each index number (C) corresponds to a key (B), and the key (B) in each authentication account (401) is paired with the key (A) in the encrypted authentication device (1) of the account. Relationship, each key (B) has a matching key (A), and each pair of paired keys (A) and keys (B) have the same index number (C). The key (A) and the key (B) are generated in advance by the server (4) in a random manner by various methods. When the key (A) is stored in the main chip (101) of the encryption authentication device (1), only the master The chip (101) can have internal access to the key (A) without any external access to secure the key (A).

In addition, each time the main chip (101) of the encryption authentication device (1) encrypts the data, an unused key (A) is extracted from the main chip (101) according to a predetermined program to encrypt the data, and the main chip (101) After encrypting the data, the key (A) is deleted or discarded or marked as used, so that the key (A) is not used again by the main chip (101). And, each time the server (4) decrypts the data, a key paired with the data is extracted from the authentication account (401) according to a predetermined program (B), the data is decrypted, and the server (4) decrypts the data. After that, the key (B) is deleted or discarded or marked as used, so that the key (B) will not be used by the server (4) again. Since the key (A) and the key (B) are used up and down, each key is used only once. When the key (A) in the encryption authentication device (1) is used up, the encryption authentication device is used. (1) If you cannot continue to use it, the user must replace the new encryption authentication device (1). If the encryption authentication device (1) stores 10,000 keys (A) and uses an average of 10 calculations per day, it can be used. 3 years.

In terms of encryption and decryption algorithms, the key (A) and the key (B) use a one-time password (One Time Pad or Vernam- cipher). The so-called one-time password is a randomly generated secret that is as long as the message. The key, the key and the message are subjected to the "X0R" operation of the bit to generate the ciphertext, and the same key and the appropriate algorithm are applied during the decryption, so that the restored message can be conveniently decrypted due to the key. It is used only once and then discarded, so it cannot be cracked. It is the simplest safe and fast encryption algorithm. The encryption authentication device (1) of the present invention can also adopt other encryption algorithms in addition to the One Time Pad encryption algorithm, and can also achieve the object of the present invention well. The encryption algorithms that can be used include:

1. Data Encryption Standard (DES);

2. Triple Data Encryption Standard ( Triple - DES ) ;

3. RSA encryption algorithm (RSA algorithm);

4. One Time Pad;

5. Public Key Infrastructure (PKI).

Before the main chip (101) of the encryption authentication device (1) of the present invention encrypts the data, the encrypted data content further includes verification data to ensure that the data is not tampered, and the verification data is encrypted. The data is generated by a check algorithm including one of the following:

1. Cyclic Redundancy Code (CRC) algorithm;

2. Abstract algorithm (Message-Digest Algorithm);

3. Message authentication code algorithm;

4. Secure Hash Standard algorithm.

And, after the server (4) decrypts the encrypted data, the server (4) uses the same verification algorithm to detect whether the data has been tampered with.

Further, the power-on password protection encryption authentication device (1) can also be used without being stolen, that is, the main chip (101) of the encryption authentication device (1) is further provided with a power-on password, each time before using the encryption authentication device (1). The user must enter the correct power-on password through the keyboard (102) in order to perform various operations using the encrypted authentication device (1). In this specification, the server (4) refers to various types of computer hosts for users to log in, and the server (4) may be an account server of each financial institution, or a bank account system server, or any computer that needs to verify the legality of the user's identity, etc. The terminal device (2) refers to a terminal device connected to the server (4), and may be a terminal device that requires an authenticated user identity, such as a computer, or a computer terminal, or an ATM machine, by the encryption authentication device of the present invention (1) ), the validity of the user identity of the login server (4) can be reliably verified.

Continuing to refer to FIG. 6, the following steps are included, which are steps for authenticating by the encrypted authentication device (1) when the user logs in to the server (4), and the specific steps are as follows:

1. The user uses the terminal (2) to connect to the server (4) via the network (3), enters the account password and other data on the keyboard (102) of the encryption authentication device (1), and encrypts the master in the authentication device (1). The chip (101) calculates the authentication data including the verification data by using a predetermined verification algorithm by the data and device number (105) input by the user, and then extracts an unused key (Α) in the main chip (101). The authentication data is encrypted into ciphertext, and the index number (C) corresponding to the key (Α) is extracted, and the master chip (101) encrypts the authentication data and deletes or discards or marks the key (Α) as use;

2. Encryption authentication device (1) Display the ciphertext together with the index number (C) to the user through the display (103), and then the user enters the login name and the density displayed on the display (103) on the terminal (2). Information such as text content and index number (C);

Or

The user enters the login name on the terminal (2), then connects the communication interface (104) of the encrypted authentication device (1) with the terminal (2), and transmits the ciphertext along with the index number (C) via the communication interface (104). To the terminal (2); 3. The terminal (2) transmits the login name, ciphertext and index number (C) to the server (4) via the network (3);

4. The server (4) finds the user's authentication account (401) from the login name, and extracts the key (B) corresponding to the index number (C) from the authentication account (401) from the index number (C). The decryption restores the authentication data, and the server (4) decrypts the ciphertext and deletes or discards the key (B) as used, and verifies the authentication data and restores the device number through a predetermined verification algorithm (105). ) and account password and other information, after verifying that the authentication data has not been tampered with, the server (4) check device number (105) and account password and other information is correct, indicating that the user's identity authentication is successful, then the server (4) passed The network (3) sends a message to the terminal (2) notifying the user that the server has been successfully logged in (4).

In the step of the embodiment, in order to facilitate the user to view the content displayed on the display screen (103), the ciphertext can be displayed on the display screen (103) together with the index number (C) in a group of four characters. Separated by a space or "-" between the character group and the character group, it is convenient for the user to view the display content, which can reduce the user's mistake due to the wrong content.

The encryption authentication device (1) and the authentication method of the invention are safe and reliable, and the user can input important data through the keyboard (102) on the encryption authentication device (1), even if the hacker uses the Trojan horse program to invade the user's computer, the user can only steal the user at most. In the data entered on the computer keyboard, the hacker is unable to steal important data entered by the user in the encrypted authentication device (1). The implementation of the present invention will bring about great social benefits.

Claims

Rights request

An encryption authentication apparatus for identity authentication, characterized in that the encryption authentication apparatus

The main structure of (1) includes a main chip (101), a keyboard (102), a display screen (103), and a communication interface (104), wherein the main chip (101) is provided with a CPU and a memory, and other components. Connected, operating according to a predetermined program, realizing the identity of the authenticated user in the server (4) and various predetermined functions, including reading user input data, storing data, encrypting data through the keyboard (102), and displaying through the display screen (103) Prompt message, via communication interface

(104) Send authentication information to the server (4);

as well as,

The encryption authentication device (1) encrypts the data by the key (A) by the data input by the user through the keyboard (102), including the user password, the operation instruction, the account number, and the like, and then passes through the terminal (2) and the network (3). ) is transmitted to the server (4), and the server (4) decrypts the data using the paired key (B) to restore the data input by the user, and checks the data content, and after verifying, the user's identity authentication succeeds, and then the server (4) The corresponding operation will be carried out according to the data content.

2. The cryptographic authentication apparatus according to claim 1, wherein said main chip (101) further comprises a unique device number (105) and a plurality of keys (A) and a plurality of index numbers. (C), each index number (C) corresponds to a key (A), and each index number (C) is different from each other.

3. The cryptographic authentication device according to claim 2, wherein each time the main chip (101) encrypts the data, an unused key is extracted from the main chip (101) according to a predetermined program. (A) Encrypt the data, and after the main chip (101) encrypts the data, the key (A) is deleted or discarded or marked as used, so that the key (A) will not be used again. The main chip (101) is used.

4. The encryption authentication device according to claim 1, wherein the main chip (101) further has a power-on password, and the user must pass the keyboard (102) before using the encryption authentication device (1) each time. Enter the correct power-on password to use the encrypted authentication device (1) for each operation.

The cryptographic authentication apparatus according to claim 1 or 2 or 3 or 4, wherein when said main chip (101) encrypts data, an encryption algorithm including one of the following may be employed:

1. Data Encryption Standard (DES);

2. Triple Data Encryption Standard (Triple - DES);

3. RSA encryption algorithm (RSA algorithm);

4. One Time Pad;

5. Public Key Infrastructure (PKI).

The cryptographic authentication device according to claim 1 or 2 or 3 or 4, wherein before the main chip (101) encrypts the data, the encrypted data content further includes verification data to ensure The information will not be tampered with.

7. The cryptographic authentication device of claim 6, wherein the verification data is generated by the encrypted data by a verification algorithm comprising one of:

1. Cyclic Redundancy Code (CRC) algorithm;

2. Abstract algorithm (Message-Digest Algorithm);

3. Message authentication code algorithm;

4. Secure Hash Standard algorithm.

8. The cryptographic authentication device of claim 1, wherein the communication interface (104) can be a wireless communication device, or a wired communication device, or a Bluetooth device, or an infrared device, or a USB interface, or SD memory card interface, or MINI-SD memory card interface, or wake up C memory card, or RS-MMC memory card interface, or RS-232 interface, or PS2 keyboard interface.

9. An encrypted authentication telecommunications system for user identity authentication, in particular for the financial industry, comprising an encryption authentication device (1) according to claims 1-8, and a terminal (2), network (3) And a server (4), wherein the encryption authentication device (1) is independent of the terminal (2) and is disposed separately from the terminal (2), wherein each encryption authentication device (1) in the system is in the server (4) Registered and identified by the server (4), respectively, a paired key (A, B) is provided in the encrypted authentication device (1) and the server (4), and the encryption process is performed in the encrypted authentication device (1). The ciphertext is formed by using the key (A), transmitted to the server (4) via the terminal (2) and the network (3), and the server (4) decrypts the ciphertext by using the paired key (B), and the decryption succeeds to identify Upon success, the system enters a later predetermined procedure.

10. The encrypted authentication telecommunications system according to claim 9, wherein said server (4) is provided with a plurality of authentication accounts (401), and each authentication account (401) corresponds to an encrypted authentication. In the device (1), the authentication account (401) stores the device number (105) of the encrypted authentication device (1) corresponding to the account and an account password, and each authentication account (401) stores multiple keys ( B) and a plurality of index numbers (C), each index number (C) corresponding to a key (B),

as well as,

The key (B) in each authentication account (401) is paired with the key (A) in the encrypted authentication device (1) of the account, and each key (B) has a matching key ( A), each pair of paired key (A) and key (B) their corresponding index number (C) is the same.

11. The cryptographic authentication telecommunications system according to claim 9, wherein the server (4) extracts a pair of the data from the authentication account (401) according to a predetermined procedure each time the server decrypts the data. The key (B) decrypts the data, and after the server (4) decrypts the data, the key (B) is deleted or discarded or marked as used, so that the key (B) does not Used again by the server (4).

An encryption authentication method, using the encryption authentication device according to any one of claims 1 to 10, for identity authentication or the like, characterized in that the method comprises the user logging in to the server using the terminal (2) (4), the user enters the account authentication password (1) into the data to be authenticated, such as the account password, and the encrypted authentication device (1) encrypts the data to be authenticated into the ciphertext, and then passes through the network through the terminal (2). (3) Transfer the ciphertext to the service (4), the server (4) decrypts the ciphertext to restore the data to be authenticated, and the server (4) checks that the information to be authenticated is correct, the user's identity is successfully authenticated, and the server can be logged in (4).

The encryption authentication method according to claim 12, which is used for identity authentication or the like, wherein the method comprises the following steps: when the user logs in to the server (4), the encryption authentication device (1) performs The steps for certification, the specific steps are as follows:

1. The user uses the terminal (2) to connect to the server (4) via the network (3), and enters the account password and other data on the keyboard (102) of the encryption authentication device (1) to encrypt the master in the authentication device (1). The chip (101) calculates the authentication data including the verification data by using a predetermined verification algorithm by the data and device number (105) input by the user, and then extracts an unused key (A) in the main chip (101). The authentication data is encrypted into ciphertext, and the index number (C) corresponding to the key (A) is extracted, and the master chip (101) encrypts the authentication data and deletes or discards or marks the key (A) as use;

2. Encryption authentication device (1) Display the cipher text together with the index number (C) to the user through the display (103), and then the user enters the login name and the density displayed on the display (103) on the terminal (2). Information such as text content and index number (C);

Or

The user enters the login name on the terminal (2), and then connects the communication interface (104) of the encrypted authentication device (1) with the terminal (2), and transmits the ciphertext along with the index number (C) through the communication interface (104). To the terminal (2);

3. The terminal (2) transmits the login name, ciphertext and index number (C) to the server (4) via the network (3);

4. The server (4) finds the user's authentication account (401) from the login name, extracts the key corresponding to the index number (C) from the authentication account (401) from the index number (C), and decrypts the ciphertext. After the authentication data is restored, the server (4) decrypts the ciphertext and deletes or discards the key (B) as used, and verifies the authentication data and restores the device number through a predetermined verification algorithm (105) And the account password and other information, after verifying that the authentication data has not been tampered with, the server (4) check the device number (105) and account password and other information is correct, indicating that the user's identity authentication is successful, then the server (4) through the network (3) Send a message to the terminal (2) notifying the user that the server has been successfully logged in (4).