WO2015058596A1 - 动态口令生成方法和系统、交易请求的处理方法和系统 - Google Patents

动态口令生成方法和系统、交易请求的处理方法和系统 Download PDF

Info

Publication number
WO2015058596A1
WO2015058596A1 PCT/CN2014/086412 CN2014086412W WO2015058596A1 WO 2015058596 A1 WO2015058596 A1 WO 2015058596A1 CN 2014086412 W CN2014086412 W CN 2014086412W WO 2015058596 A1 WO2015058596 A1 WO 2015058596A1
Authority
WO
WIPO (PCT)
Prior art keywords
pin code
cryptographic device
random number
mobile terminal
encrypted
Prior art date
Application number
PCT/CN2014/086412
Other languages
English (en)
French (fr)
Inventor
李东声
Original Assignee
天地融科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天地融科技股份有限公司 filed Critical 天地融科技股份有限公司
Publication of WO2015058596A1 publication Critical patent/WO2015058596A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to a dynamic password generation method and system, and a method and system for processing a transaction request.
  • Digital signature technology is a network information security technology that ensures that user data will not be maliciously modified during the transmission of the network.
  • the so-called digital signature technology is a technology for identity authentication, which can be used to securely transmit commands and files.
  • the digital signature technique processes the user data to be transmitted through a one-way function to obtain an alphanumeric string that authenticates the data source and verifies that the data has changed.
  • the digital signature uses a hash algorithm such as MD5, SHA-1, etc. to calculate a digest value for the data to be transmitted, and encrypts the digest value and then transmits it using an encryption algorithm.
  • digital signatures are mostly used for public key encryption technologies, such as PKCS (Public Key Cryptography Standards) based on RSA Date Security, Digital Signature Algorithm, x.509, PGP (Pretty Good Privacy). 1994 American Standards and Technology Association.
  • PKCS Public Key Cryptography Standards
  • DSS digital Signature Standard
  • a perfect digital signature technology should meet the following three conditions: first, the signer cannot refute his signature afterwards; second, no other person can falsify the signature; third, if the parties have a dispute over the authenticity of the signature, A fair arbitrator confirms the authenticity by verifying the signature.
  • a portable and portable smart cryptographic device also known as a Key device
  • USB Key any type of device that supports an audio interface of a mobile phone audio interface.
  • This is a small hardware device with a microprocessor that establishes a connection with the terminal through a terminal data communication interface.
  • the processor in the device is generally implemented by a secure design chip. Its built-in security mechanism implements key generation, key secure storage, and preset encryption algorithms.
  • the smart password device includes a display screen and a confirmation button, and the transaction request message that needs to be signed must be sent to the display screen of the smart password device for display, and after the display is correct, the user can manually confirm by pressing the confirm button. Return the signature data to the calculation. In this way, even if the hacker controls the user's terminal, the smart cryptographic device cannot be controlled, and the user cannot control the user to manually confirm by pressing the confirmation key, so the security is greatly improved.
  • Dynamic password technology also known as One Time Password (OTP) technology
  • OTP One Time Password
  • the existing One Time Password (OTP) has different types of dynamic password generation methods, such as a time-based dynamic port token, an event-based dynamic port token, and a challenge-based dynamic port token. Or based on any of the above three types of dynamic port tokens of any combination type.
  • the dynamic password generation function of the smart cryptographic device is a challenge/response-based dynamic password generation mode
  • the user is required to input a challenge code to generate a dynamic password according to the challenge code
  • the challenge code is input by the user on the smart cryptographic device.
  • the operation of the digital code realizes the input of the challenge code, and it is necessary to set a total of 10 numeric keys from 0 to 9 on the smart cryptographic device, so that the size of the smart cryptographic device is too large, which is unfavorable for carrying, so how to reduce the volume of the smart cryptographic device and Achieving a safe and easy input challenge code is a technical problem to be solved.
  • the present invention is directed to solving the above problems/one, and provides a dynamic password generating method and system, a processing method and system for a transaction request.
  • An aspect of the present invention provides a dynamic password generating method, including: a mobile terminal acquiring transaction information, and generating a transaction request according to the transaction information, and transmitting the transaction request to a background server, wherein the transaction request includes at least transaction information and a challenge code request; the background server receives the transaction request, and generates a challenge code of the transaction request according to a preset challenge code generation policy; and at least encrypts the challenge code by using an encryption key to obtain encrypted data.
  • the mobile terminal Before transmitting to the smart cryptographic device, the mobile terminal detects whether the smart cryptographic device has been inserted; if the smart cryptographic device has been inserted, acquires the PIN code of the smart cryptographic device; and encrypts the PIN code by a one-time key Obtaining an encrypted PIN code, encoding the encrypted PIN code, obtaining encoded data, and transmitting the encoded data to the smart cryptographic device through an audio interface, where the PIN code is used to open the PIN code Determining the functional authority of the smart cryptographic device; the smart cryptographic device receives the encoded data, decodes the encoded data, obtains the encrypted PIN code, and verifies the PIN code according to the encrypted PIN code Legitimacy, if the PIN code is verified to be valid, the dynamic password generating function is enabled, and the state switching success information is sent to the mobile terminal; after receiving the state switching success information, the mobile terminal receives the received
  • the smart cryptographic device Transmitting the encrypted data packet to the smart cryptographic device; the smart cryptographic device encrypting the encryption by using a decryption key corresponding to the encryption key Decrypting the packet, to obtain decrypted data, and outputting the decrypted data; after receiving the confirmation instruction decryption of data, dynamic password corresponding raw transaction costs.
  • the acquiring, by the mobile terminal, the transaction information includes: the mobile terminal displaying the account information recorded in the history record before acquiring the payment account and/or the payment account of the transaction information, and receiving the account information if the history record corresponds to the account number.
  • the selection instruction of the displayed account information is used to save the selected account as the transaction information. If there is no corresponding account in the history record, the account information input by the user is received, the account information input by the user is saved as transaction information, and the user is input. Account information is added to the history.
  • the encrypted data packet further includes time synchronization information for synchronizing the time of the clock module in the smart cryptographic device; the method further includes: the smart cryptographic device decrypting the obtained time synchronization information and the dynamic password in the smart cryptographic device Comparing the time of the clock module in the function, obtaining a time difference, comparing the time difference with the locally stored time error range, and if the time difference is not within the time error range, prompting the user whether to perform time synchronization; if receiving After the synchronization instruction, the time of the clock module is adjusted according to the time synchronization information, and after the adjustment is completed, the dynamic password generation process is executed.
  • the mobile terminal encrypts the PIN code by using a one-time key to obtain an encrypted PIN code, including: the mobile terminal acquires a public key of the smart cryptographic device, and uses the public key pair to generate a locally generated software random number K1. Encrypting, and transmitting the encrypted software random number K1' to the smart cryptographic device; the smart cryptographic device receiving the encrypted software random number K1', and using the private key corresponding to the public key to the encrypted The software random number K1' is decrypted to obtain a software random number K1; and a hardware random number K2 is generated, and the hardware random number K2 is encrypted by using the software random number K1 to obtain an encrypted hardware random number K2'.
  • the mobile terminal decrypts the encrypted hardware random number K2' by using the software random number K1 to obtain a hardware random number K2, and takes the hardware random number K2 as a one-time Key, encrypting the PIN code by using the hardware random number K2 to obtain the encrypted PIN code;
  • the smart cryptographic device verifies the legality of the PIN code according to the encrypted PIN code, including The The smart cryptographic device receives the encrypted PIN code, and decrypts the encrypted PIN code by using the hardware random number K2 to obtain a PIN code; and compares the obtained PIN code with a locally saved PIN code, if If the two PIN codes are the same, the verification is passed.
  • the mobile terminal encrypts the PIN code by using a one-time key to obtain an encrypted PIN code, including: the mobile terminal acquires a public key of the smart cryptographic device and a random number generated by the smart cryptographic device, and uses the public key Encrypting the sequence consisting of the random number and the PIN code to obtain an encryption result; the smart cryptographic device verifying the validity of the PIN code according to the encrypted PIN code, including: using the private key by the smart cryptographic device Decrypting the encrypted result to obtain the sequence, and using the random number, obtaining the PIN code from the sequence, and comparing the obtained PIN code with a locally stored PIN code, if two PINs If the codes are the same, the verification is passed.
  • the encryption key and the decryption key are asymmetric public private key pairs, and the encryption key is different from the public key of the smart cryptographic device, and the decryption key is different from the private key of the smart cryptographic device. .
  • the mobile terminal encrypts the PIN code by using a one-time key to obtain an encrypted PIN code, including: the mobile terminal acquires a random number, and forms the random number and the PIN code into a first sequence, The first sequence performs a hash algorithm calculation; the first calculation result is obtained; the smart cryptographic device verifies the legality of the PIN code according to the encrypted PIN code, including: the smart cryptographic device according to the processing with the mobile terminal
  • the second sequence is obtained in the same manner, and the same hash algorithm is used to obtain a second calculation result, and the first calculation result and the second calculation result are compared, if the first calculation result and the If the second calculation result is the same, the verification is passed.
  • Another aspect of the present invention provides a method for processing transaction request information, comprising: generating a dynamic password by the above method; the mobile terminal acquiring the dynamic password, and transmitting the dynamic password to the background server; The background server receives the dynamic password and verifies the dynamic password, and if the verification passes, executes the transaction.
  • the mobile terminal acquires a dynamic password, including: mode 1: the smart password device displays the dynamic password, and the mobile terminal receives a dynamic password input by the user; and the second mode: the smart password device uses an audio interface to provide The mobile terminal sends the dynamic password, and the mobile terminal receives the dynamic password.
  • a still further aspect of the present invention provides a dynamic password generating system, including a mobile terminal, a background server, and a smart cryptographic device, wherein: the mobile terminal is configured to acquire transaction information, generate a transaction request according to the transaction information, and generate the transaction Sending a request to a background server, wherein the transaction request includes at least transaction information and a challenge code request; and detecting whether the smart cryptographic device has been inserted before the mobile terminal transmits the encrypted data packet to the smart cryptographic device; if the smart password After the device is inserted, the PIN code of the smart cryptographic device is obtained; and the PIN code is encrypted by a one-time key to obtain an encrypted PIN code, and the encrypted PIN code is encoded to obtain encoded data, and Transmitting the encoded data to the smart cryptographic device via an audio interface, wherein the PIN code is used to open the location The functional authority of the smart cryptographic device;
  • the background server is configured to receive the transaction request, and generate a challenge code of the transaction request according to a preset challenge code generation policy; and at least encrypt the challenge code by using an encryption key to obtain an encrypted data packet. And sending the encrypted data packet to the mobile terminal; the smart cryptographic device is configured to receive the encoded data, decode the encoded data, obtain the encrypted PIN code, according to the encrypted PIN The code verifies the validity of the PIN code, if the PIN code is verified to be valid, the dynamic password generating function is turned on, and the state switching success information is sent to the mobile terminal; and the encryption is performed by using a decryption key corresponding to the encryption key.
  • the data packet is decrypted to obtain decrypted data, and the decrypted data is output; when an acknowledgement command for the decrypted data is received, a dynamic password corresponding to the current transaction is generated.
  • the mobile terminal is further configured to display the account information recorded in the history record before acquiring the payment account and/or the payment account of the transaction information, and if the account has an account number in the history record, receive the selection of the displayed account information.
  • the instruction saves the selected account as transaction information. If there is no corresponding account in the history record, the account information input by the user is received, the account information input by the user is saved as transaction information, and the account information input by the user is added to the history record. in.
  • the encrypted data packet further includes time synchronization information for synchronizing the time of the clock module in the smart cryptographic device; the smart cryptographic device is further configured to use the decrypted time synchronization information and the dynamic password function in the smart cryptographic device Comparing the time of the clock module, obtaining a time difference, comparing the time difference with a locally stored time error range, and if the time difference is not within the time error range, prompting the user whether to perform time synchronization; if receiving After the synchronization command, the time of the clock module is adjusted according to the time synchronization information, and after the adjustment is completed, the dynamic password generation process is executed.
  • the mobile terminal is further configured to acquire a public key of the smart cryptographic device, and encrypt the locally generated software random number K1 by using the public key, and send the encrypted software random number K1′ to the smart cryptographic device; And decrypting the encrypted hardware random number K2' by using the software random number K1, obtaining a hardware random number K2, using the hardware random number K2 as a one-time key, and encrypting the PIN code by using a hardware random number K2 to obtain an encrypted a PIN code; the smart cryptographic device is further configured to receive the encrypted software random number K1 ′, and decrypt the encrypted software random number K1 ′ by using a private key corresponding to the public key, to obtain a software random a number K1; and a hardware random number K2 is generated, and the hardware random number K2 is encrypted by using the software random number K1 to obtain an encrypted hardware random number K2', and the encrypted hardware random number K2' is transmitted to the mobile And receiving the encrypted PIN code, and decrypting the encrypted PIN
  • the mobile terminal is further configured to acquire a public key of the smart cryptographic device and a random number generated by the smart cryptographic device. And using the public key to encrypt the sequence consisting of the random number and the PIN code to obtain an encryption result; the smart cryptographic device is further configured to decrypt the encryption result by using a private key, obtain the sequence, and utilize The random number is obtained by obtaining the PIN code from the sequence, and comparing the obtained PIN code with a locally stored PIN code. If the two PIN codes are the same, the verification is passed.
  • the encryption key and the decryption key are asymmetric public private key pairs, and the encryption key is different from the public key of the smart cryptographic device, and the decryption key is different from the private key of the smart cryptographic device. .
  • the mobile terminal is further configured to acquire a random number, and combine the random number and the PIN code into a first sequence, perform a hash algorithm calculation on the first sequence, and obtain a first calculation result; the smart password device further And the second calculation result is obtained in the same manner as the processing manner of the mobile terminal, and the second calculation result is obtained by using the same hash algorithm, and the first calculation result and the second calculation result are compared. If the first calculation result and the second calculation result are the same, the verification is passed.
  • the smart cryptographic device comprises a security chip, wherein the security chip is used to generate a dynamic password.
  • the security chip is also used for electronic signatures.
  • a further aspect of the present invention provides a system for processing transaction request information, comprising: the dynamic password generation system, wherein the mobile terminal is further configured to acquire the dynamic password, and send the dynamic to the background server. a password; the background server is further configured to receive the dynamic password, and verify the dynamic password, and if the verification passes, execute the transaction.
  • the mobile terminal is further configured to obtain a dynamic password by using one of the following manners: Method 1: The smart password device displays the dynamic password, and the mobile terminal receives a dynamic password input by a user; The smart cryptographic device transmits the dynamic password to the mobile terminal via an audio interface, and the mobile terminal receives the dynamic password.
  • the scenes that need to be operated by means of the keyboard are respectively input PIN code and input challenge code, but the mobile terminal sends the PIN code in the method embodiment provided by the present invention.
  • the access control of the dynamic password used by the user, and the input of the PIN code is borrowed from the keyboard function of the mobile terminal by the mobile terminal, and is sent by the mobile terminal to the smart cryptographic device through the audio interface, compared with the input on the keyboard of the smart cryptographic device in the prior art.
  • the input of the PIN code is completed, so that the smart password device does not need to set the numeric keypad, which greatly reduces the volume of the smart password device; in addition, in order to ensure the secure transmission of the PIN code, the encryption is performed by the one-time key, and the PIN code is stolen.
  • the challenge code is transmitted by the mobile terminal to the smart cryptographic device through the audio interface, and the user does not need to manually input the challenge code. The user's input operation.
  • FIG. 1 is a schematic flowchart of an embodiment of a method for generating a dynamic password according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic flowchart of an embodiment of a method for processing a transaction request according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic structural diagram of an embodiment of a dynamic password generation system according to Embodiment 3 of the present invention.
  • connection In the description of the present invention, it should be noted that the terms “installation”, “connected”, and “connected” are to be understood broadly, and may be fixed or detachable, for example, unless otherwise explicitly defined and defined. Connected, or integrally connected; can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • Connected, or integrally connected can be mechanical or electrical; can be directly connected, or indirectly connected through an intermediate medium, can be the internal communication of the two components.
  • the specific meaning of the above terms in the present invention can be understood in a specific case by those skilled in the art.
  • FIG. 1 is a schematic flowchart diagram of an embodiment of a dynamic password generating method provided by the present invention.
  • the method embodiment shown in Figure 1 includes the following steps:
  • Step 101 The mobile terminal acquires transaction information, and generates a transaction request according to the transaction information, and sends the transaction request to the background server, where the transaction request includes at least the transaction information and the challenge code request;
  • the mobile terminal may be a portable terminal such as a mobile phone or a tablet computer;
  • the transaction information includes at least a payment account, a collection account, and an amount;
  • the mobile terminal selects a dynamic password by default to pay; of course, the mobile terminal may also query the background system server for the payment mode, and then determine the payment mode as a dynamic password according to the query request.
  • the payment method which in turn generates a transaction request.
  • Step 102 The background server receives the transaction request, and generates a challenge code of the transaction request according to the preset challenge code generation policy; and at least encrypts the challenge code by using the encryption key to obtain the encrypted data packet, and sends the encrypted data to the mobile terminal. package;
  • the encryption key may be a symmetric key or a public key of an asymmetric key algorithm.
  • the encryption key when the encryption key is a public key of the asymmetric key algorithm, when the dynamic password function is integrated with the signature function of the USB key, the encryption key may be a private key corresponding to the signature function in the smart cryptographic device.
  • the public key reduces the number of keys stored in the background server and facilitates finding the encryption key, thereby shortening the encryption time and improving the processing speed of the background server.
  • Step 103 Before the mobile terminal sends the encrypted data packet to the smart cryptographic device, the mobile terminal detects whether the smart cryptographic device has been inserted; if the smart cryptographic device has been inserted, obtains the PIN code of the smart cryptographic device; and encrypts by a one-time key
  • the PIN code obtains the encrypted PIN code, encodes the encrypted PIN code, obtains the encoded data, and sends the encoded data to the smart password device through the audio interface, wherein the PIN code is used to enable the function authority of the smart password device;
  • the step of detecting whether the smart cryptographic device has been inserted by the mobile terminal may be performed before receiving the encrypted data packet, or after detecting that the encrypted data packet is received; and further, the mobile terminal detects whether the smart cryptographic device has been
  • the step of inserting and obtaining the PIN code and transmitting the encrypted PIN code to the smart cryptographic device may be performed before receiving the encrypted data packet, or after detecting that the encrypted data packet is received.
  • the mobile terminal detects the insertion of the smart cryptographic device, it can also detect whether the smart cryptographic device is legal. After detecting that the smart cryptographic device is legal, the process of obtaining the PIN code, encrypting the PIN code, and sending is performed. The detection of the smart cryptographic device is legal, and the legality of the receiving end can be confirmed, and the security of information transmission is improved.
  • the PIN code is encrypted by using a one-time key, which improves the security of the PIN code transmission.
  • the one-time key is an encryption key, but the effective number of times is one, that is, when the one-time key M is used, the key M is no longer used, so that the hacker cannot steal by means of the key. PIN code.
  • the encrypted PIN code is encoded to conform to the protocol of the audio interface for transmitting data
  • the mobile terminal is The audio interface of the end performs data transmission, which improves the versatility and ease of use of the smart cryptographic device.
  • Step 104 The smart cryptographic device receives the encoded data, decodes the encoded data, obtains the encrypted PIN code, and verifies the legality of the PIN code according to the encrypted PIN code. If the PIN code is verified to be valid, the dynamic password generating function is enabled, and The mobile terminal sends a state switching success message;
  • step 103 and step 104 it can be seen from step 103 and step 104 that before the mobile terminal sends the encrypted data packet, by transmitting the PIN code to the smart cryptographic device, the identity of the user can be authenticated, and the criminal suspect is prevented from using the dynamic password function of the smart cryptographic device. Transaction, improve account security;
  • the PIN code is transmitted between the mobile terminal and the smart cryptographic device through a one-time key, which ensures the security of the PIN code transmission, reduces the possibility of PIN code theft, and further reduces the criminals.
  • the opportunity to use the dynamic password function of the smart password device for illegal transactions ensures account security.
  • Step 105 After receiving the state switching success information, the mobile terminal sends the received encrypted data packet to the smart cryptographic device through the audio interface.
  • Step 106 The smart cryptographic device decrypts the encrypted data packet by using a decryption key corresponding to the encryption key to obtain decrypted data, and outputs the decrypted data. After receiving the confirmation instruction for the decrypted data, generating a dynamic password corresponding to the transaction. ;
  • the smart cryptographic device decrypts the encrypted data packet by using a decryption key corresponding to the encryption key used by the background server, parses the challenge code from the encrypted data packet, and outputs the challenge code to the smart
  • the user is provided for confirmation.
  • the confirmation button on the smart password device is pressed, and after receiving the confirmation command, the smart password device generates a dynamic password for the transaction.
  • the dynamic password is output to the display for display or the dynamic password is sent to the mobile terminal.
  • the scenes of the prior art operation by means of the keyboard are respectively input PIN code and input challenge code, but in the method embodiment provided by the present invention, the mobile terminal sends the PIN code to implement the use of the user.
  • the access control of the dynamic password, and the input of the PIN code is compared with the input on the keyboard of the smart cryptographic device in the prior art, and the keyboard function of the mobile terminal is borrowed, and the mobile terminal sends the smart password device to the smart cryptographic device through the audio interface, thereby completing
  • the input of the PIN code makes the smart cryptographic device not need to set the numeric keypad, which greatly reduces the volume of the smart cryptographic device; in addition, in order to ensure the secure transmission of the PIN code, the encryption is performed by the one-time key, thereby reducing the possibility of the PIN code being stolen.
  • the security of the information transmission is ensured; in addition, compared with the input code of the prior art by the user, the challenge code in the present application is transmitted by the mobile terminal to the smart cryptographic device through the audio interface, and the user is manually input, thereby optimizing the user's Enter the action.
  • the method embodiment may further include the following steps, and the specific content is as follows:
  • the mobile terminal may further display the account information recorded in the history record to further simplify the user input operation before acquiring the payment account and/or the payment account of the transaction information. If there is an account in the history record, a selection instruction for the displayed account information is received, and the selected account is saved as the transaction information. If there is no corresponding account in the history record, the account information input by the user is received, and the account information input by the user is received. It is saved as transaction information, and the account information input by the user is added to the history.
  • step 102 while transmitting the challenge code, other information, such as time synchronization information, may be sent to synchronize the time of the clock module in the smart cryptographic device; correspondingly, in step 106, the transaction is generated.
  • the smart cryptographic device performs the following operations: comparing the time synchronization information obtained by the decryption with the time of the clock module in the dynamic password function of the smart cryptographic device to obtain a time difference, and the time difference value is locally stored. The time error range is compared.
  • the user is prompted to perform time synchronization; if the synchronization instruction is received, the time of the clock module is adjusted according to the time synchronization information, and after the adjustment is completed, Perform a dynamic password generation process.
  • the time factor for executing the dynamic password function can be synchronized with the background server in real time, ensuring the accuracy of dynamic password generation, and reducing the problem of dynamic password verification failure caused by time synchronization. occur.
  • Step A1 The mobile terminal is connected to the smart cryptographic device through an audio interface
  • Step A2 The mobile terminal outputs information prompting the user to input the PIN code
  • the mobile terminal can request the user to input information through an interaction interface, and the content of the interaction interface can be customized according to actual needs.
  • Step A3 The mobile terminal detects the button information received by the mobile terminal, and obtains a detection result.
  • the mobile terminal detects the content input by the user for the prompt information on the interactive page; wherein the user can implement feedback on the prompt information by using a hardware keyboard of the mobile phone or a keyboard on the touch screen.
  • Step A4 The mobile terminal parses the detection result to obtain a PIN code.
  • the information of the PIN code is sent to the smart cryptographic device through the mobile terminal, which satisfies the basic requirement of the user to manually input the PIN code, conforms to the security specification, and because the button function on the mobile terminal is borrowed, there is no need to
  • the button information is deployed on the dynamic port token to achieve the purpose of reducing the volume of the dynamic port token.
  • the one-time key is negotiated between the mobile terminal and the smart cryptographic device, so as to establish a secure channel between the mobile terminal and the smart cryptographic device.
  • the mobile terminal acquires the public key of the smart cryptographic device, encrypts the locally generated software random number K1 by using the public key, and sends the encrypted software random number K1' to the smart cryptographic device;
  • the smart cryptographic device receives the encrypted software random number K1' and uses the private key corresponding to the public key to encrypt the software.
  • the random number K1' is decrypted to obtain the software random number K1; and a hardware random number K2 is generated, and the hardware random number K2 is encrypted by the software random number K1 to obtain the encrypted hardware random number K2', and the encrypted hardware random number is transmitted. K2' to the mobile terminal;
  • the mobile terminal decrypts the encrypted hardware random number K2' by using the software random number K1, obtains the hardware random number K2, uses the hardware random number K2 as a one-time key, and encrypts the PIN code by using the hardware random number K2 to obtain the encrypted PIN. Code and send the encrypted PIN code to the smart cryptographic device;
  • the smart cryptographic device receives the encrypted PIN code, and decrypts the encrypted PIN code by using the hardware random number K2 to obtain the PIN code; compares the obtained PIN code with the locally stored PIN code, if the two PIN codes are the same, then Verification passed.
  • the hardware random number used in the method is stronger than the random number of the software random number used in the field, so that the encryption effect is better, and in addition, in the process of acquiring the hardware random number
  • the software random number is transmitted as a key to transmit the hardware random number to ensure the security of the transmission process.
  • the mobile terminal acquires the public key of the smart cryptographic device and the random number generated by the smart cryptographic device, and encrypts the sequence consisting of the random number and the PIN code by using the public key to obtain an encryption result, and sends the encrypted result to the smart cryptographic device;
  • the smart cryptographic device decrypts the encrypted result by using the private key to obtain a sequence, and obtains the PIN code from the sequence by using a random number, and compares the obtained PIN code with the locally stored PIN code. If the two PIN codes are the same, then Verification passed.
  • the random number in the present method may be a hardware random number to increase the randomness of the sequence.
  • the manner in which the mobile terminal obtains the hardware random number may also be obtained by using the hardware random number in the first mode to ensure the random number transmission. Security.
  • the random number generated by the smart cryptographic device acquired by the mobile terminal may be obtained by the mobile terminal and the smart cryptographic device, for example, by means of mutual encryption similar to the method 1, and the random number is ensured by encryption.
  • the security of the random number transmission prevents the unsafe hidden danger caused by the stolen; the random number can also be obtained from the smart cryptographic device without being encrypted through the secure transmission channel of the audio interface, thereby improving the speed of acquiring the random number.
  • the mobile terminal acquires a random number, and combines the random number and the PIN code into a first sequence, performs a hash algorithm calculation on the first sequence, obtains a first calculation result, and sends a first calculation result to the smart cryptographic device;
  • the smart cryptographic device receives the first calculation result, and obtains the second sequence in the same manner as the processing method of the mobile terminal, and uses the same hash algorithm to obtain the second calculation result, and performs the first calculation result and the second calculation result. For comparison, if the first calculation result and the second calculation result are the same, the verification is passed.
  • the calculation is performed by a sequence consisting of a random number and a PIN code, and then the smart cryptographic device determines that the calculation result of the mobile terminal is compared with the local calculation result, thereby realizing the PIN code. Verification, easy to implement.
  • the hardware random number in the method may also be obtained by using the hardware in the manner of the first method to ensure the security of the hardware random number. It can also be directly obtained from the smart crypto device through the secure transmission channel of the audio interface without encryption, thereby improving the acquisition speed.
  • the encryption key and the decryption key are asymmetric public and private key pairs, and the encryption key is different from the public key used in the signature function of the smart cryptographic device, and the decryption key and the signature function of the smart cryptographic device are used.
  • the private keys are different, thereby reducing the number of times the private key used by the signature function is used, reducing the possibility of using the private key used by the brute force signature function, and improving the security of the information storage.
  • the dynamic password generation function in the present application is built in the security chip of the smart cryptographic device. Since the security chip is a secure environment, the dynamic password generation function can be ensured, and for the smart cryptographic device, no hardware is needed. The cost makes the electronic signature function and the dynamic password function integrated in one chip, and the display device is shared, and the structure design is simple and evident.
  • the audio interface in the present invention may be replaced by a first interface
  • the first interface may be any interface such as an NFC interface, a Bluetooth interface, an OTG interface, a USB interface, an infrared interface, an optical transmission interface, etc.
  • the PIN code is encoded to conform to the respective protocols for transmitting data on different interfaces, which improves the versatility and ease of use of the smart cryptographic device.
  • FIG. 2 is a flow chart of an embodiment of a method for processing transaction request information provided by the present invention.
  • the method embodiment shown in Figure 2 includes the following steps:
  • the dynamic password is generated by the method described in the foregoing steps 101 to 106.
  • For the method for generating the dynamic password refer to the entire content of the embodiment 1, and details are not described herein again.
  • Step 107 The mobile terminal acquires a dynamic password, and sends a dynamic password to the background server.
  • Step 108 The background server receives the dynamic password and verifies the dynamic password. If the verification passes, the transaction is executed.
  • step 107 the mobile terminal obtains the dynamic password in at least two ways:
  • Method 1 The smart password device displays a dynamic password, and the mobile terminal receives the dynamic password input by the user;
  • Manner 2 The smart cryptographic device sends a dynamic password to the mobile terminal through the audio interface, and the mobile terminal receives the dynamic password.
  • the first method requires the user to manually input the dynamic password on the mobile terminal, and the second method does not require manual input by the user, and the two methods can be selected according to actual needs.
  • the background server can verify that the dynamic password has passed before the transaction can be completed.
  • the scenes of the prior art operation by means of the keyboard are respectively input PIN code and input challenge code, but in the method embodiment provided by the present invention, the mobile terminal sends the PIN code to implement the use of the user.
  • the access control of the dynamic password, and the input of the PIN code is compared with the input on the keyboard of the smart cryptographic device in the prior art, and the keyboard function of the mobile terminal is borrowed, and the mobile terminal sends the smart password device to the smart cryptographic device through the audio interface, thereby completing
  • the input of the PIN code makes the smart cryptographic device not need to set the numeric keypad, which greatly reduces the volume of the smart cryptographic device; in addition, in order to ensure the secure transmission of the PIN code, the encryption is performed by the one-time key, thereby reducing the possibility of the PIN code being stolen.
  • the security of the information transmission is ensured; in addition, compared with the input code of the prior art by the user, the challenge code in the present application is transmitted by the mobile terminal to the smart cryptographic device through the audio interface, and the user is manually input, thereby optimizing the user's Enter the action.
  • FIG. 3 is a schematic structural diagram of an embodiment of a dynamic password generation system provided by the present invention.
  • the system embodiment shown in FIG. 3 includes a mobile terminal 30, a background server 40, and a smart cryptographic device 50, wherein:
  • the mobile terminal 30 is configured to acquire transaction information, and generate a transaction request according to the transaction information, and send the transaction request to the background server 40, wherein the transaction request includes at least the transaction information and the challenge code request; and send the encrypted data packet to the mobile terminal 30.
  • the smart cryptographic device 50 Before the smart cryptographic device 50, it is detected whether the smart cryptographic device 50 has been inserted; if the smart cryptographic device 50 has been inserted, the PIN code of the smart cryptographic device 50 is obtained; and the PIN code is encrypted by the one-time key to obtain the encrypted PIN code. Encoding the encrypted PIN code to obtain encoded data, and transmitting the encoded data to the smart cryptographic device 50 through an audio interface, wherein the PIN code is used to enable the functional privilege of the smart cryptographic device 50;
  • the background server 40 is configured to receive the transaction request, and generate a challenge code of the transaction request according to the preset challenge code generation policy; at least encrypt the challenge code by using the encryption key, obtain the encrypted data packet, and send the encryption to the mobile terminal 30. data pack;
  • the smart cryptographic device 50 is configured to receive the encoded data, decode the encoded data, obtain the encrypted PIN code, verify the validity of the PIN code according to the encrypted PIN code, and if the verification PIN code is legal, enable the dynamic password generating function, and
  • the mobile terminal 30 transmits the state switching success information; and decrypts the encrypted data packet by using the decryption key corresponding to the encryption key to obtain the decrypted data, and outputs the decrypted data; and after receiving the confirmation instruction for the decrypted data, the current generation is generated.
  • the dynamic password corresponding to the transaction is configured to receive the encoded data, decode the encoded data, obtain the encrypted PIN code, verify the validity of the PIN code according to the encrypted PIN code, and if the verification PIN code is legal, enable the dynamic password generating function, and
  • the mobile terminal 30 transmits the state switching success information; and decrypts the encrypted data packet by using the decryption key corresponding to the encryption key to obtain the decrypted data,
  • the scenes of the prior art operation by means of the keyboard are respectively input PIN code and input challenge code, but in the method embodiment provided by the present invention, the mobile terminal sends the PIN code to implement the use of the user.
  • the access control of the dynamic password, and the input of the PIN code is compared with the input on the keyboard of the smart cryptographic device in the prior art, and the keyboard function of the mobile terminal is borrowed, and the mobile terminal sends the smart password device to the smart cryptographic device through the audio interface, thereby completing
  • the input of the PIN code makes the smart cryptographic device not need to set the numeric keypad, which greatly reduces the volume of the smart cryptographic device; in addition, in order to ensure the secure transmission of the PIN code, the encryption is performed by the one-time key, thereby reducing the possibility of the PIN code being stolen.
  • the security of the information transmission is ensured; in addition, compared with the input code of the prior art by the user, the challenge code in the present application is transmitted by the mobile terminal to the smart cryptographic device through the audio interface, and the user is manually input, thereby optimizing the user's Enter the action.
  • the mobile terminal 30 further uses the payment account and/or the payment account of the transaction information to further simplify the user input operation, and the mobile terminal 30 is further configured to obtain the payment account of the transaction information and/or Before the payment account is displayed, the account information recorded in the history record is displayed. If there is an account number in the history record, a selection instruction for the displayed account information is received, and the selected account is saved as the transaction information, if there is no corresponding account in the history record. And receiving the account information input by the user, saving the account information input by the user as the transaction information, and adding the account information input by the user to the history record.
  • the mobile terminal 30 may also transmit other information, such as time synchronization information, to ensure that the time when the smart cryptographic device 50 generates the dynamic password is synchronized with the background server.
  • the encrypted data packet further includes time synchronization information for synchronizing the time of the clock module in the smart cryptographic device 50; the smart cryptographic device 50 is further configured to use the time synchronization information obtained by the decryption and the dynamic password function in the smart cryptographic device 50.
  • the time of the module is compared to obtain a time difference, and the time difference is compared with the locally stored time error range.
  • the user is prompted to perform time synchronization; if a synchronization command is received, According to the time synchronization information, the time of the clock module is adjusted, and after the adjustment is completed, the dynamic password generation process is executed.
  • the one-time key used between the mobile terminal 30 and the smart cryptographic device 50 may be negotiated between the mobile terminal 30 and the smart cryptographic device 50, thereby implementing the mobile terminal 30 and the smart device.
  • a secure channel is established between the cryptographic devices 50. For example, it can be implemented by one of the following methods:
  • the mobile terminal 30 is further configured to acquire the public key of the smart cryptographic device 50, encrypt the locally generated software random number K1 with the public key, and send the encrypted software random number K1' to the smart cryptographic device 50; and utilize the software.
  • the random number K1 decrypts the encrypted hardware random number K2' to obtain the hardware random number K2, and the hardware random number K2 is used.
  • the PIN code is encrypted by using the hardware random number K2 to obtain the encrypted PIN code;
  • the smart cryptographic device 50 is further configured to receive the encrypted software random number K1', and decrypt the encrypted software random number K1' by using the private key corresponding to the public key to obtain a software random number K1; and generate a hardware random number K2 And encrypting the hardware random number K2 by using the software random number K1, obtaining the encrypted hardware random number K2', transmitting the encrypted hardware random number K2' to the mobile terminal 30; and receiving the encrypted PIN code, and using the hardware random number K2 decrypts the encrypted PIN code to obtain the PIN code; compares the obtained PIN code with the locally stored PIN code, and if the two PIN codes are the same, the verification passes.
  • the mobile terminal 30 is further configured to acquire the public key of the smart cryptographic device 50 and the random number generated by the smart cryptographic device 50, and encrypt the sequence consisting of the random number and the PIN code by using the public key to obtain an encryption result;
  • the smart cryptographic device 50 is further configured to decrypt the encrypted result by using the private key, obtain a sequence, and obtain a PIN code from the sequence by using a random number, and compare the obtained PIN code with the locally saved PIN code, if two PINs If the codes are the same, the verification is passed.
  • the random number generated by the smart cryptographic device 50 acquired by the mobile terminal 30 may be negotiated between the mobile terminal 30 and the smart cryptographic device 50, for example, by using a software random number and a hardware random number similar to the foregoing manner 1.
  • the encryption method is obtained, and the random number is transmitted by encryption to ensure the security of the random number transmission and prevent the insecure hidden danger caused by the stolen; the random number can also be the secure transmission channel through the audio interface without directly encrypting from the smart password device. Get in 50, improve the speed of getting the random number.
  • the mobile terminal 30 is further configured to obtain a random number, and combine the random number and the PIN code into a first sequence, perform a hash algorithm calculation on the first sequence, and obtain a first calculation result;
  • the smart cryptographic device 50 is further configured to obtain the second sequence in the same manner as the processing manner of the mobile terminal 30, and use the same hash algorithm to obtain a second calculation result, and compare the first calculation result with the second calculation result. Yes, if the first calculation result and the second calculation result are the same, the verification is passed.
  • the hardware random number in this mode can also be obtained by using the hardware random number in the first mode to ensure the security of the hardware random number. It can also be directly obtained from the smart crypto device through the secure transmission channel of the audio interface without encryption, thereby improving the acquisition speed.
  • the encryption key and the decryption key in the first mode and the second mode are asymmetric public and private key pairs, and the encryption key is different from the public key of the smart password device, and the decryption key is different from the private key of the smart password device. That is, the encryption key is different from the public key used in the smart cryptographic device to perform the electronic signature function, and the decryption key is different from the private key used in the smart cryptographic device to perform the electronic signature function.
  • the encryption key is different from the public key used in the smart cryptographic device to perform the electronic signature function
  • the decryption key is different from the private key used in the smart cryptographic device to perform the electronic signature function.
  • the smart cryptographic device 50 includes a security chip, wherein the security chip is used to perform a dynamic password generation function; the security chip may be a security chip that implements an electronic signature function of the smart cryptographic device. Since the security chip is a secure environment, the dynamic password generation function can be ensured, and the smart password device 50 does not need to increase the hardware cost, so that the electronic signature function and the dynamic password generation function are integrated into one chip, and the shared display device is shared. The structure design is simple and naked.
  • the security chip of the smart cryptographic device 50 is also used to perform an electronic signature function.
  • the electronic signature can implement all the functions of the digital signature in the prior art.
  • the security chip of the smart cryptographic device 50 provided by the present invention can form a security environment, and thus the smart cryptographic device in the present invention is not needed.
  • the related hardware tampering structure is set in 50, which saves hardware cost.
  • the audio interface in the present invention may be replaced by a first interface
  • the first interface may be any interface such as an NFC interface, a Bluetooth interface, an OTG interface, a USB interface, an infrared interface, an optical transmission interface, etc.
  • the PIN code is encoded to conform to the respective protocols for transmitting data on different interfaces, which improves the versatility and ease of use of the smart cryptographic device.
  • the system for processing transaction request information provided by the present invention includes:
  • the mobile terminal 30 is further configured to acquire a dynamic password and send a dynamic password to the background server 40.
  • the background server 40 is further configured to receive the dynamic password and verify the dynamic password. If the verification is passed, the current transaction is executed.
  • the mobile terminal 30 is further configured to obtain a dynamic password by using one of the following manners, including:
  • Manner 1 The smart cryptographic device 50 displays a dynamic password, and the mobile terminal 30 receives the dynamic password input by the user;
  • Manner 2 The smart cryptographic device 50 transmits a dynamic password to the mobile terminal 30 via the audio interface, and the mobile terminal 30 receives the dynamic password.
  • the first method requires the user to manually input the dynamic password on the mobile terminal, and the second method does not require manual input by the user, and the two methods can be selected according to actual needs.
  • the background server 40 can verify that the dynamic password has passed before completing the transaction.
  • the scenes of the prior art operation by means of the keyboard are respectively input PIN code and input challenge code, but in the method embodiment provided by the present invention, the mobile terminal sends the PIN code to implement the use of the user.
  • Dynamic password Access control and the input of the PIN code is compared with the input on the keyboard of the smart password device in the prior art, and the keyboard function of the mobile terminal is borrowed, and the mobile terminal sends the smart password device through the audio interface, thereby completing the PIN code.
  • the smart password device does not need to set the numeric keypad, which greatly reduces the size of the smart password device; in addition, in order to ensure the secure transmission of the PIN code, the one-time key is used for encryption, which reduces the possibility of the PIN code being stolen, and ensures the information.
  • the challenge code is transmitted by the mobile terminal to the smart cryptographic device through the audio interface, and the input operation of the user is optimized.
  • portions of the invention may be implemented in hardware, software, firmware or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
  • each functional unit in each embodiment of the present invention may be integrated into one processing module, or each unit may exist physically separately, or two or more units may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the integrated modules, if implemented in the form of software functional modules and sold or used as stand-alone products, may also be stored in a computer readable storage medium.
  • the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephone Function (AREA)

Abstract

本发明提供一种动态口令生成方法和系统，处理交易请求的方法和系统，动态口令生成方法包括：移动终端接收后台服务器发送的加密数据包，将加密后的PIN码发送至智能密码设备，智能密码设备验证PIN码合法，开启动态口令生成功能并接收加密数据包，生成本次交易对应的动态口令。本发明借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积。

Description

动态口令生成方法和系统、交易请求的处理方法和系统 技术领域
本发明涉及一种电子技术领域，尤其涉及一种动态口令生成方法和系统、交易请求的处理方法和系统。
背景技术
随着网络的迅速发展给人们带来的极大便利，人们越来越依赖于网络进行各种活动，例如网络文件的传输、网上银行交易均已逐渐成为人们生活、工作中不可缺少的一部分。由于网络毕竟是一个虚拟的环境，存在着太多不安全的因素，而在网络环境中必然会进行数据交互的网络活动，尤其是像网上银行业务和机密文件的传输这样的网络活动，对网络的安全提出了很高的要求，因此人们开始大力发展网络信息安全技术。
数字签名技术就是一种为了确保用户数据在网络的传输过程中不会被人恶意修改的网络信息安全技术。所谓数字签名技术，就是一种进行身份认证的技术，可用于安全地传送命令和文件。数字签名技术通过一个单向函数对要传送的用户数据进行处理，得到用以认证数据来源并核实数据是否发生变化的一个字母数字串。通常数字签名采用MD5、SHA-1等散列算法对要传送的数据计算一个摘要值，并采用加密算法对这个摘要值进行加密然后进行传送。目前数字签名采用较多的是公钥加密技术，如基于RSA Date Security公司的PKCS(Public Key Cryptography Standards)、Digital Signature Algorithm、x.509、PGP(Pretty Good Privacy).1994年美国标准与技术协会公布了数字签名标准(DSS)而使公钥加密技术广泛应用。这种在数字化文档上的数字签名类似于纸张上的手写签名，是不可伪造的，文档的接收者能够验证文档确实来自签名者，并且签名后的文档没有被修改过，从而保证接收的文档中信息的真实性和完整性。完善的数字签名技术应满足以下三个条件：第一，签名者事后不能抵赖自己的签名；第二，任何其它人不能伪造签名；第三，如果当事人双方关于签名的真伪发生争执，能够在公正的仲裁者面前通过验证签名来确认其真伪。
对数据进行数字签名后，可以很大程度上增加数据的安全性。但是，黑客技术的发展依然使用户非常担忧，因为一旦恶意攻击者控制了用户的使用的终端，他们就可以截取终端内存中出现的数据，对终端合法用户的利益造成伤害。因此人们研制出了一种便携式的可移动使用的智能密码设备，也称为Key设备，包括：USB Key、蓝牙Key以及支持手机音频接口的音频Key等任意形式的设备。这是一种带有微处理器的小型硬件设备，其通过终端数据通讯接口与终端建立连接，设备内的处理器一般会采用安全设计芯片实现，利用 其内置的安全机制，实现密钥生成、密钥安全存储和预置加密算法等功能，与密钥相关的运算完全在认证设备内部执行，所以安全性很高。同时，令智能密码设备包含显示屏以及确认按键，需要签名的交易请求报文必须发送至智能密码设备的显示屏进行显示，并且在显示无误后，经用户手动按确认键进行确认后，方可将签名数据返回至计算。这样即便黑客控制了用户的终端，但是无法控制智能密码设备，并且更不能控制用户手动按确认键进行确认，因此安全性得到了很大提高。
另外，银行和各种大型电子商务网站还同时采用动态口令令牌或动态口令卡来加强网络身份认证的安全性。
动态口令技术又称为一次性口令(One Time Password，简称OTP)技术，其特点是用户根据服务商提供的动态口令令牌的显示数字来输入动态密码，以便进行网络交易。现有的动态口令牌(One Time Password，OTP)存在不同种类的动态口令生成方式，例如：基于时间型的动态口令牌，基于事件型的动态口令牌，以及基于挑战应答型的动态口令牌，或者基于上述三种类型的任意组合型的动态口令牌。
基于上述两种网络身份认证技术，人们开发出了一种新型智能密码设备，其集成了数字签名技术以及动态口令技术，具备现有的Key设备具有的数字签名功能，同时还具备现有的动态口令牌具有的动态口令生成功能，在方便人们使用的同时还减少了设备数量。
但是在智能密码设备的动态口令生成功能为基于挑战/应答式的动态口令生成方式时，需要用户输入挑战码，从而根据挑战码生成动态口令，挑战码的输入方式是由用户对智能密码设备上的数字的操作实现挑战码的输入，需要在该智能密码设备上设置0～9共10个数字键，使得智能密码设备的体积过大，不利于携带，因此如何减小智能密码设备的体积以及实现安全、简便的输入挑战码是亟待解决的技术问题。
发明内容
本发明旨在解决上述问题/之一，提供一种动态口令生成方法和系统、交易请求的处理方法和系统。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明一方面提供了一种动态口令生成方法，包括：移动终端获取交易信息，并根据交易信息生成交易请求，并将所述交易请求发送至后台服务器，其中所述交易请求至少包括交易信息以及挑战码请求；所述后台服务器接收所述交易请求，并根据预先设置的挑战码生成策略，生成所述交易请求的挑战码；再利用加密密钥至少对所述挑战码进行加密，得到加密数据包，并向所述移动终端发送所述加密数据包；在移动终端将所述加密数据包 发送给智能密码设备之前，所述移动终端检测智能密码设备是否已插入；如果所述智能密码设备已插入，则获取所述智能密码设备的PIN码；并通过一次性密钥加密所述PIN码，得到加密后的PIN码，对所述加密后的PIN码进行编码，得到编码数据，并通过音频接口将所述编码数据发送至所述智能密码设备，其中，所述PIN码用于开启所述智能密码设备的功能权限；所述智能密码设备接收所述编码数据，对所述编码数据进行解码，获得所述加密后的PIN码，根据所述加密后的PIN码验证所述PIN码的合法性，如果验证所述PIN码合法，开启动态口令生成功能，并向所述移动终端发送状态切换成功信息；所述移动终端在接收到状态切换成功信息后，通过音频接口将接收到的所述加密数据包发送给智能密码设备；所述智能密码设备利用加密密钥对应的解密密钥对所述加密数据包进行解密，得到解密数据，并输出所述解密数据；当接收到对所述解密数据的确认指令后，生成本次交易对应的动态口令。
此外，所述移动终端获取交易信息，包括：所述移动终端在获取交易信息的付款账号和/或收款账号之前，显示历史记录中记载的账号信息，如果历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
此外，所述加密数据包还包括时间同步信息，用以同步智能密码设备中时钟模块的时间；所述方法还包括：智能密码设备将解密得到的时间同步信息与所述智能密码设备中动态口令功能中时钟模块的时间进行比较，得到时间差值，将所述时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
此外，所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：移动终端获取智能密码设备的公钥，并利用所述公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备；智能密码设备接收所述加密后的软件随机数K1’，并利用所述公钥对应的私钥对所述加密后的软件随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用所述软件随机数K1加密所述硬件随机数K2，得到加密后的硬件随机数K2’，发送所述加密后的硬件随机数K2’至移动终端；所述移动终端利用所述软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码；所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：所 述智能密码设备接收所述加密后的PIN码，并利用所述硬件随机数K2解密所述加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
此外，所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：移动终端获取智能密码设备的公钥和智能密码设备生成的随机数，并利用所述公钥对所述随机数和PIN码组成的序列进行加密，得到加密结果；所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：所述智能密码设备利用私钥对所述加密结果进行解密，得到所述序列，并利用所述随机数，从所述序列中获取所述PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
此外，所述加密密钥和所述解密密钥为非对称公私钥对，且所述加密密钥与所述智能密码设备的公钥不同，所述解密密钥与智能密码设备的私钥不同。
此外，所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：所述移动终端获取随机数，并将该随机数和PIN码组成第一序列，对所述第一序列进行哈希算法计算；得到第一计算结果；所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：所述智能密码设备按照与移动终端的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将所述第一计算结果和所述第二计算结果进行比对，如果所述第一计算结果和所述第二计算结果相同，则验证通过。
本发明另一方面提供了一种处理交易请求信息的方法，包括：通过上述的方法生成动态口令；所述移动终端获取所述动态口令，并向所述后台服务器发送所述动态口令；所述后台服务器接收所述动态口令，并对所述动态口令进行验证，如果验证通过，则执行本次交易。
此外，所述移动终端获取动态口令，包括：方式一：所述智能密码设备显示所述动态口令，所述移动终端接收用户输入的动态口令；方式二：所述智能密码设备通过音频接口向所述移动终端发送所述动态口令，所述移动终端接收所述动态口令。
本发明又一方面提供了一种动态口令生成系统，包括移动终端、后台服务器和智能密码设备，其中：所述移动终端用于获取交易信息，并根据交易信息生成交易请求，并将所述交易请求发送至后台服务器，其中所述交易请求至少包括交易信息以及挑战码请求；并在移动终端将所述加密数据包发送给智能密码设备之前，检测智能密码设备是否已插入；如果所述智能密码设备已插入，则获取所述智能密码设备的PIN码；并通过一次性密钥加密所述PIN码，得到加密后的PIN码，对所述加密后的PIN码进行编码，得到编码数据，并通过音频接口将所述编码数据发送至所述智能密码设备，其中，所述PIN码用于开启所 述智能密码设备的功能权限；
所述后台服务器用于接收所述交易请求，并根据预先设置的挑战码生成策略，生成所述交易请求的挑战码；再利用加密密钥至少对所述挑战码进行加密，得到加密数据包，并向所述移动终端发送所述加密数据包；所述智能密码设备用于接收所述编码数据，对所述编码数据进行解码，获得所述加密后的PIN码，根据所述加密后的PIN码验证所述PIN码的合法性，如果验证所述PIN码合法，开启动态口令生成功能，并向所述移动终端发送状态切换成功信息；并利用加密密钥对应的解密密钥对所述加密数据包进行解密，得到解密数据，并输出所述解密数据；当接收到对所述解密数据的确认指令后，生成本次交易对应的动态口令。
此外，所述移动终端还用于在获取交易信息的付款账号和/或收款账号之前，显示历史记录中记载的账号信息，如果历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
此外，所述加密数据包还包括时间同步信息，用以同步智能密码设备中时钟模块的时间；所述智能密码设备还用于将解密得到的时间同步信息与所述智能密码设备中动态口令功能中时钟模块的时间进行比较，得到时间差值，将所述时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
此外，所述移动终端还用于获取智能密码设备的公钥，并利用所述公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备；以及利用所述软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码；所述智能密码设备还用于接收所述加密后的软件随机数K1’，并利用所述公钥对应的私钥对所述加密后的软件随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用所述软件随机数K1加密所述硬件随机数K2，得到加密后的硬件随机数K2’，发送所述加密后的硬件随机数K2’至移动终端；以及接收所述加密后的PIN码，并利用所述硬件随机数K2解密所述加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
此外，所述移动终端还用于获取智能密码设备的公钥和智能密码设备生成的随机数， 并利用所述公钥对所述随机数和PIN码组成的序列进行加密，得到加密结果；所述智能密码设备还用于利用私钥对所述加密结果进行解密，得到所述序列，并利用所述随机数，从所述序列中获取所述PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
此外，所述加密密钥和所述解密密钥为非对称公私钥对，且所述加密密钥与所述智能密码设备的公钥不同，所述解密密钥与智能密码设备的私钥不同。
此外，所述移动终端还用于获取随机数，并将该随机数和PIN码组成第一序列，对所述第一序列进行哈希算法计算；得到第一计算结果；所述智能密码设备还还用于按照与移动终端的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将所述第一计算结果和所述第二计算结果进行比对，如果所述第一计算结果和所述第二计算结果相同，则验证通过。
此外，所述智能密码设备包括安全芯片，其中所述安全芯片用于生成动态口令。
此外，所述安全芯片还用于进行电子签名。
本发明再一方面提供了一种处理交易请求信息的系统，包括：上述的动态口令生成系统，其中，所述移动终端还用于获取所述动态口令，并向所述后台服务器发送所述动态口令；所述后台服务器还用于接收所述动态口令，并对所述动态口令进行验证，如果验证通过，则执行本次交易。
此外，所述移动终端还用于通过如下方式之一获取动态口令，包括：方式一：所述智能密码设备显示所述动态口令，所述移动终端接收用户输入的动态口令；方式二：所述智能密码设备通过音频接口向所述移动终端发送所述动态口令，所述移动终端接收所述动态口令。
由上述本发明提供的技术方案可以看出，在生成动态口令过程中，需要借助键盘的操作的场景分别为输入PIN码和输入挑战码，但本发明提供的方法实施例中移动终端发送PIN码实现对用户使用的动态口令的访问控制，且PIN码的输入与现有技术中是在智能密码设备的键盘上输入相比，借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积；另外，为了保证PIN码的安全传输，通过一次性密钥进行加密，降低了PIN码被盗的可能，保证了信息传输的安全；另外，与现有技术中挑战码由用户输入相比，本申请中挑战码是由移动终端通过音频接口传输给智能密码设备，无需用户手动输入的，优化了用户的输入操作。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他附图。
图1为本发明实施例1提供的动态口令生成方法实施例的流程示意图；
图2为本发明实施例2提供的交易请求的处理方法实施例的流程示意图；
图3为本发明实施例3提供的动态口令生成系统实施例的结构示意图。
具体实施方式
下面结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明的保护范围。
在本发明的描述中，需要理解的是，术语“中心”、“纵向”、“横向”、“上”、“下”、“前”、“后”、“左”、“右”、“竖直”、“水平”、“顶”、“底”、“内”、“外”等指示的方位或位置关系为基于附图所示的方位或位置关系，仅是为了便于描述本发明和简化描述，而不是指示或暗示所指的装置或元件必须具有特定的方位、以特定的方位构造和操作，因此不能理解为对本发明的限制。此外，术语“第一”、“第二”仅用于描述目的，而不能理解为指示或暗示相对重要性或数量或位置。
在本发明的描述中，需要说明的是，除非另有明确的规定和限定，术语“安装”、“相连”、“连接”应做广义理解，例如，可以是固定连接，也可以是可拆卸连接，或一体地连接；可以是机械连接，也可以是电连接；可以是直接相连，也可以通过中间媒介间接相连，可以是两个元件内部的连通。对于本领域的普通技术人员而言，可以具体情况理解上述术语在本发明中的具体含义。
下面将结合附图对本发明实施例作进一步地详细描述。
实施例1
图1为本发明提供的动态口令生成方法实施例的流程示意图。图1所示方法实施例包括如下步骤：
步骤101、移动终端获取交易信息，并根据交易信息生成交易请求，并将交易请求发送至后台服务器，其中交易请求至少包括交易信息以及挑战码请求；
其中，移动终端可以为手机、平板电脑等便携式终端；交易信息至少包括付款账号、收款账户和金额等；
具体的，当移动终端接收到交易信息后，移动终端默认选择动态口令的方式来支付；当然，移动终端也可以向后台系统服务器查询支付方式，再根据查询请求后，确定支付方式为动态口令的支付方式，进而生成交易请求。
步骤102、后台服务器接收交易请求，并根据预先设置的挑战码生成策略，生成交易请求的挑战码；再利用加密密钥至少对挑战码进行加密，得到加密数据包，并向移动终端发送加密数据包；
其中，现有技术中挑战码的生成方式均适用于本步骤，此处不再赘述；
另外，加密密钥可以是对称密钥或非对称密钥算法的公钥。其中，当该加密密钥为非对称密钥算法的公钥时，当动态口令功能与USBkey的签名功能集成在一起时，该加密密钥可以是智能密码设备中签名功能所使用的私钥对应的公钥，减少后台服务器存储的密钥数量，且方便查找该加密密钥，从而缩短了加密时间，提高后台服务器的处理速度。
步骤103、在移动终端将加密数据包发送给智能密码设备之前，移动终端检测智能密码设备是否已插入；如果智能密码设备已插入，则获取智能密码设备的PIN码；并通过一次性密钥加密PIN码，得到加密后的PIN码，对加密后的PIN码进行编码，得到编码数据，并通过音频接口将编码数据发送至智能密码设备，其中，PIN码用于开启智能密码设备的功能权限；
具体来说，移动终端检测智能密码设备是否已插入的步骤可以是在接收到加密数据包之前执行，也可以在检测到接收到加密数据包后执行的；此外，移动终端检测智能密码设备是否已插入且获取PIN码，将加密后的PIN码发送至智能密码设备的步骤可以是在接收到加密数据包之前执行，也可以在检测到接收到加密数据包后执行的。
当然，在移动终端检测到智能密码设备插入后，还可以检测该智能密码设备是否合法，在检测到该智能密码设备合法后，执行获取PIN码、加密PIN码以及发送的流程。检测智能密码设备合法，可以确认接收端的合法性，提高信息传输的安全性。
其中，采用一次性密钥加密该PIN码，提高了PIN码传输的安全性。具体的，一次性密钥是一个加密密钥，但使用的有效次数为1次，即当一次性密钥M在使用过后，该密钥M就不再使用了，使得黑客无法借助密钥窃取PIN码。
此外，对加密后的PIN码进行编码，使其符合音频接口传输数据的协议，通过移动终 端的音频接口进行数据传输，提高了智能密码设备的通用性和易用性。
步骤104、智能密码设备接收编码数据，对编码数据进行解码，获得加密后的PIN码，根据加密后的PIN码验证PIN码的合法性，如果验证PIN码合法，开启动态口令生成功能，并向移动终端发送状态切换成功信息；
由步骤103和步骤104可以看出，在移动终端发送加密数据包之前，通过向智能密码设备传输PIN码，可以实现对用户身份的认证，防止不法分子使用该智能密码设备的动态口令功能进行非法交易，提高账号安全；另外，在移动终端和智能密码设备之间通过一次性密钥来传输PIN码，保证了PIN码的传输安全，降低了PIN码被盗的可能，也进一步减少了不法分子使用该智能密码设备的动态口令功能进行非法交易的机会，保障了账户安全。
步骤105、移动终端在接收到状态切换成功信息后，通过音频接口将接收到的加密数据包发送给智能密码设备；
步骤106、智能密码设备利用加密密钥对应的解密密钥对加密数据包进行解密，得到解密数据，并输出解密数据；当接收到对解密数据的确认指令后，生成本次交易对应的动态口令；
具体的，智能密码设备接收到加密数据包后，采用与后台服务器采用的加密密钥对应的解密密钥解密该加密数据包，从该加密数据包中解析出挑战码，输出该挑战码至智能密码设备的显示屏上，以提供用户进行确认，当用户确认该挑战码正确后，按下智能密码设备上的确认按键，智能密码设备接收到该确认指令后，生成本次交易的动态口令，输出该动态口令至显示屏上进行显示或者将该动态口令发送给移动终端。
由上可以看出，在生成动态口令过程中，现有技术中借助键盘的操作的场景分别为输入PIN码和输入挑战码，但本发明提供的方法实施例中移动终端发送PIN码实现对用户使用的动态口令的访问控制，且PIN码的输入与现有技术中是在智能密码设备的键盘上输入相比，借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积；另外，为了保证PIN码的安全传输，通过一次性密钥进行加密，降低了PIN码被盗的可能，保证了信息传输的安全；另外，与现有技术中挑战码由用户输入相比，本申请中挑战码是由移动终端通过音频接口传输给智能密码设备，无需用户手动输入的，优化了用户的输入操作。
在上述方法流程中，方法实施例还可以包括如下步骤，具体内容如下：
在步骤101中，移动终端在获取交易信息过程中，在获取交易信息的付款账号和/或收款账号之前，为进一步简化用户输入操作，还可以显示历史记录中记载的账号信息，如果 历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
在步骤102中，在发送该挑战码的同时，还可以发送其他信息，如时间同步信息，用以同步智能密码设备中时钟模块的时间；相对应的，在步骤106中，在生成本次交易对应的动态口令之前，智能密码设备还执行如下操作：将解密得到的时间同步信息与智能密码设备中动态口令功能中时钟模块的时间进行比较，得到时间差值，将时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
在从后台服务器获取挑战码的同时，接收时间同步信息，使得执行动态口令功能的时间因子能够实时与后台服务器同步，保证动态口令生成的准确性，降低因时间不同步造成动态口令验证失败的问题发生。
其中，获取智能密码设备中动态口令功能对应的PIN码的过程如下：
步骤A1、移动终端通过音频接口与智能密码设备相连；
步骤A2、移动终端输出提示用户输入PIN码的信息；
具体的，移动终端可以通过一个交互界面请求用户输入信息，该交互界面的内容可以根据实际需要进行自定义。
步骤A3、移动终端对移动终端接收的按键信息进行检测，得到检测结果；
具体的，移动终端通过在交互页面上用户针对该提示信息输入的内容进行检测；其中用户可以通过手机的硬件键盘或触摸屏上的键盘等实现对上述提示信息的反馈。
步骤A4、移动终端对检测结果进行解析，得到PIN码。
由上述步骤可以看出，PIN码的信息是通过移动终端发送给智能密码设备的，满足了用户手动输入PIN码的基本要求，符合安全规范，且由于借用了移动终端上的按键功能，无需在动态口令牌上部署按键信息，达到了缩小动态口令牌体积的目的。
在步骤103和104中，一次性密钥是通过移动终端与智能密码设备协商得到的，从而实现移动终端与智能密码设备之间建立安全通道，具体实现方式包括：
方式一：
移动终端获取智能密码设备的公钥，并利用公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备；
智能密码设备接收加密后的软件随机数K1’，并利用公钥对应的私钥对加密后的软件 随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用软件随机数K1加密硬件随机数K2，得到加密后的硬件随机数K2’，发送加密后的硬件随机数K2’至移动终端；
移动终端利用软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码，并向智能密码设备发送加密后的PIN码；
智能密码设备接收加密后的PIN码，并利用硬件随机数K2解密加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
本方式中，与本领域常用的使用随机数相比，本方式采用的硬件随机数，较本领域惯用的软件随机数随机性强，使得加密效果更好，另外，在获取硬件随机数过程中，以软件随机数作为密钥传输硬件随机数，保证传输过程的安全。
方式二：
移动终端获取智能密码设备的公钥和智能密码设备生成的随机数，并利用公钥对随机数和PIN码组成的序列进行加密，得到加密结果，并向智能密码设备发送加密结果；
智能密码设备利用私钥对加密结果进行解密，得到序列，并利用随机数，从序列中获取PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
本方式中，通过将随机数与PIN码组成序列，降低了黑客得到私钥破解该序列后从序列里破解PIN码的可能，有效降低了破解可能，提高了PIN码传输的安全性。
优选的，本方式中随机数可以是硬件随机数，以增加序列的随机性，当然，移动终端获取硬件随机数的方式也可以采用方式一中硬件随机数的方式来获取，以保证随机数传输的安全。
另外，本方式中，上述移动终端获取的智能密码设备生成的随机数可以是移动终端与智能密码设备协商得到的，例如通过类似于方式一的互相加密的方式得到，通过加密传输该随机数保证了随机数传输的安全性，防止被窃取造成的不安全隐患；该随机数也可以是通过音频接口的安全传输通道不经加密直接从智能密码设备中获取，提高获取该随机数的速度。
方式三：
移动终端获取随机数，并将该随机数和PIN码组成第一序列，对第一序列进行哈希算法计算；得到第一计算结果，并向智能密码设备发送第一计算结果；
智能密码设备接收第一计算结果，并按照与移动终端的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将第一计算结果和第二计算结果进行比对，如果第一计算结果和第二计算结果相同，则验证通过。
本方式中，利用哈希算法不可逆的特性，通过由随机数和PIN码组成的序列进行计算，进而由智能密码设备判断移动终端的计算结果与本地的计算结果进行比对，实现对PIN码的验证，实现简单。
其中，本方式中的硬件随机数也可以采用方式一中硬件随手数的方式来获取，以保证硬件随机数的安全。也可以直接通过音频接口的安全传输通道不经加密直接从智能密码设备中获取，提高获取速度。
进一步需要说明的是，加密密钥和解密密钥为非对称公私钥对，且加密密钥与智能密码设备中签名功能所采用的公钥不同，解密密钥与智能密码设备中签名功能所采用的私钥不同，从而减少签名功能所采用的私钥的使用次数，减少暴力破解签名功能所采用的私钥的可能，提高信息存储的安全性。
需要说明的是，本申请中动态口令生成功能内置于智能密码设备的安全芯片中，由于安全芯片是一个安全环境，能够保证动态口令生成功能的安全，且对于智能密码设备而言，无需增加硬件成本，使得电子签名功能与动态口令功能集成于一个芯片中，且共用显示装置，结构设计简单精巧。
当然，本发明中的音频接口还可以替换为第一接口，该第一接口可以为NFC接口、蓝牙接口、OTG接口、USB接口、红外接口、光传输接口等任意形式的接口，其对加密后的PIN码进行编码，使其符合不同接口传输数据的各自的协议，提高了智能密码设备的通用性和易用性。
实施例2
图2为本发明提供的处理交易请求信息的方法实施例的流程图。图2所示方法实施例包括如下步骤：
通过上述步骤101至步骤106所述的方法生成动态口令；其生成方法参见实施例1的全部记载内容，在此不再赘述。
步骤107、移动终端获取动态口令，并向后台服务器发送动态口令；
步骤108、后台服务器接收动态口令，并对动态口令进行验证，如果验证通过，则执行本次交易。
在步骤107中，移动终端获取动态口令的方式至少有如下两种：
方式一：智能密码设备显示动态口令，移动终端接收用户输入的动态口令；
方式二：智能密码设备通过音频接口向移动终端发送动态口令，移动终端接收动态口令。
在上述方式中，方式一是需要用户在移动终端上手动输入动态口令的，方式二是无需用户手动输入的，两种方式可以根据实际需要进行选择。
基于本实施例，后台服务器验证动态口令通过后，才可以完成本次交易。由上可以看出，在生成动态口令过程中，现有技术中借助键盘的操作的场景分别为输入PIN码和输入挑战码，但本发明提供的方法实施例中移动终端发送PIN码实现对用户使用的动态口令的访问控制，且PIN码的输入与现有技术中是在智能密码设备的键盘上输入相比，借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积；另外，为了保证PIN码的安全传输，通过一次性密钥进行加密，降低了PIN码被盗的可能，保证了信息传输的安全；另外，与现有技术中挑战码由用户输入相比，本申请中挑战码是由移动终端通过音频接口传输给智能密码设备，无需用户手动输入的，优化了用户的输入操作。
实施例3
图3为本发明提供的动态口令生成系统实施例的结构示意图。图3所示系统实施例包括移动终端30、后台服务器40和智能密码设备50，其中：
移动终端30用于获取交易信息，并根据交易信息生成交易请求，并将交易请求发送至后台服务器40，其中交易请求至少包括交易信息以及挑战码请求；并在移动终端30将加密数据包发送给智能密码设备50之前，检测智能密码设备50是否已插入；如果智能密码设备50已插入，则获取智能密码设备50的PIN码；并通过一次性密钥加密PIN码，得到加密后的PIN码，对加密后的PIN码进行编码，得到编码数据，并通过音频接口将编码数据发送至智能密码设备50，其中，PIN码用于开启智能密码设备50的功能权限；
后台服务器40用于接收交易请求，并根据预先设置的挑战码生成策略，生成交易请求的挑战码；再利用加密密钥至少对挑战码进行加密，得到加密数据包，并向移动终端30发送加密数据包；
智能密码设备50用于接收编码数据，对编码数据进行解码，获得加密后的PIN码，根据加密后的PIN码验证PIN码的合法性，如果验证PIN码合法，开启动态口令生成功能，并向移动终端30发送状态切换成功信息；并利用加密密钥对应的解密密钥对加密数据包进行解密，得到解密数据，并输出解密数据；当接收到对解密数据的确认指令后，生成本次 交易对应的动态口令。
由上可以看出，在生成动态口令过程中，现有技术中借助键盘的操作的场景分别为输入PIN码和输入挑战码，但本发明提供的方法实施例中移动终端发送PIN码实现对用户使用的动态口令的访问控制，且PIN码的输入与现有技术中是在智能密码设备的键盘上输入相比，借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积；另外，为了保证PIN码的安全传输，通过一次性密钥进行加密，降低了PIN码被盗的可能，保证了信息传输的安全；另外，与现有技术中挑战码由用户输入相比，本申请中挑战码是由移动终端通过音频接口传输给智能密码设备，无需用户手动输入的，优化了用户的输入操作。
另外，移动终端30在获取交易信息过程中，在获取交易信息的付款账号和/或收款账号之前，为进一步简化用户输入操作，移动终端30还用于在获取交易信息的付款账号和/或收款账号之前，显示历史记录中记载的账号信息，如果历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
移动终端30在向智能密码设备50发送该挑战码的同时，还可以发送其他信息，例如时间同步信息等信息，以保证智能密码设备50生成动态口令时的时间与后台服务器同步。此时，加密数据包还包括时间同步信息，用以同步智能密码设备50中时钟模块的时间；智能密码设备50还用于将解密得到的时间同步信息与智能密码设备50中动态口令功能中时钟模块的时间进行比较，得到时间差值，将时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
此外，为了进一步提高PIN码传输的安全性，移动终端30以及智能密码设备50之间采用的一次性密钥可以是通过移动终端30与智能密码设备50协商得到的，从而实现移动终端30与智能密码设备50之间建立安全通道。例如可以通过如下方式之一实现：
方式一：
移动终端30还用于获取智能密码设备50的公钥，并利用公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备50；以及利用软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作 为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码；
智能密码设备50还用于接收加密后的软件随机数K1’，并利用公钥对应的私钥对加密后的软件随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用软件随机数K1加密硬件随机数K2，得到加密后的硬件随机数K2’，发送加密后的硬件随机数K2’至移动终端30；以及接收加密后的PIN码，并利用硬件随机数K2解密加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
方式二：
移动终端30还用于获取智能密码设备50的公钥和智能密码设备50生成的随机数，并利用公钥对随机数和PIN码组成的序列进行加密，得到加密结果；
智能密码设备50还用于利用私钥对加密结果进行解密，得到序列，并利用随机数，从序列中获取PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
本方式中，上述移动终端30获取的智能密码设备50生成的随机数可以是移动终端30与智能密码设备50协商得到的，例如通过类似于上述方式一中通过软件随机数和硬件随机数的互相加密的方式得到，通过加密传输该随机数保证了随机数传输的安全性，防止被窃取造成的不安全隐患；该随机数也可以是通过音频接口的安全传输通道不经加密直接从智能密码设备50中获取，提高获取该随机数的速度。
方式三：
移动终端30还用于获取随机数，并将该随机数和PIN码组成第一序列，对第一序列进行哈希算法计算；得到第一计算结果；
智能密码设备50还还用于按照与移动终端30的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将第一计算结果和第二计算结果进行比对，如果第一计算结果和第二计算结果相同，则验证通过。
本方式中的硬件随机数也可以采用方式一中硬件随机数的方式来获取，以保证硬件随机数的安全。也可以直接通过音频接口的安全传输通道不经加密直接从智能密码设备中获取，提高获取速度。
另外，方式一和方式二中的加密密钥和解密密钥为非对称公私钥对，且加密密钥与智能密码设备的公钥不同，解密密钥与智能密码设备的私钥不同。即该加密密钥与智能密码设备中执行电子签名功能所采用的公钥不同，解密密钥与智能密码设备中执行电子签名功能所采用的私钥不同。从而减少签名功能所采用的私钥的使用次数，减少暴力破解签名功 能所采用的私钥的可能，提高信息存储的安全性。
此外，智能密码设备50包括安全芯片，其中安全芯片用于执行动态口令生成功能；该安全芯片可以为实现智能密码设备电子签名功能的安全芯片。由于安全芯片是一个安全环境，能够保证动态口令生成功能的安全，且对于智能密码设备50而言，无需增加硬件成本，使得电子签名功能与动态口令生成功能集成于一个芯片中，且共用显示装置，结构设计简单精巧。
进一步的，智能密码设备50的安全芯片还用于执行电子签名功能。该电子签名即可以实现现有技术中的数字签名的全部功能。
需要说明的是，与现有技术中动态口令牌的硬件防拆的设置相比，本发明提供的智能密码设备50的安全芯片能够能构成一个安全环境，因此无需在本发明中的智能密码设备50中设置相关的硬件防拆的结构，节省了硬件成本开支。
当然，本发明中的音频接口还可以替换为第一接口，该第一接口可以为NFC接口、蓝牙接口、OTG接口、USB接口、红外接口、光传输接口等任意形式的接口，其对加密后的PIN码进行编码，使其符合不同接口传输数据的各自的协议，提高了智能密码设备的通用性和易用性。
实施例4
本发明提供的处理交易请求信息的系统包括：
实施例3所记载的动态口令生成系统；其动态口令生成系统参见实施例3的全部记载内容，在此不再赘述。
其中，移动终端30还用于获取动态口令，并向后台服务器40发送动态口令；后台服务器40还用于接收动态口令，并对动态口令进行验证，如果验证通过，则执行本次交易。
此外，移动终端30还用于通过如下方式之一获取动态口令，包括：
方式一：智能密码设备50显示动态口令，移动终端30接收用户输入的动态口令；
方式二：智能密码设备50通过音频接口向移动终端30发送动态口令，移动终端30接收动态口令。
在上述方式中，方式一是需要用户在移动终端上手动输入动态口令的，方式二是无需用户手动输入的，两种方式可以根据实际需要进行选择。
基于本实施例，后台服务器40验证动态口令通过后，才可以完成本次交易。由上可以看出，在生成动态口令过程中，现有技术中借助键盘的操作的场景分别为输入PIN码和输入挑战码，但本发明提供的方法实施例中移动终端发送PIN码实现对用户使用的动态口令 的访问控制，且PIN码的输入与现有技术中是在智能密码设备的键盘上输入相比，借用移动终端的键盘功能，由移动终端通过音频接口发送给智能密码设备，从而完成PIN码的输入，使得智能密码设备无需设置数字键盘，大大缩小了智能密码设备的体积；另外，为了保证PIN码的安全传输，通过一次性密钥进行加密，降低了PIN码被盗的可能，保证了信息传输的安全；另外，与现有技术中挑战码由用户输入相比，本申请中挑战码是由移动终端通过音频接口传输给智能密码设备，无需用户手动输入的，优化了用户的输入操作。
流程图中或在此以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的模块、片段或部分，并且本发明的优选实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本发明的实施例所属技术领域的技术人员所理解。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或他们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
本技术领域的普通技术人员可以理解实现上述实施例方法携带的全部或部分步骤是可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，该程序在执行时，包括方法实施例的步骤之一或其组合。
此外，在本发明各个实施例中的各功能单元可以集成在一个处理模块中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。所述集成的模块如果以软件功能模块的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。
上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的 一个或多个实施例或示例中以合适的方式结合。
尽管上面已经示出和描述了本发明的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本发明的限制，本领域的普通技术人员在不脱离本发明的原理和宗旨的情况下在本发明的范围内可以对上述实施例进行变化、修改、替换和变型。本发明的范围由所附权利要求及其等同限定。

Claims (20)

  1. 一种动态口令生成方法，其特征在于，包括：
    移动终端获取交易信息，并根据交易信息生成交易请求，并将所述交易请求发送至后台服务器，其中所述交易请求至少包括交易信息以及挑战码请求；
    所述后台服务器接收所述交易请求，并根据预先设置的挑战码生成策略，生成所述交易请求的挑战码；再利用加密密钥至少对所述挑战码进行加密，得到加密数据包，并向所述移动终端发送所述加密数据包；
    在移动终端将所述加密数据包发送给智能密码设备之前，所述移动终端检测智能密码设备是否已插入；如果所述智能密码设备已插入，则获取所述智能密码设备的PIN码；并通过一次性密钥加密所述PIN码，得到加密后的PIN码，对所述加密后的PIN码进行编码，得到编码数据，并通过音频接口将所述编码数据发送至所述智能密码设备，其中，所述PIN码用于开启所述智能密码设备的功能权限；
    所述智能密码设备接收所述编码数据，对所述编码数据进行解码，获得所述加密后的PIN码，根据所述加密后的PIN码验证所述PIN码的合法性，如果验证所述PIN码合法，开启动态口令生成功能，并向所述移动终端发送状态切换成功信息；
    所述移动终端在接收到状态切换成功信息后，通过音频接口将接收到的所述加密数据包发送给智能密码设备；
    所述智能密码设备利用加密密钥对应的解密密钥对所述加密数据包进行解密，得到解密数据，并输出所述解密数据；当接收到对所述解密数据的确认指令后，生成本次交易对应的动态口令。
  2. 根据权利要求1所述的方法，其特征在于，所述移动终端获取交易信息，包括：
    所述移动终端在获取交易信息的付款账号和/或收款账号之前，显示历史记录中记载的账号信息，如果历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
  3. 根据权利要求1或2所述的方法，其特征在于：
    所述加密数据包还包括时间同步信息，用以同步智能密码设备中时钟模块的时间；
    所述方法还包括：
    智能密码设备将解密得到的时间同步信息与所述智能密码设备中动态口令功能中时钟 模块的时间进行比较，得到时间差值，将所述时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
  4. 根据权利要求1至3任一项所述的方法，其特征在于：
    所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：
    移动终端获取智能密码设备的公钥，并利用所述公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备；
    智能密码设备接收所述加密后的软件随机数K1’，并利用所述公钥对应的私钥对所述加密后的软件随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用所述软件随机数K1加密所述硬件随机数K2，得到加密后的硬件随机数K2’，发送所述加密后的硬件随机数K2’至移动终端；
    所述移动终端利用所述软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码；
    所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：
    所述智能密码设备接收所述加密后的PIN码，并利用所述硬件随机数K2解密所述加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
  5. 根据权利要求1至3任一项所述的方法，其特征在于：
    所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：
    移动终端获取智能密码设备的公钥和智能密码设备生成的随机数，并利用所述公钥对所述随机数和PIN码组成的序列进行加密，得到加密结果；
    所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：
    所述智能密码设备利用私钥对所述加密结果进行解密，得到所述序列，并利用所述随机数，从所述序列中获取所述PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
  6. 根据权利要求4或5所述的方法，其特征在于，所述加密密钥和所述解密密钥为非对称公私钥对，且所述加密密钥与所述智能密码设备的公钥不同，所述解密密钥与智能密码设备的私钥不同。
  7. 根据权利要求1至3任一项所述的方法，其特征在于：
    所述移动终端通过一次性密钥加密所述PIN码，得到加密后的PIN码，包括：
    所述移动终端获取随机数，并将该随机数和PIN码组成第一序列，对所述第一序列进行哈希算法计算；得到第一计算结果；
    所述智能密码设备根据所述加密后的PIN码验证所述PIN码的合法性，包括：
    所述智能密码设备按照与移动终端的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将所述第一计算结果和所述第二计算结果进行比对，如果所述第一计算结果和所述第二计算结果相同，则验证通过。
  8. 一种处理交易请求信息的方法，其特征在于，包括：
    通过权利要求1至7任一项所述的方法生成动态口令；
    所述移动终端获取所述动态口令，并向所述后台服务器发送所述动态口令；
    所述后台服务器接收所述动态口令，并对所述动态口令进行验证，如果验证通过，则执行本次交易。
  9. 根据权利要求8所述的方法，其特征在于，所述移动终端获取动态口令，包括：
    方式一：所述智能密码设备显示所述动态口令，所述移动终端接收用户输入的动态口令；
    方式二：所述智能密码设备通过音频接口向所述移动终端发送所述动态口令，所述移动终端接收所述动态口令。
  10. 一种动态口令生成系统，其特征在于，包括移动终端、后台服务器和智能密码设备，其中：
    所述移动终端用于获取交易信息，并根据交易信息生成交易请求，并将所述交易请求发送至后台服务器，其中所述交易请求至少包括交易信息以及挑战码请求；并在移动终端将所述加密数据包发送给智能密码设备之前，检测智能密码设备是否已插入；如果所述智能密码设备已插入，则获取所述智能密码设备的PIN码；并通过一次性密钥加密所述PIN码，得到加密后的PIN码，对所述加密后的PIN码进行编码，得到编码数据，并通过音频接口将所述编码数据发送至所述智能密码设备，其中，所述PIN码用于开启所述智能密码设备的功能权限；
    所述后台服务器用于接收所述交易请求，并根据预先设置的挑战码生成策略，生成所述交易请求的挑战码；再利用加密密钥至少对所述挑战码进行加密，得到加密数据包，并向所述移动终端发送所述加密数据包；
    所述智能密码设备用于接收所述编码数据，对所述编码数据进行解码，获得所述加密后的PIN码，根据所述加密后的PIN码验证所述PIN码的合法性，如果验证所述PIN码合 法，开启动态口令生成功能，并向所述移动终端发送状态切换成功信息；并利用加密密钥对应的解密密钥对所述加密数据包进行解密，得到解密数据，并输出所述解密数据；当接收到对所述解密数据的确认指令后，生成本次交易对应的动态口令。
  11. 根据权利要求10所述的系统，其特征在于，所述移动终端还用于在获取交易信息的付款账号和/或收款账号之前，显示历史记录中记载的账号信息，如果历史记录中对应有账号，则接收对显示的账号信息的选择指令，将选择的账号作为交易信息保存，如果历史记录中没有对应的账号，则接收用户输入的账号信息，将用户输入的账号信息作为交易信息保存，并将用户输入的账号信息添加到历史记录中。
  12. 根据权利要求10或11所述的系统，其特征在于，所述加密数据包还包括时间同步信息，用以同步智能密码设备中时钟模块的时间；所述智能密码设备还用于将解密得到的时间同步信息与所述智能密码设备中动态口令功能中时钟模块的时间进行比较，得到时间差值，将所述时间差值与本地存储的时间误差范围进行比较，如果时间差值不在时间误差范围内，则提示用户是否进行时间同步；如果接收到同步指令后，根据时间同步信息，对时钟模块的时间进行调整，并在调整完成后，执行动态口令生成流程。
  13. 根据权利要求10至12任一项所述的系统，其特征在于：
    所述移动终端还用于获取智能密码设备的公钥，并利用所述公钥对本地生成的软件随机数K1进行加密，并将加密后的软件随机数K1’发送给智能密码设备；以及利用所述软件随机数K1对加密后的硬件随机数K2’进行解密，得到硬件随机数K2，将硬件随机数K2作为一次性密钥，利用硬件随机数K2加密PIN码，得到加密后的PIN码；
    所述智能密码设备还用于接收所述加密后的软件随机数K1’，并利用所述公钥对应的私钥对所述加密后的软件随机数K1’进行解密，得到软件随机数K1；并生成一硬件随机数K2，并利用所述软件随机数K1加密所述硬件随机数K2，得到加密后的硬件随机数K2’，发送所述加密后的硬件随机数K2’至移动终端；以及接收所述加密后的PIN码，并利用所述硬件随机数K2解密所述加密后的PIN码，得到PIN码；将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
  14. 根据权利要求10至12任一项所述的系统，其特征在于：
    所述移动终端还用于获取智能密码设备的公钥和智能密码设备生成的随机数，并利用所述公钥对所述随机数和PIN码组成的序列进行加密，得到加密结果；
    所述智能密码设备还用于利用私钥对所述加密结果进行解密，得到所述序列，并利用所述随机数，从所述序列中获取所述PIN码，将获取到的PIN码与本地保存的PIN码进行比较，如果两个PIN码相同，则验证通过。
  15. 根据权利要求13或14所述的系统，其特征在于，所述加密密钥和所述解密密钥为非对称公私钥对，且所述加密密钥与所述智能密码设备的公钥不同，所述解密密钥与智能密码设备的私钥不同。
  16. 根据权利要求10至12任一项所述的系统，其特征在于：
    所述移动终端还用于获取随机数，并将该随机数和PIN码组成第一序列，对所述第一序列进行哈希算法计算；得到第一计算结果；
    所述智能密码设备还还用于按照与移动终端的处理方式相同的方式得到第二序列，并采用相同的哈希算法，得到第二计算结果，将所述第一计算结果和所述第二计算结果进行比对，如果所述第一计算结果和所述第二计算结果相同，则验证通过。
  17. 根据权利要求10至16任一项所述的系统，其特征在于，所述智能密码设备包括安全芯片，其中所述安全芯片用于生成动态口令。
  18. 根据权利要求17所述的系统，其特征在于，所述安全芯片还用于进行电子签名。
  19. 一种处理交易请求信息的系统，其特征在于，包括：上述权利要求10至18任一项所述的动态口令生成系统，其中，所述移动终端还用于获取所述动态口令，并向所述后台服务器发送所述动态口令；所述后台服务器还用于接收所述动态口令，并对所述动态口令进行验证，如果验证通过，则执行本次交易。
  20. 根据权利要求19所述的系统，其特征在于，所述移动终端还用于通过如下方式之一获取动态口令，包括：
    方式一：所述智能密码设备显示所述动态口令，所述移动终端接收用户输入的动态口令；
    方式二：所述智能密码设备通过音频接口向所述移动终端发送所述动态口令，所述移动终端接收所述动态口令。
PCT/CN2014/086412 2013-10-22 2014-09-12 动态口令生成方法和系统、交易请求的处理方法和系统 WO2015058596A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310499921.2A CN103532719B (zh) 2013-10-22 2013-10-22 动态口令生成方法和系统、交易请求的处理方法和系统
CN201310499921.2 2013-10-22

Publications (1)

Publication Number Publication Date
WO2015058596A1 true WO2015058596A1 (zh) 2015-04-30

Family

ID=49934425

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/086412 WO2015058596A1 (zh) 2013-10-22 2014-09-12 动态口令生成方法和系统、交易请求的处理方法和系统

Country Status (2)

Country Link
CN (1) CN103532719B (zh)
WO (1) WO2015058596A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110447971A (zh) * 2019-08-30 2019-11-15 惠州市新泓威科技有限公司 具有电子儿童锁的电子烟及其控制方法
CN111126533A (zh) * 2020-01-08 2020-05-08 牛津(海南)区块链研究院有限公司 基于动态口令的身份认证方法、装置和动态令牌
CN111307798A (zh) * 2018-12-11 2020-06-19 成都智叟智能科技有限公司 采用多种采集技术的物品查验方法
CN112241524A (zh) * 2019-07-16 2021-01-19 深圳软牛科技有限公司 iOS设备账号密码导入方法及系统
CN112765618A (zh) * 2020-12-23 2021-05-07 金卡智能集团股份有限公司 一种电子燃气表的控制方法
CN113963468A (zh) * 2021-10-25 2022-01-21 中国银行股份有限公司 开锁码的生成方法及装置
CN114758433A (zh) * 2022-02-23 2022-07-15 珠海汇金科技股份有限公司 一种基于云端的动态密码生成方法、系统和智能锁
CN115100762A (zh) * 2022-05-31 2022-09-23 深圳市旭子科技有限公司 一种生成12位真随机动态口令的安全开锁方法
CN115426179A (zh) * 2022-09-01 2022-12-02 中国联合网络通信集团有限公司 信息找回方法、装置和电子设备

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103532719B (zh) * 2013-10-22 2017-01-18 天地融科技股份有限公司 动态口令生成方法和系统、交易请求的处理方法和系统
CN104092683B (zh) * 2014-07-04 2017-05-10 飞天诚信科技股份有限公司 一种pin码保护方法及系统
CN104202337B (zh) * 2014-09-22 2017-06-06 上海众人网络安全技术有限公司 一种基于音频信号的数据传输系统及方法
CN106411520B (zh) * 2015-07-29 2020-08-04 腾讯科技（深圳）有限公司 一种虚拟资源数据的处理方法、装置及系统
CN110048834A (zh) * 2019-03-12 2019-07-23 深圳壹账通智能科技有限公司 动态密码发送方法、装置及计算机可读存储介质
CN111212065B (zh) * 2019-12-31 2021-08-27 海信集团有限公司 一种家电设备通信加密的方法、家电设备和服务器

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101188495A (zh) * 2007-12-04 2008-05-28 魏恺言 一种实现强口令认证方式的安全系统及方法
CN101576945A (zh) * 2008-12-31 2009-11-11 北京飞天诚信科技有限公司 多功能读卡器及其实现方法
CN101645775A (zh) * 2008-08-05 2010-02-10 北京灵创科新科技有限公司 基于空中下载的动态口令身份认证系统
CN102377570A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种生成动态口令的方法和装置
CN102377783A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种动态口令生成及认证的方法和系统
CN103532719A (zh) * 2013-10-22 2014-01-22 天地融科技股份有限公司 动态口令生成方法和系统、交易请求的处理方法和系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101582896A (zh) * 2009-06-24 2009-11-18 周哲 第三方网络认证系统及其认证方法
CN101807994B (zh) * 2009-12-18 2012-07-25 北京握奇数据系统有限公司 一种ic卡应用数据传输的方法及系统
CN102298683A (zh) * 2010-06-22 2011-12-28 国民技术股份有限公司 一种具有短距离射频通讯认证的认证装置、系统及方法
CN202177904U (zh) * 2011-07-08 2012-03-28 国民技术股份有限公司 一种基于音频接口的智能密码钥匙
CN102594803B (zh) * 2012-01-18 2016-03-23 深圳市文鼎创数据科技有限公司 信息安全设备及服务器时间同步方法
CN102752115B (zh) * 2012-07-04 2015-09-16 北京天龙融和软件有限公司 挑战码生成方法及装置、动态口令认证方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101188495A (zh) * 2007-12-04 2008-05-28 魏恺言 一种实现强口令认证方式的安全系统及方法
CN101645775A (zh) * 2008-08-05 2010-02-10 北京灵创科新科技有限公司 基于空中下载的动态口令身份认证系统
CN101576945A (zh) * 2008-12-31 2009-11-11 北京飞天诚信科技有限公司 多功能读卡器及其实现方法
CN102377570A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种生成动态口令的方法和装置
CN102377783A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种动态口令生成及认证的方法和系统
CN103532719A (zh) * 2013-10-22 2014-01-22 天地融科技股份有限公司 动态口令生成方法和系统、交易请求的处理方法和系统

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111307798A (zh) * 2018-12-11 2020-06-19 成都智叟智能科技有限公司 采用多种采集技术的物品查验方法
CN112241524A (zh) * 2019-07-16 2021-01-19 深圳软牛科技有限公司 iOS设备账号密码导入方法及系统
CN110447971A (zh) * 2019-08-30 2019-11-15 惠州市新泓威科技有限公司 具有电子儿童锁的电子烟及其控制方法
CN110447971B (zh) * 2019-08-30 2024-04-26 惠州市新泓威科技有限公司 具有电子儿童锁的电子烟及其控制方法
CN111126533A (zh) * 2020-01-08 2020-05-08 牛津(海南)区块链研究院有限公司 基于动态口令的身份认证方法、装置和动态令牌
CN112765618B (zh) * 2020-12-23 2023-04-07 金卡智能集团股份有限公司 一种电子燃气表的控制方法
CN112765618A (zh) * 2020-12-23 2021-05-07 金卡智能集团股份有限公司 一种电子燃气表的控制方法
CN113963468A (zh) * 2021-10-25 2022-01-21 中国银行股份有限公司 开锁码的生成方法及装置
CN114758433A (zh) * 2022-02-23 2022-07-15 珠海汇金科技股份有限公司 一种基于云端的动态密码生成方法、系统和智能锁
CN115100762A (zh) * 2022-05-31 2022-09-23 深圳市旭子科技有限公司 一种生成12位真随机动态口令的安全开锁方法
CN115100762B (zh) * 2022-05-31 2023-12-26 深圳市旭子科技有限公司 一种生成12位真随机动态口令的安全开锁方法
CN115426179A (zh) * 2022-09-01 2022-12-02 中国联合网络通信集团有限公司 信息找回方法、装置和电子设备
CN115426179B (zh) * 2022-09-01 2024-05-03 中国联合网络通信集团有限公司 信息找回方法、装置和电子设备

Also Published As

Publication number Publication date
CN103532719A (zh) 2014-01-22
CN103532719B (zh) 2017-01-18

Similar Documents

Publication Publication Date Title
WO2015058596A1 (zh) 动态口令生成方法和系统、交易请求的处理方法和系统
CN103516525B (zh) 一种动态口令生成方法和系统
WO2014161438A1 (zh) 动态口令牌、动态口令牌数据传输方法及系统
CA2875503C (en) Enterprise triggered 2chk association activation
US10033701B2 (en) Enhanced 2CHK authentication security with information conversion based on user-selected persona
US11544365B2 (en) Authentication system using a visual representation of an authentication challenge
TWI454111B (zh) 用於確保通訊之鑑別及完備性的技術
CN103929306B (zh) 智能密钥设备和智能密钥设备的信息管理方法
WO2017071496A1 (zh) 实现会话标识同步的方法及装置
US20100180120A1 (en) Information protection device
CN103944724B (zh) 一种用户身份识别卡
WO2015161689A1 (zh) 一种基于协商密钥的数据处理方法
WO2014187206A1 (zh) 一种备份电子签名令牌中私钥的方法和系统
WO2014201907A1 (zh) 电子签名方法及系统
TWI526871B (zh) Server, user device, and user device and server interaction method
WO2014187210A1 (zh) 一种电子签名令牌私钥的备份方法和系统
CN101819614A (zh) 利用语音核验USBKey增强网络交易安全性的系统和方法
CN106056419A (zh) 利用电子签名设备实现独立交易的方法、系统和设备
WO2015109958A1 (zh) 一种基于协商密钥的数据处理方法和手机
WO2019232766A1 (zh) 交易方法、硬件钱包和交易设备
WO2014187209A1 (zh) 一种备份电子签名令牌中信息的方法和系统
Zefferer A server-based signature solution for mobile devices
WO2011060739A1 (zh) 一种安全系统及方法
WO2019232764A1 (zh) 交易方法、硬件钱包和交易设备
RUCIŃSKI WŁODZIMIERZ CHOCIANOWICZ¹, JERZY PEJAŚ¹

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14855055

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14855055

Country of ref document: EP

Kind code of ref document: A1