WO2015018249A1

WO2015018249A1 - Method and system for verifying identity of dynamic password token

Info

Publication number: WO2015018249A1
Application number: PCT/CN2014/081697
Authority: WO
Inventors: 李东声
Original assignee: 天地融科技股份有限公司
Priority date: 2013-08-09
Filing date: 2014-07-04
Publication date: 2015-02-12
Also published as: HK1190522A1; CN103427996B; CN103427996A

Abstract

Disclosed are a method and a system for verifying an identity of a dynamic password token. The method comprises: a dynamic password token receiving an identity verification instruction, calculating a first verification value according to first information, and outputting the first verification value, the first information at least comprising a first seed key for verifying an identity of the dynamic password token, and the first seed key being preset in the dynamic password token; and a verification apparatus corresponding to the dynamic password token obtaining the first verification value, verifying the first verification value, and outputting a verification result. In the present invention, a seed key for verifying an identity of the dynamic password token is preset in the dynamic password token, and a verification value calculated at least according to the seed key is sent to a verification apparatus for verification; if the verification value is consistent with a standard verification value calculated in the verification apparatus, the identity of the dynamic password token is valid; otherwise, the identity of the dynamic password token is invalid; in this manner, the identity of the dynamic password token is verified, and the dynamic password token is prevented from being forged.

Description

Method and system for verifying dynamic port token identity

Technical field

The present invention relates to the field of information security, and in particular, to a method and system for verifying a dynamic port token identity. Background technique

In order to ensure information security, authentication is usually performed before the operation is performed. The purpose is to give legitimate users access and to deny access to illegal users. It is a common method to perform identity authentication by whether the password is correct or not. Password authentication can be divided into static password authentication and dynamic password authentication. A dynamic password is a one-time password, and each password can only be used once. Dynamic passwords can change over time, times, and challenge information. Dynamic port tokens can be used to generate and display dynamic passwords (also known as dynamic passwords) with built-in seed keys that reference the seed key each time a dynamic password is calculated.

Synchronous dynamic port tokens currently on the market, each time a dynamic password is calculated, in addition to referencing the seed key and other static factors, it is also necessary to reference at least one automatically changing synchronization factor, such as time, event count, and the like. Since the synchronization factor is dynamically changing, the dynamic passwords obtained each time are different. The challenge response type dynamic port token, when calculating the dynamic password, refers to the synchronization factor such as time or event count in addition to the challenge information.

As can be seen from the basic working principle described above, the seed key and synchronization factor are the basic elements for calculating the dynamic password. However, the synchronization factor is predictable, especially for time-synchronized tokens. The time of the token is standard time. For event-synchronized tokens, the event count also has a specified starting value. Due to the predictability of the synchronization factor, the seed key becomes the basis for securing security with dynamic passwords. If the seed key is compromised, the security of the dynamic password will be greatly affected.

In an actual dynamic token application, the seed key is typically produced by the token manufacturer (ie, the vendor) and injected into the token, while the manufacturer needs to provide the seed file to the customer (eg, bank, etc.) Used to import a dynamic password authentication system so that dynamic password authentication can be completed. Alternatively, the seed key can also be generated by the customer and provided to the token manufacturer for production. That is, the seed key of the token is inevitably grasped by the token manufacturer and the bank, which increases the possibility of seed key leakage, and once the seed key is leaked, the criminal can falsify the token according to the leaked seed key, thereby Causes the user's economic loss.

At present, no effective solution has been proposed for how to verify whether the dynamic port token identity is legal and how to avoid the user's economic loss in the case of a forged token. Summary of the invention The invention provides a method and a system for verifying a dynamic port token identity, so as to at least solve the problem of how to verify whether the dynamic port token identity is legal and how to avoid the user's economic loss in the case where a forged token occurs.

According to an aspect of the present invention, a method for verifying a dynamic port token identity is provided, including: receiving, by a dynamic port token, an identity verification command, calculating a first verification value according to the first information, and outputting the first verification value, where The first information includes at least a first seed key for verifying the dynamic port token identity, where the first seed key is preset in the dynamic port token; and corresponding to the dynamic port token The verification device acquires the first verification value, verifies the first verification value, and outputs a verification result.

In addition, the dynamic port token receiving the identity verification instruction includes: the dynamic port token receiving an identity verification instruction input by a user, wherein the identity verification instruction is input by one of the following forms: a button or a button combination, a sound signal, a creature The feature signal or the optical signal; or, the dynamic port token receives the transaction information; or the dynamic port token receives an instruction that arrives within a preset period.

In addition, the obtaining, by the verification device corresponding to the dynamic port token, the first verification value includes: in an online situation, the background server receives the first verification value, and sends the first verification value to the verification device .

In addition, the acquiring, by the verification device corresponding to the dynamic port token, the first verification value includes: in an offline situation, the terminal receives the first verification value, and sends the first verification value to the verification device .

In addition, the verifying, by the verification device, the first verification value includes: the verification device calculates a second verification value according to the second information, where the second information includes at least a second seed key, the second The seed key is preset for verifying the dynamic port token identity; the verification device compares the first verification value with the second verification value; the first verification value is the same as the second verification value In case, the verification device determines that the identity of the dynamic port token is legal.

In addition, the dynamic port token performs the verification method of the dynamic port token identity before generating the dynamic password; or the dynamic port token performs the verification method of the dynamic port token identity while generating the dynamic password. .

Furthermore, the first seed key is different from the seed key of the dynamic password used to generate the transaction in the dynamic port token.

In addition, the first information further includes at least one of the following: a product serial number, a random number, and a time of the dynamic port token. The content included in the second information is corresponding to the content included in the first information.

According to another aspect of the present invention, a verification system for a dynamic port token identity is provided, comprising: a dynamic port token and a verification device. The dynamic port token includes: a receiving module, configured to receive an identity verification command, and a calculating module, configured to calculate a first verification value according to the first information, where the first information includes at least a first a sub-key, the first seed key is preset in the dynamic port token; and the first output module is configured to output the first verification value. The verification device includes: an obtaining module, configured to acquire the first verification value; a certificate module, configured to verify the first verification value; and a second output module, configured to output a verification result.

In addition, the receiving module includes: a first receiving unit, configured to receive an identity verification instruction input by a user, or receive an instruction that arrives within a preset period, where the identity verification instruction is input by one of the following forms: a button or a button a combination, a sound signal, a biometric signal or an optical signal; a second receiving unit, configured to receive the transaction information.

In addition, the system further includes: a background server, configured to receive the first verification value in an online situation, and send the first verification value to the verification device.

In addition, the system further includes: a terminal, configured to receive the first verification value in an offline situation, and send the first verification value to the verification device.

In addition, the verification module includes: a calculation unit, configured to calculate a second verification value according to the second information, where the second information includes at least a second seed key, where the second seed key is preset a comparison unit, configured to compare the first verification value with the second verification value, and a determining unit, configured to: when the first verification value is the same as the second verification value Next, determine that the identity of the dynamic port token is legal.

In addition, the verification device performs verification of the dynamic port token identity before generating the dynamic password; or, the verification device performs verification of the dynamic port token identity while generating the dynamic password.

According to another aspect of the present invention, a computer storage medium is provided, comprising: computer instructions, when the computer instructions are executed, such that: the dynamic port token receives the identity verification instruction, and calculates the first information according to the first information Verifying the value, and outputting the first verification value, where the first information includes at least a first seed key for verifying the identity of the dynamic port token, and the first seed key is preset in the The verification device corresponding to the dynamic port token acquires the first verification value, verifies the first verification value, and outputs a verification result.

It can be seen from the technical solution provided by the present invention that the present invention provides a method and a system for verifying a dynamic port token identity, and a seed key for verifying a dynamic port token identity is preset in the dynamic port token, at least according to the The seed key calculates the verification value by using a preset algorithm, and sends the verification value to the verification device for verification. If the verification value is consistent with the standard verification value calculated in the verification device, the token identity is legal, that is, the token is reliable. The manufacturer produces, otherwise the token identity is illegal, it is forged; the dynamic port token identity is verified, and the dynamic port token is prevented from being forged. Further, if it is verified that the dynamic port token identity is invalid, subsequent operations such as subsequent transactions may not be allowed, thereby avoiding economic loss to the user; In addition, online verification and offline verification modes are provided. For the case where both the dynamic port token identity needs to be verified and the transaction needs to be performed, since the bank server originally needs to receive the dynamic password, the online verification mode is adopted, and the verification value is forwarded by the bank server. After the verification pass information, the transaction can be carried out, which makes the verification and transaction process simple and convenient. For the case of verifying the dynamic port token identity without transaction, the offline verification mode can be adopted to avoid causing the bank server. burden;

In addition, the first information may further include other randomness that may increase the calculated verification value, so that the hacker is difficult to break and is more secure;

In addition, the verification of the dynamic port token identity can be performed before the dynamic password is generated, that is, whether the dynamic password is generated according to the verification result to execute the transaction, so that unnecessary operations can be avoided; or the dynamic password is generated while generating the dynamic password. The verification of the card identity, in the case of a dynamic password and identity verification, the execution of the transaction can save the time spent on the entire transaction process. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

1 is a flowchart of a method for verifying a dynamic port token identity according to Embodiment 1 of the present invention;

2 is a structural block diagram 1 of a dynamic port token identity verification system according to Embodiment 2 of the present invention;

3 is a structural block diagram 2 of a dynamic port token identity verification system according to Embodiment 2 of the present invention;

4 is a structural block diagram of a dynamic port token identity verification system according to Embodiment 3 of the present invention;

Figure 5 is a flowchart of a transaction method provided by Embodiment 4 of the present invention;

6 is a flowchart of a transaction method provided by Embodiment 5 of the present invention;

Figure 7 is a flow chart showing the transaction method provided in Embodiment 6 of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

In the description of the present invention, it is to be understood that the terms "center", "longitudinal", "transverse", "upper", "lower", "front",

The orientation or positional relationship of "post", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc. is The orientation or the positional relationship shown in the drawings is merely for the convenience of the description of the invention and the description of the invention, and is not intended to indicate or imply that the device or component referred to has a specific orientation, is constructed and operated in a specific orientation, and therefore cannot be understood. To limit the invention. Moreover, the terms "first" and "second" are used for descriptive purposes only and are not to be construed as indicating or implying a relative importance or quantity or location.

In the description of the present invention, it should be noted that the terms "installed", "connected", unless otherwise specifically defined and defined.

"Connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium. , can be the internal connection of two components. The specific meaning of the above terms in the present invention can be understood in a specific case by those skilled in the art.

The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

Example 1

This embodiment provides a method for verifying a dynamic port token identity, which can verify whether the dynamic port token identity is legal, that is, whether the dynamic port token is forged. 1 is a flowchart of a method for verifying a dynamic port token identity according to Embodiment 1 of the present invention. As shown in FIG. 1, the method includes the following steps:

Step S101: The dynamic port token receives the identity verification command, calculates a first verification value according to the first information, and outputs a first verification value, where the first information includes at least a first seed key for verifying the dynamic port token identity. The first seed key is pre-set in the dynamic port token. The outputting the first verification value may be displaying the first verification value on the display screen of the dynamic password card, or transmitting the first verification value to other devices, or a combination of the two methods.

Preferably, the first seed key is different from the seed key used to generate the dynamic password used in the transaction in the dynamic port token. If the two are the same, after the seed key for generating the dynamic password is leaked, the criminal will The seed key is used as a key for verifying the dynamic port token identity, forging a dynamic port token, and may not be able to verify the authenticity of the token. For example, the key algorithm used to calculate the verification value in the forged token happens to be a dynamic port token. The algorithm set at the factory is the same, and it is impossible to verify its authenticity. Therefore, in order to avoid this, it is preferable to use different seed keys to generate dynamic passwords and verify token identities, respectively.

Step S102: The verification device corresponding to the dynamic port token obtains the first verification value, verifies the first verification value, and outputs the verification result after the verification is completed.

It should be noted that the verification device may be a software implemented system or a hardware device, and the hardware device may store a product serial number of all dynamic port tokens produced by the manufacturer and a corresponding seed key for verifying the identity. And other information.

The authentication command is used to trigger the identity verification of the dynamic port token. The dynamic port token receiving the identity verification instruction in step S101 includes: the dynamic port token receives the identity verification instruction input by the user, wherein the identity verification instruction passes the following form Input: button or button combination, sound signal, biometric signal or optical signal; or, the dynamic port token receives the transaction information; or, the dynamic port token receives the instruction that arrives within the preset period.

Specifically, the dynamic port token can receive an authentication command input in the form of a button or a key combination, and the button or button combination can be preset by the manufacturer of the dynamic port token, or can be customized by the user. For the case where the manufacturer sets the button or the button combination, it cannot be changed, or the user needs higher authority to modify it. The button or combination of buttons can be: Long press on a button of the dynamic port token, any combination of buttons on the dynamic port token (eg buttons 4 and 8). The sound signal can be a fixed piece of music, and the biometric signal can be a specific fingerprint, an iris, or the like. The use of received transaction information to trigger authentication, typically in the case of a transaction after verification.

The obtaining, by the verification device, the first verification value in step S102 includes the following two cases:

(1) In the case of online, the background server receives the first verification value and sends the first verification value to the verification device. Correspondingly, the verification result is returned to the background server.

The backend server can be the bank's server for transactions. In the case that both the dynamic port token identity needs to be verified and the transaction needs to be performed, since the bank server originally needs to receive the dynamic password, the online verification mode is adopted, and the verification value is forwarded by the bank server, and the verified information is obtained, and then the transaction can be performed. Make verification and transaction process simple and convenient. At the same time, trading with the verification passed can guarantee the security of the transaction and user funds.

(2) In the offline case, the terminal receives the first verification value and transmits the first verification value to the verification device. Correspondingly, the verification result is returned to the terminal. Here, offline means that the authentication is not performed by the bank server. For the case where only the dynamic port token identity is verified, and no transaction is required, the offline verification mode can be adopted to avoid the burden on the background server.

The first verification value of the dynamic port token output may be displayed through the display screen. After the user knows the verification value, the terminal (for example, a mobile phone, a tablet computer, a PC, etc.) sends the verification value to the manufacturer by using a short message or an email. The fixed contact is sent directly to the verification device; the verification value can also be input on the verification interface of the manufacturer's website, and the verification result is displayed to the user after being verified by the verification device in the background.

The verification device performs the verification of the first verification value in step S102, which can be implemented by the following steps: The verification device calculates the second verification value according to the second information, where the second information includes at least the second seed key, the second seed key a pre-set key for verifying the dynamic port token identity; the verification device compares the first verification value with the second verification value; and if the first verification value is the same as the second verification value, the verification device determines the dynamic port token Legal status.

In fact, the first seed key used to verify the dynamic port token identity preset in the dynamic port token may be forged, and the first verification value is calculated according to at least the first seed key according to a preset algorithm. The first verification value is sent to the verification device; the second seed key used by the verification device is preset by the vendor for the dynamic port token, and is only known by the vendor itself, and is used to uniquely identify the dynamic port token, at least according to the second seed key. Key is pre-set The second verification value calculated by the algorithm can be understood as a standard verification value. As long as the first verification value is inconsistent with the standard verification value, the token identity is invalid. If they are consistent, the token identity is legal.

Preferably, the foregoing first information further includes at least one of the following: a product serial number of the dynamic port token, a random number, and a time; the content and the first information included in the second information used to generate the second verification value in the verification device includes: The content is corresponding. The random number or time can be used to increase the randomness of the calculated verification value, making it difficult for hackers to crack and be more secure. Normally, the first information includes the first seed key, the product serial number, and the time, and the second information also includes the first seed key, the product serial number, and the time, and the first verification value is calculated and the second verification value is calculated. The algorithm used is the same, so that it can be guaranteed that the first verification value and the second verification value are the same if the first seed key is not forged. For the forged token, the content included in the first information is not necessarily the same as the content included in the second information, and the algorithm used to calculate the first verification value and the second verification value is not necessarily the same.

Specifically, the algorithm for calculating the verification value may be: an algorithm such as SM3, HMAC-256 HMAC-512, and MD5, and the content included in the first information and the content included in the second information may be different according to different algorithms.

In addition, the dynamic port token can verify the dynamic port token identity before generating the dynamic password; or the dynamic port token can also verify the dynamic port token identity while generating the dynamic password. That is to say, it is possible to first verify whether the identity of the dynamic port token is legal, and if the identity is legal, generate a dynamic password to execute the transaction, so that unnecessary operations can be avoided; and the dynamic password can be verified while generating the dynamic password. Whether the identity is legal or not, and the dynamic password and identity are verified, the execution of the transaction can save the time spent on the entire transaction process.

The technical solution provided in this embodiment pre-sets a seed key for verifying the dynamic port token identity in the dynamic port token, and calculates a verification value according to at least the pre-set algorithm according to the seed key, and sends the verification value to the verification device. Performing verification, if the verification value is consistent with the standard verification value calculated in the verification device, the token identity is legal, that is, the token is produced by a reliable manufacturer; if the verification value is inconsistent with the standard verification value calculated in the verification device, The token identity is illegal and is forged. The dynamic port token identity is verified to prevent the dynamic port token from being forged. Furthermore, if it is verified that the dynamic port token identity is illegal, subsequent operations such as subsequent transactions may not be allowed, thereby avoiding economic loss to the user. On the other hand, if it can be verified that the token is a forged token, it indicates that the seed key used to generate the dynamic password is leaked, and the seed key used for authentication is not leaked, and the seed key may be excluded from the possibility of vendor leakage. .

Example 2

This embodiment provides a dynamic port token identity verification system, which can be used to implement the verification method in Embodiment 1. 2 is a structural block diagram 1 of a dynamic port token identity verification system according to Embodiment 2 of the present invention. As shown in FIG. 2, the system includes: a dynamic port token 20 and a verification device 30, where:

The dynamic port token 20 includes: a receiving module 201, configured to receive an identity verification command; a computing module 202, coupled to the receiving module 201, configured to calculate a first verification value according to the first information, where the first information includes at least The first seed key of the stateful token identity, the first seed key is preset in the dynamic port token; the first output module 203 is connected to the computing module 202, and configured to output the first verification value. The first output module 203 can be a display screen of the dynamic port token 20. Preferably, the first seed key is different from the seed key of the dynamic port token used to generate the dynamic password used by the transaction.

The verification device 30 includes: an obtaining module 301, configured to obtain a first verification value; a verification module 302, connected to the obtaining module 301, for verifying the first verification value; and a second output module 303, connected to the verification module 302, After the verification is completed, the verification result is output. It should be noted that the verification device 30 may be a software implemented system or a hardware device, and the hardware device may store the product serial number of all the dynamic port tokens produced by the manufacturer and the corresponding seed density for verifying the identity. Key and other information.

As shown in FIG. 3, the receiving module 201 includes: a first receiving unit 2011, configured to receive an authentication command input by a user or receive an instruction that arrives within a preset period, where the authentication command is input by: pressing a button or a button a combination, a sound signal, a biometric signal or an optical signal; a second receiving unit 2012, configured to receive transaction information. It has been described in detail in Embodiment 1, and will not be described again here.

The above system further includes: a background server 40, configured to receive the first verification value in the case of online, and send the first verification value to the verification device 30. Correspondingly, the verification result is returned to the background server 40. The backend server 40 can be a bank's server for transactions. In the case that both the dynamic port token identity needs to be verified and the transaction needs to be performed, after the bank server obtains the verified information, the transaction can be performed, which makes the verification and transaction process relatively simple and convenient. At the same time, trading with the verification passed can guarantee the security of the transaction and user funds.

In addition, the verification module 302 includes: a calculating unit 3021, configured to calculate a second verification value according to the second information, where the second information includes at least a second seed key, where the second seed key is preset for verifying the dynamic password Key of the card identity; comparison unit 3022, connected to the calculation unit 3021, for comparing the first verification value with the second verification value; the determining unit 3023, connected to the comparison unit 3022, for the first verification value and the second verification When the values are the same, it is determined that the identity of the dynamic port token is legal.

The first information further includes at least one of the following: a product serial number of the dynamic port token, a random number, and a time; the content included in the second information used to generate the second verification value in the verification device corresponds to the content included in the first information of. Using random numbers or time can increase the randomness of the calculated verification values, which is more secure. Normally, the first information includes the first seed key, the product serial number, and the time, and the second information also includes the first seed key, the product serial number, and the time, and the first verification value is calculated and the second verification value is calculated. The algorithm used is the same, so that it can be guaranteed that the first verification value and the second verification value are the same if the first seed key is not forged. For the forged token, the content included in the first information is not necessarily the same as the content included in the second information, and the algorithm used to calculate the first verification value and the second verification value is not necessarily the same. Specifically, the algorithm for calculating the verification value may be: SM3, HMAC-256 HMAC-512, and For algorithms such as MD5, the content included in the first information and the content included in the second information may be different according to different algorithms.

In addition, the verification device performs verification of the dynamic port token identity before generating the dynamic password; or, the verification device performs verification of the dynamic port token identity while generating the dynamic password. That is to say, it is possible to first verify whether the identity of the dynamic port token is legal, and if the identity is legal, generate a dynamic password to execute the transaction, so that unnecessary operations can be avoided; and the dynamic password can be verified while generating the dynamic password. Whether the identity is legal or not, and the dynamic password and identity are verified, the execution of the transaction can save the time spent on the entire transaction process.

The technical solution provided in this embodiment pre-sets a seed key for verifying the dynamic port token identity in the dynamic port token, and the calculating module 202 calculates the verification value according to the seed key according to at least a preset algorithm, and the first output module 203 Sending the verification value to the verification device 30 for verification. If the verification value is consistent with the standard verification value calculated in the verification device 30, the token identity is legal, that is, the token is produced by a reliable manufacturer; if the verification value and the verification device are If the standard verification value calculated in 30 is inconsistent, the token identity is illegal and is forged; the dynamic port token identity verification is implemented to prevent the dynamic port token from being forged. Further, if it is verified that the dynamic port token identity is illegal, operations such as subsequent transactions may not be allowed, thereby avoiding economic loss to the user. On the other hand, if it can be verified that the token is a forged token, it indicates that the seed key used to generate the dynamic password is leaked, and the seed key used for authentication is not leaked, and the seed key may be excluded from the possibility of vendor leakage. .

Example 3

The system of this embodiment differs from the system of FIG. 3 in Embodiment 2 in that the background server 40 is replaced with the terminal 50 to implement offline verification, and corresponding to the replacement, the transmission mode of the first verification value is changed. As shown in FIG. 4, the system further includes: a terminal 50, configured to receive the first verification value in an offline situation, and send the first verification value to the verification device 30. Correspondingly, the verification result is returned to the terminal 50. Here, offline refers to not verifying through the bank server. If only the identity of the dynamic port token is verified, and no transaction is required, the offline verification mode can be adopted to avoid the burden on the background server.

The first verification value of the dynamic port token output may be displayed through the display screen. After the user knows the verification value, the terminal (for example, a mobile phone, an iPad, a PC, etc.) sends the verification value to the manufacturer by using a short message or an email. The fixed contact is sent directly to the verification device; the verification value can also be input on the verification interface of the manufacturer's website, and the verification result is displayed to the user after being verified by the verification device in the background.

Example 4

The present embodiment provides a transaction method, which can be implemented based on the verification method of the dynamic port token identity described in Embodiment 1 and the verification system of the dynamic port token identity described in Embodiment 2, as shown in FIG. The trading method includes the following steps: Step S501, the dynamic port token generates a dynamic password;

Step S502: The dynamic port token calculates a first verification value according to the first information, where the first information includes at least a first seed key for verifying a dynamic port token identity, where the first seed key is preset in a dynamic port token. It should be noted that the sequence of step S501 and step S502 can be exchanged, that is, step S502 is first performed to calculate the first verification value, and then step S501 is executed to generate a dynamic password, and the trigger condition for calculating the first verification value may be that the transaction is received. After receiving the transaction information, step S501 and step S502 are simultaneously performed.

Step S503, the dynamic port token sends the dynamic password together with the first verification value to the background server;

Step S504, after receiving the dynamic password and the first verification value, the background server verifies the dynamic password, and sends the first verification value to the verification device corresponding to the dynamic port token for verification; after the verification device is verified, the verification result is output; Step S505 The background server receives the verification result, and executes the transaction if both the dynamic password and the first verification value are verified.

The steps of verifying the first verification value by the verification device have been described in detail in Embodiments 1 to 3, and are not described herein again. In this embodiment, when the dynamic password and the first verification value are both passed, the transaction can be executed, and the double guarantee is used to increase the security of the transaction and ensure the security of the user funds. Even if the dynamic port token is forged, since the calculated first verification value cannot be verified, the transaction cannot be completed, and the user's economic loss is avoided.

Example 5

The present embodiment provides a transaction method, which can be implemented based on the verification method of the dynamic port token identity described in Embodiment 1 and the verification system of the dynamic port token identity described in Embodiment 2. The transaction method of this embodiment The difference from the transaction method in Embodiment 4 is that in this embodiment, the identity verification of the token is performed first, and then based on the verification result, it is determined whether a dynamic password is generated to execute the transaction. As shown in Figure 6, the transaction method includes the following steps:

Step S601, the dynamic port token receives the transaction information, calculates a first verification value according to the first information, and outputs a first verification value, where the first information includes at least a first seed key for verifying the dynamic port token identity, A subkey is pre-set in the dynamic port token;

Step S602, the background server receives the first verification value, and forwards the first verification value to the verification device. Step S603, the verification device verifies the first verification value, and after the verification is completed, outputs the verification result. Step S604, the background server Receiving the verification result, if the verification result is legal, step S605 is performed; if the verification result is invalid, step S606 is performed;

Step S605, the background server sends information (for example, the verification pass information) to the dynamic port token, triggers the dynamic port token to generate a dynamic password, and performs a subsequent transaction process;

Step S606, the background server sends information (for example, verification failure information) to the dynamic port token, and stops the transaction. In the above step S601, the condition for triggering the identity verification may also be that the user arrives within the predetermined verification period or the user The authentication command is input. Correspondingly, the trigger condition for generating the dynamic password in step S605 may be that the transaction information is received within a certain time (for example, 3 minutes, 10 minutes, etc.) after the verification is passed, to ensure security.

The steps of verifying the first verification value by the verification device have been described in detail in Embodiments 1 to 3, and are not described herein again. In this embodiment, the identity verification of the token is performed first, and then based on the verification result, it is determined whether a dynamic password is generated to execute the transaction, thereby avoiding unnecessary operations.

Example 6

The present embodiment provides a transaction method, which can be implemented based on the verification method of the dynamic port token identity described in Embodiment 1 and the verification system of the dynamic port token identity described in Embodiment 3. The transaction method of this embodiment The difference from the transaction method in Embodiment 5 is that the authentication mode of the token is performed in the online verification mode in Embodiment 5. In this embodiment, the token is authenticated by using the offline verification mode, as shown in FIG. The method includes the following steps:

Step S701, the dynamic port token receives the transaction information, calculates the first verification value according to the first information, and outputs the first verification value (here, the first verification value may be displayed on the display screen of the dynamic port token), where The first information includes at least a first seed key for verifying a dynamic port token identity, where the first seed key is preset in the dynamic port token;

Step S702: The user obtains the first verification value, and forwards the first verification value to the verification device by using an email, a short message, or the like, or inputs a first verification value on the verification interface, so that the verification device obtains the first verification value;

Step S703, the verification device verifies the first verification value, and after the verification is completed, outputs the verification result; Step S704, the terminal receives the verification result, if the verification result is the identity legal, step S705 is performed; if the verification result is the identity is invalid, Go to step S706;

Step S705: The user operates the dynamic port token to trigger the dynamic port token to generate a dynamic password, and performs a subsequent transaction process. Step S706, no transaction is performed.

In the above step S701, the condition for triggering the identity verification may also be that it arrives within a predetermined verification period or the user inputs an identity verification instruction. Correspondingly, the trigger condition for generating the dynamic password in step S705 may be a certain time after the verification is passed. (eg 3 minutes, 10 minutes, etc.) Receive transaction information to ensure security.

The steps of verifying the first verification value by the verification device have been described in detail in Embodiments 1 to 3, and are not described herein again. The offline authentication mode is used to verify the identity of the dynamic port token. If the verification is passed, the dynamic password is generated, and the transaction is completed with the background server. Otherwise, the transaction is not performed to ensure the security of the user funds; and the offline verification can reduce the burden on the server.

Example 7

The present application provides a computer storage medium comprising computer instructions that, when executed, cause: The dynamic port token receives the authentication command, calculates the first verification value according to the first information, and outputs the first verification value, where the first information includes at least a first seed key for verifying the dynamic port token identity, and the first seed key The key is preset in the dynamic port token; the verification device corresponding to the dynamic port token acquires the first verification value, verifies the first verification value, and outputs the verification result. Any process or method description in the flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a particular logical function or process. And the scope of the preferred embodiments of the invention includes additional implementations, in which the functions may be performed in a substantially simultaneous manner or in an opposite order depending on the functions involved, in the order shown or discussed. It will be understood by those skilled in the art to which the embodiments of the present invention pertain.

It should be understood that portions of the invention may be implemented in hardware, software, firmware or a combination thereof. In the above-described embodiments, multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented with any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

One of ordinary skill in the art can understand that all or part of the steps carried by the method of implementing the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, one or a combination of the steps of the method embodiments is included.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. The integrated modules, if implemented in the form of software functional modules and sold or used as separate products, may also be stored in a computer readable storage medium.

The above-mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means a specific feature described in connection with the embodiment or example. A structure, material or feature is included in at least one embodiment or example of the invention. In the present specification, the schematic representation of the above terms does not necessarily mean the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Although the embodiments of the present invention have been shown and described, it is understood that the foregoing embodiments are illustrative and not restrictive Variations, modifications, alterations and variations of the above-described embodiments are possible within the scope of the invention. The scope of the invention is defined by the appended claims and their equivalents.

Claims

claims

1. A dynamic password token identity verification method, characterized by including:

The dynamic password token receives the identity verification instruction, calculates a first verification value based on the first information, and outputs the first verification value, wherein the first information at least includes a first seed password used to verify the identity of the dynamic password token. key, the first seed key is preset in the dynamic password token;

The verification device corresponding to the dynamic password token obtains the first verification value, verifies the first verification value, and outputs the verification result.

2. The method according to claim 1, wherein the dynamic password token receives an identity verification instruction including: the dynamic password token receives an identity verification instruction input by a user, wherein the identity verification instruction is in the following form One of the inputs: keys or key combinations, sound signals, biometric signals or light signals;

Or, the dynamic password token receives transaction information;

Alternatively, the dynamic port token receives an instruction arriving within a preset period.

3. The method according to claim 1 or 2, wherein the verification device corresponding to the dynamic password token obtains the first verification value including:

In an online situation, the backend server receives the first verification value and sends the first verification value to the verification device.

4. The method according to claim 1 or 2, wherein the verification device corresponding to the dynamic password token obtains the first verification value including:

In an offline situation, the terminal receives the first verification value and sends the first verification value to the verification device.

5. The method according to any one of claims 1 to 4, characterized in that, the verification device verifying the first verification value includes:

The verification device calculates a second verification value based on the second information, wherein the second information includes at least a second seed key, and the second seed key is preset for verifying the identity of the dynamic password token;

The verification device compares the first verification value and the second verification value;

When the first verification value and the second verification value are the same, the verification device determines that the identity of the dynamic password token is legal.

6. The method according to any one of claims 1 to 5, characterized in that,

The dynamic password token executes the verification method of the identity of the dynamic password token before generating the dynamic password;

Alternatively, the dynamic password token generates the dynamic password and simultaneously executes the dynamic password token identity verification method.

7. The method according to any one of claims 1 to 6, characterized in that the first seed key is different from the seed key used in the dynamic password token to generate the dynamic password used in the transaction.

8. The method according to any one of claims 1 to 7, characterized in that,

The first information also includes at least one of the following: the product serial number, random number and time of the dynamic password token.

9. The method according to any one of claims 5 to 8, characterized in that,

The content included in the second information corresponds to the content included in the first information.

10. A dynamic password token identity verification system, characterized by including:

Dynamic password token, the dynamic password token includes:

Receiving module, used to receive identity verification instructions;

The calculation module is used to calculate the first verification value based on the first information, wherein the first information at least includes a first seed key used to verify the identity of the dynamic password token, and the first seed key is preset in the location. In the above dynamic password token;

A first output module, used to output the first verification value; and

Verification device, the verification device includes:

Obtaining module, used to obtain the first verification value;

A verification module, used to verify the first verification value;

The second output module is used to output verification results.

11. The system according to claim 10, characterized in that the receiving module includes:

The first receiving unit is used to receive identity verification instructions input by the user or receive instructions arriving within a preset period, wherein the identity verification instructions are input in one of the following forms: keys or key combinations, sound signals, biometric signals or light signal;

The second receiving unit is used to receive transaction information.

12. The system according to claim 10 or 11, characterized in that, the system further includes: a background server, configured to receive the first verification value and send the first verification value when online to the verification device.

13. The system according to claim 10 or 11, characterized in that, the system further includes: a terminal, configured to receive the first verification value and send the first verification value when offline. to the verification device.

14. The system according to any one of claims 10 to 13, characterized in that the verification module includes: a calculation unit configured to calculate a second verification value according to the second information, wherein the second information is at least Including a second seed key, the second seed key is preset and used to verify the identity of the dynamic password token;

A comparison unit configured to compare the first verification value with the second verification value;

Determining unit, configured to determine the dynamic interface when the first verification value and the second verification value are the same. The token's identity is valid.

15. The system according to any one of claims 10 to 14, characterized in that:

Verify the identity of the dynamic password token by the verification device before generating the dynamic password;

Alternatively, the verification device verifies the identity of the dynamic password token while generating the dynamic password.

16. The system according to any one of claims 10 to 15, characterized in that the first seed key is different from the seed key in the dynamic password token used to generate the dynamic password used in the transaction.

17. The system according to any one of claims 10 to 16, characterized in that the first information also includes at least one of the following: the product serial number, random number and time of the dynamic password token.

18. The system according to any one of claims 14 to 17, characterized in that the content included in the second information corresponds to the content included in the first information.

19. A computer storage medium, characterized in that it includes computer instructions that, when executed, cause: