WO2013152540A1 - 用于密码验证的用户终端、密码交易终端、系统和方法 - Google Patents

用于密码验证的用户终端、密码交易终端、系统和方法 Download PDF

Info

Publication number
WO2013152540A1
WO2013152540A1 PCT/CN2012/075342 CN2012075342W WO2013152540A1 WO 2013152540 A1 WO2013152540 A1 WO 2013152540A1 CN 2012075342 W CN2012075342 W CN 2012075342W WO 2013152540 A1 WO2013152540 A1 WO 2013152540A1
Authority
WO
WIPO (PCT)
Prior art keywords
password
near field
field communication
module
transaction terminal
Prior art date
Application number
PCT/CN2012/075342
Other languages
English (en)
French (fr)
Inventor
杨杰
傅启洪
范勇
魏攀
赵栋
朱渊
张芝萍
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP12874343.2A priority Critical patent/EP2824953A4/en
Priority to US14/391,789 priority patent/US9722994B2/en
Publication of WO2013152540A1 publication Critical patent/WO2013152540A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G06F21/35—User authentication involving the use of external additional devices, e.g. dongles or smart cards communicating wirelessly
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/327—Short range or proximity payments by means of M-devices
    • G06Q20/3278—RFID or NFC payments by means of M-devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4012—Verifying personal identification numbers [PIN]
    • H04B5/77—
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0492—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload by using a location-limited connection, e.g. near-field communication or limited proximity of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0846—Network architectures or network communication protocols for network security for authentication of entities using passwords using time-dependent-passwords, e.g. periodically changing passwords

Definitions

  • the present invention relates to the field of cryptographic authentication, and more particularly to user terminals, cryptographic exchange terminals, systems and methods for cryptographic authentication.
  • NFC Near Field Communication
  • the near field communication module can be simulated as a non-contact IC card with the underlying IS014443 A or IS014443 B standard for data interaction with an external reader.
  • the near field communication module can be modeled as a non-contact IC card reader with the underlying IS014443 A or IS015693 standard, which can read non-contact IC cards that support these standards.
  • the near field communication mobile phone can establish a close communication link with the same device with near field communication capability, and exchange information and exchange data.
  • the current user password authentication method is usually a password input directly in the password input device provided by the service provider. Since the password input device is open to the public, it is easy for the illegal elements to install the invisible camera or the secret device, which brings hidden dangers to the public's password security. At the same time, the password is also easily exposed to the criminals due to the password typing.
  • the invention provides a password authentication user terminal, a password transaction terminal, a system and a method, to solve the technical problem of how to ensure password security.
  • the present invention provides a user terminal for password verification, where the user terminal includes a password generation module and a first near field communication module, where
  • the password generation module is set to: generate a password
  • the first near field communication module is configured to: convert the generated password into near field communication tag data
  • the near field communication is sent to the password transaction terminal.
  • the system further includes a first password management module
  • the password generating module is further configured to: after generating the password, send a trigger signal to the first password management module;
  • the first password management module is configured to: set a valid time of the password and start timing under the trigger of the password generation module, and after the valid time arrives, detect whether the first near field communication module completes the near field Transmitting the communication tag data, if the first near field communication module does not complete the transmission of the near field communication tag data within the valid time, notifying the first near field communication module to delete the transmission to the cryptographic transaction terminal Data, and triggering the password generation module to regenerate the password.
  • the first password management module is further configured to: when detecting that the first near field communication module completes sending the near field communication tag data after the valid time arrives, determining whether the password generating module stores the generated Password, if the generated password is stored, the stored password is deleted.
  • the present invention further provides a password transaction terminal for password verification, the password transaction terminal includes a second near field communication module and a password authentication module, wherein the second near field communication module is configured to: The near field communication tag data sent by the user terminal through the near field communication is restored to a password and sent to the password authentication module;
  • the password authentication module is configured to: verify the validity of the data from the second near field communication module.
  • the password transaction terminal further includes a second password management module,
  • the second password management module is configured to: after obtaining the verification that the password authentication module completes the verification, delete the verified password stored in the password authentication module.
  • the present invention also provides a password verification system, where the system includes a user terminal and a password transaction terminal, wherein
  • the user terminal uses the user terminal as described above;
  • the cryptographic transaction terminal uses the cryptographic transaction terminal as described above.
  • the present invention further provides a password verification method, which is used for a user terminal, and the method includes:
  • the generated password is converted to near field communication tag data and sent to the cryptographic transaction terminal through near field communication.
  • the method further includes:
  • the method further includes:
  • the stored password is deleted.
  • the converting the generated password into the near field communication tag data and transmitting the password to the password transaction terminal through the near field communication further includes:
  • the present invention further provides a password verification method, which is used for a password transaction terminal, and the method includes:
  • the method further includes:
  • the present invention further provides a password verification method, which is used for a user terminal and a password transaction terminal, and the method includes:
  • the user terminal performs password verification using the method as described above;
  • the cryptographic transaction terminal performs password verification using the method described above.
  • the above technical solution transmits the password to the password transaction terminal through the near field communication, and the password is transparent to the outside world, which greatly reduces the risk of the password being stolen; and the device that generates the password is the user terminal itself, which can avoid the password generation device due to the lawless person.
  • FIG. 1 is a structural block diagram of a user terminal for a password 3 full certificate according to the embodiment
  • FIG. 2 is a component block diagram of a cryptographic transaction terminal for a password insurance certificate according to the embodiment
  • FIG. 3 is a flowchart of a method for performing password verification by a user terminal according to the embodiment
  • FIG. 4 is a flowchart of a method for performing password verification by the password transaction terminal of the embodiment.
  • FIG. 1 is a structural block diagram of a user terminal for a password 3 full certificate according to the embodiment.
  • the user terminal includes a password generating module and a first near field communication module, where
  • a password generating module configured to generate a password
  • the password generation module may have a human-computer interaction (UI) interface, a numeric keypad for the user to input a password, a screen for displaying the operation guidance information, and the like;
  • UI human-computer interaction
  • the first near field communication module is configured to convert the generated password into near field communication tag data and send the message to the password transaction terminal through near field communication.
  • the first near field communication module may be composed of a first tag conversion submodule and a first communication submodule, wherein:
  • a first label conversion submodule configured to convert a password from the password input submodule into near field communication tag data, and send the near field communication tag data to the first communication submodule;
  • the first communication submodule is configured to send the near field communication tag data to the password transaction terminal by using near field communication.
  • the user terminal may further include a first password management module
  • the password generating module is configured to send a trigger signal to the first password management module after generating the password
  • a first password management module configured to set a valid time of the password and start timing under the trigger of the password generating module, and after the valid time arrives, detect whether the first near field communication module completes the near field communication label Sending data, if the first near field communication module does not complete the transmission of the near field communication tag data within the valid time, notifying the first near field communication module to delete the data not sent to the password transaction terminal, And triggering the password generation module to regenerate the password.
  • the first password management module may be further configured to: when detecting that the first near field communication module completes sending the near field communication tag data after the valid time arrives, determining whether the password generating module stores the generated password, if Store the generated password and delete the stored password.
  • the first password management module can prevent the user from being stolen and used by others for a long time by setting the effective time of the password, thereby causing password security problems.
  • the application terminal includes a password generation module, a first near field communication module, and a first password management module.
  • the first near field communication module further includes a first label conversion submodule and a first communication submodule.
  • the password generating module is configured to display the “enter password” information to the user through the UI interface; after receiving the password input by the user, wait for the user to issue a “send” command through the UI interface, and wait to receive the “send” sent by the user through the UI interface. After the command, the user is displayed with the "close to the password transaction terminal" information through the user UI interface; and the received user input password is sent to the first label conversion.
  • a sub-module simultaneously sending a trigger signal to the first password management module; after receiving the trigger signal from the first password management module, displaying a "re-enter password” information to the user through the UI interface, waiting for receiving a password input by the user;
  • a first label conversion submodule configured to convert a password from the password generation module into near field communication label data suitable for near field communication transmission, and send the label data to the first communication submodule
  • the first communication sub a module, configured to establish a near field communication connection with the password transaction terminal, and send the near field communication tag data to the password transaction terminal through the connection;
  • the first password management module is configured to: after receiving the trigger signal from the password input sub-module, set the valid time of the password to 5 seconds and start timing, and after 5 seconds, detect whether the first communication sub-module completes the near-field Transmitting the communication tag data, if it is detected that the first communication sub-module does not complete the transmission of the near field communication tag data, notifying the first communication sub-module to delete the near field communication tag data, and triggering the password generation module to regenerate the password;
  • the first communication sub-module detects that the near field communication tag data is sent, determines whether the password input sub-module stores the password input by the user through the UI interface, and if the password input sub-module stores the password input by the user through the UI interface, deleting the password Stored password;
  • FIG. 2 is a structural block diagram of a password transaction terminal for a password insurance certificate according to the embodiment.
  • the cryptographic transaction terminal includes a second near field communication module and a password authentication module, wherein the second near field communication module is configured to restore the near field communication tag data sent by the user terminal through the near field communication to a password, and then send the Password authentication module;
  • the second near field communication module may be composed of a second tag conversion submodule and a second communication submodule, wherein
  • a second communication submodule configured to receive near field communication tag data sent by the user terminal through the near field communication, and send the near field communication tag data to the second tag conversion submodule;
  • a second label conversion submodule configured to restore the near field communication label data to a password, and send the password to the password authentication module.
  • a password authentication module configured to verify validity of data from the second near field communication module; the password authentication module can perform mutual authentication through a remote server connected to the password transaction terminal The validity of the data from the second near field communication module.
  • the password transaction terminal may further include a second password management module, configured to delete the verified password stored in the password authentication module after the password authentication submodule is verified to be verified.
  • the password after verification is deleted, that is, the password trace is cleared, which further ensures the security of the password.
  • the embodiment also provides a system for password verification, the system includes a user terminal and a password transaction terminal, wherein the user terminal can use the user terminal described in the above embodiment, and the composition is shown in FIG. 1; the password transaction terminal can be The cryptographic transaction terminal described in the above embodiment is used, and the composition is shown in FIG. 2.
  • FIG. 3 is a flowchart of a method for performing password verification by a user terminal according to an embodiment of the present invention.
  • S302 converts the generated password into near field communication tag data, and sends the data to the password transaction terminal through near field communication;
  • Step S302 can include:
  • the valid time of the password may also be set and start timing. After the valid time arrives, it is detected whether the transmission of the near field communication tag data is completed; The transmission of the near field communication tag data is not completed, the data not transmitted to the password transaction terminal is deleted, and step S301 is re-executed.
  • the transmission of the near field communication tag data is completed after the expiration of the valid time, it is determined whether the password is stored after the password is generated, and if the password is stored, the stored password is deleted.
  • FIG. 4 is a flowchart of a method for performing password verification by the password transaction terminal of the embodiment.
  • S402 verifies the validity of the password.
  • the verified password is deleted and the password trace is cleared.
  • the embodiment further provides a password verification method for the user terminal and the password transaction terminal.
  • the user terminal can perform password verification using the password verification method described in the above embodiment, and the password transaction terminal can use the above implementation.
  • the password verification method described in the example performs password verification, and is not described here.
  • each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may use software functions.
  • the form of the module is implemented. The invention is not limited to any specific form of combination of hardware and software.
  • the above technical solution transmits the password to the password transaction terminal through near field communication, and the password is transparent to the outside world, which greatly reduces the risk of the password being stolen; at the same time, the device generating the password is the user terminal itself, which can avoid the illegal molecular pair.
  • the password generation device creates a password leak caused by the installation of the stealing device.

Abstract

一种用于密码验证的用户终端、密码交易终端、系统和方法，其中，用户终端包括密码生成模块以及第一近场通讯模块，所述密码生成模块设置为：产生密码；所述第一近场通讯模块设置为：将产生的密码转换为近场通讯标签数据后通过近场通讯向密码交易终端发送。本申请有效地保证了密码验证过程中的密码安全。

Description

用于密码验证的用户终端、 密码交易终端、 系统和方法
技术领域
本发明涉及密码验证领域， 尤其涉及用于密码验证的用户终端、 密码交 易终端、 系统和方法。
背景技术
近场通讯 ( Near Field Communication, NFC )是一种短巨离无线通讯技术， 具有快速， 安全， 简单的特点。 NFC具有 3种工作模式， 包括 NFC卡模拟模 式、 读 /写模式、 Peer-to-Peer通讯模式。 NFC卡模拟模式下， 近场通讯模块可 以模拟成一张底层兼容 IS014443 A或 IS014443 B标准的非接触式 IC卡，与 外部阅读器进行数据交互。 读 /写模式下， 近场通信模块可以模拟成一个底层 兼容 IS014443 A或 IS015693标准的非接触式 IC卡阅读器，可以读取支持这 些标准的非接触式 IC卡。 Peer-to-Peer通讯模式下， 近场通信手机可以和同 样具有近场通信能力的设备建立近距离通信链路， 进行信息交换和数据交换 等。
由于目前用户进行密码验证的方式通常是在服务提供商提供的密码输入 设备中直接进行密码输入。 由于密码输入设备对公众开放， 因此很容易被不 法分子安装隐形摄像头或盗密装置， 为公众的密码安全带来隐患； 同时， 由 于密码现场键入， 密码也易暴露给不法分子。
发明内容
本发明提供了一种密码验证的用户终端、 密码交易终端、 系统和方法， 以解决如何保证密码安全的技术问题。
为解决上述技术问题， 本发明提供了一种用于密码验证的用户终端， 所 述用户终端包括密码生成模块以及第一近场通讯模块， 其中，
密码生成模块设置为： 产生密码；
第一近场通讯模块设置为： 将产生的密码转换为近场通讯标签数据后通 过近场通讯向密码交易终端发送。
优选地， 所述系统还包括第一密码管理模块；
所述密码生成模块还设置为： 在产生密码后， 向所述第一密码管理模块 发送触发信号；
所述第一密码管理模块设置为： 在所述密码生成模块的触发下， 设置所 述密码的有效时间并开始计时， 并在有效时间到达后， 检测第一近场通讯模 块是否完成对近场通讯标签数据的发送， 若在有效时间内所述第一近场通讯 模块没有完成对近场通讯标签数据的发送， 则通知所述第一近场通讯模块删 除未向所述密码交易终端发送的数据， 并触发所述密码生成模块重新产生密 码。
优选地， 所述第一密码管理模块还设置为： 当有效时间到达后检测到所 述第一近场通讯模块完成对近场通讯标签数据的发送时， 判断所述密码生成 模块是否存储产生的密码， 若存储产生的密码， 则删除该存储的密码。
为解决上述技术问题， 本发明还提供了一种用于密码验证的密码交易终 端， 所述密码交易终端包括第二近场通讯模块以及密码认证模块， 其中， 第二近场通讯模块设置为： 将用户终端通过近场通讯发来的近场通讯标 签数据还原为密码后发送至所述密码认证模块；
密码认证模块设置为： 验证来自第二近场通讯模块的数据的有效性。 优选地， 所述密码交易终端还包括第二密码管理模块，
第二密码管理模块设置为： 在获知所述密码认证模块完成验证后， 删除 所述密码认证模块中存储的验证后的密码。
为解决上述技术问题， 本发明还提供了一种密码验证系统， 所述系统包 括用户终端和密码交易终端， 其中，
所述用户终端釆用如上所述的用户终端；
所述密码交易终端釆用如上所述的密码交易终端。 为解决上述技术问题， 本发明还提供了一种密码验证方法， 用于用户终 端， 所述方法包括：
产生密码；
将生成的密码转换为近场通讯标签数据后通过近场通讯向密码交易终端 发送。
优选地， 所述方法还包括：
在所述产生密码后， 设置所述密码的有效时间并开始计时， 在所述有效 时间到达后， 检测是否完成对所述近场通讯标签数据的发送； 若在有效时间 内没有完成对近场通讯标签数据的发送， 删除未向所述密码交易终端发送的 数据， 并重新产生密码。
优选地， 所述方法还包括：
若当有效时间到达后检测到完成了对所述近场通讯标签数据的发送， 继 续判断产生密码后是否存储了所述密码；
若产生密码后存储了所述密码， 删除存储的密码。
优选地， 所述将生成的密码转换为近场通讯标签数据后通过近场通讯向 密码交易终端发送还包括：
将来自密码输入子模块的密码转换成近场通讯标签数据；
将所述近场通讯标签数据通过近场通讯向所述密码交易终端发送。
为解决上述技术问题， 本发明还提供了一种密码验证方法， 用于密码交 易终端， 所述方法包括：
验证所述密码的有效性。
优选地， 所述方法还包括：
在验证所述密码的有效性后， 删除验证后的密码。 为解决上述技术问题， 本发明还提供了一种密码验证方法， 用于用户终 端和密码交易终端， 所述方法包括：
所述用户终端釆用如上所述的方法进行密码验证；
所述密码交易终端釆用如上所述的方法进行密码验证。
上述技术方案， 将密码通过近场通讯传输给密码交易终端， 密码对外界 透明， 极大地减低了密码被窃取的风险； 同时产生密码的设备为用户终端本 身， 可避免因不法分子对密码产生设备安装窃取装置而造成的密码泄露。 附图概述
图 1为本实施例的用于密码 3全证的用户终端的组成模块图；
图 2为本实施例的用于密码险证的密码交易终端的组成模块图； 图 3为本实施例的用户终端进行密码验证的方法流程图；
图 4为本实施例的密码交易终端进行密码验证的方法流程图。
本发明的较佳实施方式
为使本发明的目的、 技术方案和优点更加清楚明白， 下文中将结合附图 对本发明的实施例进行详细说明。 需要说明的是， 在不冲突的情况下， 本申 请中的实施例及实施例中的特征可以相互任意组合。
图 1为本实施例的用于密码 3全证的用户终端的组成模块图。
该用户终端包括密码生成模块以及第一近场通讯模块， 其中，
密码生成模块， 用于产生密码；
密码生成模块可具有人机交互的用户 （UI )界面， 提供供用户输入密码 的数字键盘、 显示操作引导信息的屏幕等；
第一近场通讯模块， 用于将产生的密码转换为近场通讯标签数据后通过 近场通讯向密码交易终端发送。 第一近场通讯模块可由第一标签转换子模块和第一通信子模块组成， 其 中：
第一标签转换子模块， 用于将来自密码输入子模块的密码转换成近场通 讯标签数据， 并该近场通讯标签数据发送至所述第一通信子模块；
第一通信子模块， 用于将该近场通讯标签数据通过近场通讯向所述密码 交易终端发送。
在其他实施例中， 用户终端还可包括第一密码管理模块；
此时， 密码生成模块， 用于在产生密码后， 向所述第一密码管理模块发 送触发信号；
第一密码管理模块， 用于在所述密码生成模块的触发下， 设置所述密码 的有效时间并开始计时， 并在有效时间到达后， 检测第一近场通讯模块是否 完成对近场通讯标签数据的发送， 若在有效时间内所述第一近场通讯模块没 有完成对近场通讯标签数据的发送， 则通知所述第一近场通讯模块删除未向 所述密码交易终端发送的数据， 并触发所述密码生成模块重新产生密码。
所述第一密码管理模块， 还可用于当有效时间到达后检测到所述第一近 场通讯模块完成对近场通讯标签数据的发送时， 判断所述密码生成模块是否 存储产生的密码， 若存储产生的密码， 则删除该存储的密码。
上述第一密码管理模块通过设置密码的有效时间， 避免用户长期有效而 被他人窃取使用， 造成密码安全问题。
下面以一个具体的应用示例来对上述应用终端的功能模块进行进一步详 细的描述。
该应用终端包括密码生成模块、第一近场通讯模块和第一密码管理模块； 第一近场通讯模块又包括第一标签转换子模块和第一通信子模块。
密码生成模块， 用于通过其 UI界面向用户显示 "输入密码"信息； 待接 收到用户输入的密码后， 等待用户通过 UI界面下达 "发送"命令， 待接收到 用户通过 UI界面下达的 "发送" 命令后， 通过用户 UI界面向用户显示 "靠 近密码交易终端" 信息； 以及将接收到的用户输入密码发送至第一标签转换 子模块， 同时向所述第一密码管理模块发送触发信号； 在接收到来自第一密 码管理模块的触发信号后， 通过 UI界面向用户显示 "重新输入密码" 信息， 等待接收用户输入的密码；
第一标签转换子模块， 用于将来自密码生成模块的密码转换为适于近场 通讯传输的近场通讯标签数据，并将该标签数据发送至所述第一通信子模块； 第一通信子模块， 用于与密码交易终端建立近场通讯连接， 通过该连接 向密码交易终端发送近场通讯标签数据；
第一密码管理模块， 用于接收到来自密码输入子模块的触发信号后， 设 置所述密码的有效时间为 5秒并开始计时， 经过 5秒后， 检测第一通信子模 块是否完成对近场通讯标签数据的发送， 若检测到第一通信子模块没有完成 对近场通讯标签数据的发送， 通知第一通信子模块删除近场通讯标签数据， 并触发所述密码生成模块重新产生密码； 若检测到第一通信子模块完成对近 场通讯标签数据的发送，判断密码输入子模块是否存储了用户通过 UI界面输 入的密码， 若密码输入子模块存储了用户通过 UI界面输入的密码， 删除该存 储的密码；
图 2为本实施例的用于密码险证的密码交易终端的组成模块图。
该密码交易终端包括第二近场通讯模块以及密码认证模块， 其中， 第二近场通讯模块， 用于将用户终端通过近场通讯发来的近场通讯标签 数据还原为密码后发送至所述密码认证模块；
第二近场通讯模块可由第二标签转换子模块和第二通信子模块组成， 其 中，
第二通信子模块， 用于接收来自用户终端通过近场通讯发来的近场通讯 标签数据， 并将该近场通讯标签数据发送至所述第二标签转换子模块；
第二标签转换子模块， 用于将所述近场通讯标签数据还原为密码， 将所 述密码发送至所述密码认证模块。
密码认证模块， 用于验证来自第二近场通讯模块的数据的有效性； 密码认证模块可通过与密码交易终端相连的远端服务器进行交互验证来 自第二近场通讯模块的数据的有效性。
在其他实施例中， 密码交易终端还可包括第二密码管理模块， 用于在获 知所述密码认证子模块完成验证后， 删除所述密码认证模块中存储的验证后 的密码。 删除验证后的密码， 即清除密码痕迹， 进一步保证了密码的安全。
本实施例还提供了一个用于密码验证的系统， 该系统包括用户终端和密 码交易终端， 其中用户终端可釆用上述实施例记载的用户终端， 组成结构见 图 1所示； 密码交易终端可釆用上述实施例记载的密码交易终端， 组成结构 见图 2所示。
图 3为本实施例的用户终端进行密码验证的方法流程图。
S301产生密码；
S302将生成的密码转换为近场通讯标签数据后通过近场通讯向密码交易 终端发送；
步骤 S302可包括：
将来自密码输入子模块的密码转换成近场通讯标签数据；
将所述近场通讯标签数据通过近场通讯向所述密码交易终端发送。
在其他实施例中， 产生密码后， 还可设置所述密码的有效时间并开始计 时， 在所述有效时间到达后，检测是否完成对所述近场通讯标签数据的发送； 若在有效时间内没有完成对近场通讯标签数据的发送， 删除未向所述密码交 易终端发送的数据， 并重新执行步骤 S301。
若在有效时间到达后， 检测出完成了对所述近场通讯标签数据的发送， 继续判断产生密码后是否存储了所述密码， 若产生密码后存储了所述密码， 删除存储的密码。
图 4为本实施例的密码交易终端进行密码验证的方法流程图。 S402验证所述密码的有效性。
为进一步确保密码的安全， 可在验证所述密码的有效性后， 删除验证后 的密码， 清除密码痕迹。
本实施例还提供了一种用于用户终端和密码交易终端的密码验证方法， 该方法中， 用户终端可釆用上述实施例记载的密码验证方法进行密码验证， 密码交易终端可釆用上述实施例记载的密码验证方法进行密码验证， 此处不 再累述。
本领域普通技术人员可以理解上述方法中的全部或部分步骤可通过程序 来指令相关硬件完成， 所述程序可以存储于计算机可读存储介质中， 如只读 存储器、 磁盘或光盘等。 可选地， 上述实施例的全部或部分步骤也可以使用 一个或多个集成电路来实现， 相应地， 上述实施例中的各模块 /单元可以釆用 硬件的形式实现， 也可以釆用软件功能模块的形式实现。 本发明不限制于任 何特定形式的硬件和软件的结合。
需要说明的是， 本发明还可有其他多种实施例， 在不背离本发明精神及 和变形， 但这些相应的改变和变形都应属于本发明所附的权利要求的保护范 围。
工业实用性 上述技术方案， 将密码通过近场通讯传输给密码交易终端， 密码对外界 透明， 极大地减低了密码被窃取的风险； 同时产生密码的设备为用户终端本 身， 可避免因不法分子对密码产生设备安装窃取装置而造成的密码泄露。

Claims

权 利 要 求 书
1、 一种用于密码验证的用户终端， 所述用户终端包括密码生成模块以 及第一近场通讯模块， 其中，
所述密码生成模块设置为： 产生密码；
所述第一近场通讯模块设置为： 将产生的密码转换为近场通讯标签数据 后通过近场通讯向密码交易终端发送。
2、 如权利要求 1 所述的用户终端， 其中， 所述系统还包括第一密码管 理模块；
所述密码生成模块还设置为： 在产生密码后， 向所述第一密码管理模块 发送触发信号；
所述第一密码管理模块设置为： 在所述密码生成模块的触发下， 设置所 述密码的有效时间并开始计时， 并在有效时间到达后， 检测第一近场通讯模 块是否完成对近场通讯标签数据的发送， 若在有效时间内所述第一近场通讯 模块没有完成对近场通讯标签数据的发送， 则通知所述第一近场通讯模块删 除未向所述密码交易终端发送的数据， 并触发所述密码生成模块重新产生密 码。
3、 如权利要求 2所述的用户终端， 其中，
所述第一密码管理模块还设置为： 当有效时间到达后检测到所述第一近 场通讯模块完成对近场通讯标签数据的发送时， 判断所述密码生成模块是否 存储产生的密码， 若存储产生的密码， 则删除该存储的密码。
4、 一种用于密码验证的密码交易终端， 所述密码交易终端包括第二近场 通讯模块以及密码认证模块， 其中，
所述第二近场通讯模块设置为： 将用户终端通过近场通讯发来的近场通 讯标签数据还原为密码后发送至所述密码认证模块；
所述密码认证模块设置为：验证来自第二近场通讯模块的数据的有效性。
5、 如权利要求 4所述的密码交易终端， 其中， 所述密码交易终端还包括 第二密码管理模块， 所述第二密码管理模块设置为： 在获知所述密码认证模块完成验证后， 删除所述密码认证模块中存储的验证后的密码。
6、 一种密码验证系统， 所述系统包括用户终端和密码交易终端， 其中， 所述用户终端釆用如权利要求 1~3中任一项所述的用户终端；
所述密码交易终端釆用如权利要求 4~5中任一项所述的密码交易终端。
7、 一种密码验证方法， 用于用户终端， 所述方法包括：
产生密码；
将生成的密码转换为近场通讯标签数据后通过近场通讯向密码交易终端 发送。
8、 如权利要求 7所述的方法， 其中， 所述方法还包括：
在所述产生密码后， 设置所述密码的有效时间并开始计时， 在所述有效 时间到达后， 检测是否完成对所述近场通讯标签数据的发送； 若在有效时间 内没有完成对近场通讯标签数据的发送， 删除未向所述密码交易终端发送的 数据， 并重新产生密码。
9、 如权利要求 8所述的方法， 其中， 所述方法还包括：
若当有效时间到达后检测到完成了对所述近场通讯标签数据的发送， 继 续判断产生密码后是否存储了所述密码；
若产生密码后存储了所述密码， 删除存储的密码。
10、 如权利要求 9所述的方法， 其中，
所述将生成的密码转换为近场通讯标签数据后通过近场通讯向密码交易 终端发送还包括：
将来自密码输入子模块的密码转换成近场通讯标签数据；
将所述近场通讯标签数据通过近场通讯向所述密码交易终端发送。
11、 一种密码验证方法， 用于密码交易终端， 所述方法包括：
验证所述密码的有效性。
12、 如权利要求 11所述的方法， 其中， 所述方法还包括： 在验证所述密码的有效性后， 删除验证后的密码。
13、 一种密码验证方法， 用于用户终端和密码交易终端， 所述方法包括： 所述用户终端釆用如权利要求 7-10中任一项所述的方法进行密码验证； 所述密码交易终端釆用如权利要求 11-12 中任一项所述的方法进行密码 验证。
PCT/CN2012/075342 2012-04-12 2012-05-11 用于密码验证的用户终端、密码交易终端、系统和方法 WO2013152540A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP12874343.2A EP2824953A4 (en) 2012-04-12 2012-05-11 USER TERMINAL FOR PASSWORD BASED AUTHENTICATION AND METHOD, SYSTEM AND PASSWORD BASED TRANSACTION TERMINAL
US14/391,789 US9722994B2 (en) 2012-04-12 2012-05-11 User terminal for password-based authentication, and password-based trading terminal, system, and method

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210107171.5 2012-04-12
CN2012101071715A CN103379491A (zh) 2012-04-12 2012-04-12 用于密码验证的用户终端、密码交易终端、系统和方法

Publications (1)

Publication Number Publication Date
WO2013152540A1 true WO2013152540A1 (zh) 2013-10-17

Family

ID=49327023

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/075342 WO2013152540A1 (zh) 2012-04-12 2012-05-11 用于密码验证的用户终端、密码交易终端、系统和方法

Country Status (4)

Country Link
US (1) US9722994B2 (zh)
EP (1) EP2824953A4 (zh)
CN (1) CN103379491A (zh)
WO (1) WO2013152540A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104836780B (zh) * 2014-02-12 2017-03-15 腾讯科技（深圳）有限公司 数据交互方法、验证终端、服务器和系统
CN107038572B (zh) * 2017-04-14 2018-07-24 桂林微网互联信息技术有限公司 加密卡及其工作方法
US10742414B1 (en) 2019-10-18 2020-08-11 Capital One Services, Llc Systems and methods for data access control of secure memory using a short-range transceiver
CN113962233B (zh) * 2021-10-18 2023-10-10 珠海格力电器股份有限公司 近场通信触发方法、装置、电子设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060143706A1 (en) * 2004-12-28 2006-06-29 Hitomi Kawasaki Security control apparatus, security control method, and storage medium
CN101561953A (zh) * 2009-05-26 2009-10-21 中山大学 一种安全的atm系统及其运行方法
CN102096972A (zh) * 2009-12-15 2011-06-15 中国移动通信集团公司 一种基于用户终端完成联机支付的方法、系统及用户终端
CN102122342A (zh) * 2011-02-14 2011-07-13 惠州Tcl移动通信有限公司 一种手机密码输入方法及使用该方法的手机

Family Cites Families (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2396472A (en) * 2002-12-18 2004-06-23 Ncr Int Inc System for cash withdrawal
US20050046880A1 (en) * 2003-08-27 2005-03-03 Kyocera Mita Corporation Image forming device and image forming system
US7471199B2 (en) * 2004-01-09 2008-12-30 Intermec Ip Corp. Mobile key using read/write RFID tag
JP4664034B2 (ja) * 2004-10-15 2011-04-06 株式会社エヌ・ティ・ティ・ドコモ コンテンツ配信管理装置及びコンテンツ配信管理方法
US8209751B2 (en) * 2004-11-18 2012-06-26 Biogy, Inc. Receiving an access key
JP2007148471A (ja) * 2005-11-24 2007-06-14 Hitachi Ltd サービス通知システム
JP4983197B2 (ja) * 2006-10-19 2012-07-25 富士ゼロックス株式会社 認証システム、認証サービス提供装置、および認証サービス提供プログラム
US8812673B2 (en) * 2007-02-14 2014-08-19 Alcatel Lucent Content rate control for streaming media servers
US8068607B2 (en) * 2007-07-31 2011-11-29 Ricoh Company, Limited Information processing apparatus and information processing method
WO2009039419A1 (en) * 2007-09-21 2009-03-26 Wireless Dynamics, Inc. Wireless smart card and integrated personal area network, near field communication and contactless payment system
US8565723B2 (en) * 2007-10-17 2013-10-22 First Data Corporation Onetime passwords for mobile wallets
US8095113B2 (en) * 2007-10-17 2012-01-10 First Data Corporation Onetime passwords for smart chip cards
JP5241319B2 (ja) * 2008-05-15 2013-07-17 インターナショナル・ビジネス・マシーンズ・コーポレーション ネットワーク上に配置された構成要素についての情報を検出するためのパスワードを管理するコンピュータ・システム、並びにその方法及びコンピュータ・プログラム
MX353765B (es) * 2008-05-26 2018-01-24 Nxp Bv Disociador de medida del tiempo de respuesta de un transpondedor y su autenticacion.
JP2010015541A (ja) * 2008-06-04 2010-01-21 Fujitsu Ltd 認証システム、端末装置、パスワード発行装置及び認証方法
MX2011001931A (es) * 2008-08-20 2011-07-28 Wherepro Llc Generador de paquete de datos que genera codigos de paso.
US8949955B2 (en) * 2008-10-29 2015-02-03 Symantec Corporation Method and apparatus for mobile time-based UI for VIP
EP2182493A1 (en) * 2008-11-04 2010-05-05 Gemalto SA Remote user authentication using NFC
WO2010090533A2 (en) * 2009-01-07 2010-08-12 Resonance Holdings Limited Bluetooth authentication system and method
US8826397B2 (en) * 2009-01-15 2014-09-02 Visa International Service Association Secure remote authentication through an untrusted network
US8590022B2 (en) * 2009-02-26 2013-11-19 Blackberry Limited Authentication using a wireless mobile communication device
US8423783B2 (en) * 2009-11-27 2013-04-16 International Business Machines Corporation Secure PIN management of a user trusted device
US20110251962A1 (en) * 2010-04-13 2011-10-13 John Hruska Transaction method for secure electronic gift cards
FR2959896B1 (fr) * 2010-05-06 2014-03-21 4G Secure Procede d'authentification d'un utilisateur requerant une transaction avec un fournisseur de service
KR101719161B1 (ko) * 2010-05-13 2017-03-23 삼성전자주식회사 ＷｉＦｉ 기반의 단말기 및 그의 채널 운용 방법
US9916572B2 (en) * 2010-08-18 2018-03-13 International Business Machines Corporation Payment card processing system
US20120084210A1 (en) * 2010-09-30 2012-04-05 Arvin Farahmand Mobile device payment system
JP5754924B2 (ja) * 2010-11-29 2015-07-29 キヤノン株式会社 基地局、基地局の制御方法、プログラム
KR20120071982A (ko) * 2010-12-23 2012-07-03 주식회사 케이티 안전 결제를 위한 근거리 무선 통신 단말，및 근거리 무선 통신 단말을 이용한 안전 결제 방법
DE212012000065U1 (de) * 2011-02-25 2013-09-27 Vasco Data Security International Gmbh Ein Token für eine starke Authentisierung mit akustischer Dateneingabe
GB2488766A (en) * 2011-03-04 2012-09-12 Intercede Ltd Securely transferring data to a mobile device
US11514451B2 (en) * 2011-03-15 2022-11-29 Capital One Services, Llc Systems and methods for performing financial transactions using active authentication
US20130046697A1 (en) * 2011-03-17 2013-02-21 Suridx, Inc. Using Mobile Device to Prevent Theft of User Credentials
WO2012140249A1 (en) * 2011-04-14 2012-10-18 Yubico Ab A dual interface device for access control and a method therefor
US20120323690A1 (en) * 2011-06-15 2012-12-20 Joseph Michael Systems and methods for monitoring, managing, and facilitating location- and/or other criteria-dependent targeted communications and/or transactions
US9882734B2 (en) * 2011-08-19 2018-01-30 Ecolink Intelligent Technology Inc. Method and apparatus for network device detection
US11172363B2 (en) * 2011-10-31 2021-11-09 Ncr Corporation Techniques for automated transactions
US20130171967A1 (en) * 2012-01-04 2013-07-04 Ayman S. Ashour Providing Secure Execution of Mobile Device Workflows
US8880028B2 (en) * 2012-02-08 2014-11-04 Blackberry Limited Near field communication (NFC) accessory providing enhanced data transfer features and related methods

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060143706A1 (en) * 2004-12-28 2006-06-29 Hitomi Kawasaki Security control apparatus, security control method, and storage medium
CN101561953A (zh) * 2009-05-26 2009-10-21 中山大学 一种安全的atm系统及其运行方法
CN102096972A (zh) * 2009-12-15 2011-06-15 中国移动通信集团公司 一种基于用户终端完成联机支付的方法、系统及用户终端
CN102122342A (zh) * 2011-02-14 2011-07-13 惠州Tcl移动通信有限公司 一种手机密码输入方法及使用该方法的手机

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP2824953A4 *

Also Published As

Publication number Publication date
CN103379491A (zh) 2013-10-30
EP2824953A1 (en) 2015-01-14
US20150082403A1 (en) 2015-03-19
EP2824953A4 (en) 2015-03-25
US9722994B2 (en) 2017-08-01

Similar Documents

Publication Publication Date Title
KR102358546B1 (ko) 장치에 대해 클라이언트를 인증하기 위한 시스템 및 방법
US9510192B2 (en) Method and apparatus for securing a mobile application
KR101451214B1 (ko) 결제 방법, 이를 실행하는 결제 서버, 이를 저장한 기록 매체 및 이를 실행하는 시스템
CN103888436B (zh) 用户认证的方法和装置
CN104618315B (zh) 一种验证信息推送和信息验证的方法、装置及系统
CN103793815A (zh) 适用于银行卡和行业卡的移动智能终端收单系统及方法
JP2014529964A (ja) モバイル機器経由の安全なトランザクション処理のシステムおよび方法
CN105827656B (zh) 基于nfc支付的身份认证方法及装置
WO2018113577A1 (zh) 一种基于用户端界面联网验票的方法、系统及智能设备
CN110826043A (zh) 一种数字身份申请系统及方法、身份认证系统及方法
CN103747012A (zh) 网络交易的安全验证方法、装置及系统
JP2008544710A (ja) 暗号化を実現する方法及び装置
JP2022527798A (ja) 効率的なチャレンジ応答認証のためのシステム及び方法
CN103427999A (zh) 用户身份验证方法及系统
CN103916848A (zh) 一种移动终端数据备份和恢复的方法及系统
WO2013152540A1 (zh) 用于密码验证的用户终端、密码交易终端、系统和方法
JP2014106593A (ja) 取引認証方法、及びシステム
CN108696361B (zh) 智能卡的配置方法、生成方法及装置
CN106156677A (zh) 身份证读卡方法和系统
KR101603963B1 (ko) 지문 정보 및 인증번호를 이용한 인증 방법, 사용자 단말기 및 금융사 서버
CN107437997B (zh) 一种射频通信装置及方法
KR101294805B1 (ko) 2-채널 앱인증 방법 및 시스템
WO2018098686A1 (zh) 安全验证方法、装置、终端设备及服务器
WO2018232662A1 (zh) 一种移动终端解锁方法和移动终端
KR101879842B1 (ko) Otp를 이용한 사용자 인증 방법 및 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12874343

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2012874343

Country of ref document: EP

Ref document number: 14391789

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE