WO2015081763A1 - 一种虚拟设备的授权使用方法及装置 - Google Patents

一种虚拟设备的授权使用方法及装置 Download PDF

Info

Publication number
WO2015081763A1
WO2015081763A1 PCT/CN2014/089225 CN2014089225W WO2015081763A1 WO 2015081763 A1 WO2015081763 A1 WO 2015081763A1 CN 2014089225 W CN2014089225 W CN 2014089225W WO 2015081763 A1 WO2015081763 A1 WO 2015081763A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual device
virtual
identifier
mobile terminal
request
Prior art date
Application number
PCT/CN2014/089225
Other languages
English (en)
French (fr)
Inventor
鲍文彬
谢涛令
杨贵龙
励业宏
顾兵
贾小龙
Original Assignee
苏州海博智能系统有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州海博智能系统有限公司 filed Critical 苏州海博智能系统有限公司
Priority to US15/102,137 priority Critical patent/US10305878B2/en
Publication of WO2015081763A1 publication Critical patent/WO2015081763A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0846—Network architectures or network communication protocols for network security for authentication of entities using passwords using time-dependent-passwords, e.g. periodically changing passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications

Definitions

  • the present invention relates to the field of virtual devices, and in particular, to a method and an apparatus for authorizing use of a virtual device capable of setting permissions.
  • the physical card has high security, but it is easy to cause leakage or loss in various occasions, and it cannot be used at multiple locations and multiple people at the same time.
  • the second is to use a pure virtual card. Although the virtual card is easy to use, the security is very low. Only the card number, expiration date, verification code and other information are used to complete the transaction verification, and the information such as the password is easily spread in the network.
  • the physical access card is the same as the physical bank card. Although it is highly secure, it needs to be carried frequently, and this is easy to cause loss. If you use a pure virtual card, such as embedding relevant identity information into your smartphone, use your smartphone to open the door. Although easy to use, the security is also low.
  • an embodiment of the present invention provides a method for authorized use of a virtual device, including:
  • the mobile terminal receives a request for generating a first virtual device that is sent by the first device, where the request for generating the first virtual device includes an identifier of the first device and first authentication information; and the virtual device terminal software is installed on the mobile terminal. ;
  • the mobile terminal receives the right information of the first virtual device input by the user;
  • the mobile terminal generates a first virtual device and the server generates a second virtual device;
  • the mobile terminal generates second authentication information and transmits the use request and the second authentication information to the server when receiving a use request input by a user;
  • the first virtual device is included in the use request Current usage status and an identifier of the first virtual device;
  • the server searches for the corresponding second virtual device according to the identifier of the first virtual device, performs authentication on the second authentication information and the use request according to the corresponding second virtual device, and sends the authentication result. Go to the mobile terminal, so that the mobile terminal performs the next operation according to the authentication result;
  • the generating, by the mobile terminal, the first virtual device includes: the mobile terminal generating an identifier of the first virtual device according to the identifier of the first device, and according to the identifier of the first virtual device and the rights information of the first virtual device Generating a first virtual device;
  • the generating the second virtual device by the server includes:
  • the server receiving, by the mobile terminal, a request for generating a second virtual device, where the request for generating the second virtual device includes the identifier of the first device, the first authentication information, and the first virtual device Permission information, the server according to the identifier of the first device, the permission information of the first device, and the related authentication information of the first device, the request in the request for generating the second virtual device Determining the first authentication information and the rights information of the first virtual device,
  • the server If the authentication is passed, the server generates an identifier of the second virtual device according to the identifier of the first device, and generates a second virtual device according to the identifier of the second virtual device and the rights information of the first virtual device. And storing the second virtual device in association with the first device.
  • the receiving, by the mobile terminal, the request for generating the first virtual device that is sent by the first device includes:
  • the mobile terminal interacts with a physical device, and obtains the request for generating the first virtual device from the physical device;
  • the mobile terminal communicates with another mobile terminal that generates a third virtual device, and the request to generate the first virtual device is obtained from the another mobile terminal.
  • the authorization generation and use method of the virtual device is authenticated by using a PKI method.
  • the authorization generation and use method of the virtual device is authenticated by means of a dynamic password; the method includes:
  • the mobile terminal interacts with the first device to obtain the request for generating a first virtual device, where the request for generating the first virtual device includes an identifier of the first device, a first dynamic password, and the first virtual a key of the device; the first dynamic password is obtained by the first device according to the key of the first device and a dynamic primer; the key of the first virtual device is used by the first device according to the The key of the first device is encrypted;
  • the mobile terminal receives the right information of the first virtual device input by the user;
  • the mobile terminal generates an identifier of the first virtual device according to the identifier of the first device, and generates, according to the identifier of the first virtual device, the key of the first virtual device, and the rights information of the first virtual device.
  • First virtual device ;
  • the mobile terminal sends a request for generating a second virtual device to the server;
  • the request for generating the second virtual device includes an identifier of the first device, the first dynamic password, and rights information of the first virtual device ;
  • the server If the authentication is passed, the server generates an identifier of the second virtual device according to the identifier of the first device, and generates a key of the second virtual device according to the key encryption of the first device;
  • the server generates a second virtual device according to the identifier of the second virtual device, the key of the second virtual device, and the right information of the first virtual device, and the second virtual device and the first virtual device A device performs associated storage;
  • the mobile terminal When receiving the use request input by the user, the mobile terminal generates a second dynamic password according to the key of the first virtual device and sends the use request and the second dynamic password to the server;
  • the usage request includes a current usage status of the first virtual device and an identifier of the first virtual device; a current usage status of the first virtual device corresponds to rights information of the first virtual device;
  • the server searches for the corresponding second virtual device according to the identifier of the first virtual device, performs authentication on the second dynamic password and the use request according to the corresponding second virtual device, and sends the authentication result. Go to the mobile terminal, so that the mobile terminal performs the next operation according to the authentication result.
  • the request for generating the first virtual card further includes a random code
  • the key of the first virtual device is generated by the first device by using a key of the first device and the random code by using an SM3 cryptographic hash algorithm;
  • the second request for generating a virtual card further includes the random code
  • the server If the authentication is passed, the server generates a key of the second virtual device by using an SM3 cryptographic hash algorithm according to the key of the first device and the random code.
  • the rights information includes at least one of a time, a category, and a quota
  • the current usage state of the first virtual device includes at least one of a current usage time, a usage category, and a usage quota of the first virtual device.
  • the current usage state of the first virtual device includes at least one of a current usage time, a usage category, and a usage quota of the first virtual device.
  • An embodiment of the present invention further provides an apparatus for authorizing use of a virtual device, including a mobile terminal and a server;
  • the mobile terminal is configured to receive, by the first device, a request for generating a first virtual device and rights information of the first virtual device that is input by the user, and generate an identifier of the first virtual device according to the identifier of the first device, according to the Generating, by the identifier of the first virtual device and the rights information of the first virtual device, a first virtual device and sending a request for generating the second virtual device to the server;
  • the request for generating the first virtual device includes the first device
  • the first authentication information is installed on the mobile terminal;
  • the request for generating the second virtual device includes the identifier of the first device, the first authentication information, and the first virtual Permission information of the device;
  • the mobile terminal is further configured to: when receiving the use request input by the user, generate second authentication information, send the use request and the second authentication information to the server, and perform, according to the authentication result returned by the server a next operation;
  • the usage request includes a current usage status of the first virtual device and an identifier of the first virtual device;
  • the server configured to: according to the identifier of the first device, the rights information of the first device, and the related authentication information of the first device, the request in the request for generating the second virtual device
  • the first authentication information and the right information of the first virtual device are authenticated.
  • the identifier of the second virtual device is generated according to the identifier of the first device, according to the identifier of the second virtual device.
  • the rights information of the first virtual device generates a second virtual device, and associates the second virtual device with the first device;
  • the server is further configured to search for the corresponding second virtual device according to the identifier of the first virtual device, and perform authentication on the second authentication information and the use request according to the corresponding second virtual device.
  • the authentication result is sent to the mobile terminal.
  • the mobile terminal is configured to interact with a physical device, and obtain the request for generating the first virtual device from the physical device;
  • the mobile terminal is configured to communicate with another mobile terminal that generates the third virtual device, and obtain the request for generating the first virtual device from the another mobile terminal.
  • the mobile terminal and the server complete the authorization generation and use of the virtual device by using a PKI method.
  • the mobile terminal and the server complete authorization generation and use of the virtual device by using a dynamic password
  • the mobile terminal is configured to receive the request for generating the first virtual device of the first device and the right information of the first virtual device that is input by the user, and generate the identifier of the first virtual device according to the identifier of the first device And generating, according to the identifier of the first virtual device, the key of the first virtual device, and the rights information of the first virtual device, a first virtual device, and sending a request for generating a second virtual device to the server;
  • the request of the first virtual device includes an identifier of the first device, a first dynamic password, and a key of the first virtual device; the first dynamic password is determined by the first device according to the density of the first device
  • the key is encrypted by the dynamic reference; the key of the first virtual device is obtained by the first device according to the key of the first device; and the request for generating the second virtual device includes the first device The identifier, the first dynamic password, and the rights information of the first virtual device;
  • the mobile terminal is further configured to: when receiving the use request input by the user, generate a second dynamic password according to the key of the first virtual device, and send the use request and the second dynamic password to the And the server performs the next operation according to the authentication result returned by the server;
  • the usage request includes a current usage status of the first virtual device and an identifier of the first virtual device; current usage of the first virtual device a state corresponding to the rights information of the first virtual device;
  • the server is configured to: according to the identifier of the first device, the rights information of the first device, and the key of the first device, the first one of the requests for generating the second virtual device A dynamic password and the right information of the first virtual device are authenticated, and when the authentication is passed, the identifier of the second virtual device is generated according to the identifier of the first device, and the second key is generated according to the key of the first device.
  • the server is further configured to search for the corresponding second virtual device according to the identifier of the first virtual device, and perform authentication on the second dynamic password and the use request according to the corresponding second virtual device.
  • the authentication result is sent to the mobile terminal.
  • the rights information includes at least one of a time, a category, and a quota
  • the current usage state of the first virtual device includes at least one of a current usage time, a usage category, and a usage quota of the first virtual device.
  • the current usage state of the first virtual device includes at least one of a current usage time, a usage category, and a usage quota of the first virtual device.
  • the invention installs a virtual device terminal software on a mobile terminal, authorizes and generates a virtual device with a certain permission limit (time, category, quota) on the mobile terminal, and performs mutual authentication with the server during the authorization process and use process. It is easy to use and improves safety. Moreover, in the present invention, the virtual device can be immediately generated by swiping the card in the virtual device terminal software, and the process is convenient and safe. Dynamic password technology, PKI technology, etc. can be supported when authenticating with the server (both virtual device authorization generation and virtual device use), and when using dynamic password technology, the keys are hashed in the server and the first device respectively. Generated and not transmitted over the network, further improving security. Moreover, the virtual device with corresponding authority in the present invention can also authorize the generation of a new virtual device.
  • FIG. 1 is a flowchart of authorizing generation of a virtual device according to the present invention
  • FIG. 2 is a flow chart of using a virtual device according to the present invention.
  • FIG. 3 is a flow chart of generating a virtual card using dynamic password authorization according to the present invention.
  • FIG. 4 is a flow chart of using a virtual card using a dynamic password according to the present invention.
  • Figure 5 is a structural view of the apparatus of the present invention.
  • the first embodiment of the present invention provides a method for authorizing the use of a virtual device.
  • the method includes the process of authorizing the generation of the virtual device and the process of using the virtual device to perform related operations, such as paying or opening the access control. Both of these processes require authentication between the mobile terminal and the server. In addition to the identity authentication information, the method also adds authentication of the rights information.
  • the user sets the usage rights of the virtual device on the mobile terminal, and then sends it to the server for verification. If the usage right of the virtual device set by the verification pass is within the authority of the first device, the virtual device is authorized to be generated on the server.
  • the mobile terminal sends the current usage status of the virtual device to the server for authentication, and if the virtual device's usage authority of the above setting is met, the authentication passes.
  • the present invention needs to deploy an operation platform for authorizing the generation of a virtual device, that is, setting a server, and pre-storing information for performing authentication, such as a device identifier, a device key, and device permission information, in the server. Also need to install the virtual device terminal software on the mobile terminal and issue it with OTP (One-time Password) function or PKI (Public Key) Infrastructure, public key infrastructure) physical device. After the above preparation is completed, it is necessary to authorize the generation of the virtual device in the mobile terminal and the server. See Figure 1 for the steps to authorize the generation of virtual devices:
  • the mobile terminal receives a request for generating the first virtual device that is sent by the first device.
  • the request for generating the first virtual device includes the identifier of the first device and the first authentication information; the virtual device terminal software is installed on the mobile terminal.
  • the first device may be a physical device, such as a physical card, such as a physical bank card or an access card, and the specific identifier may be a bank card number or a serial number.
  • the mobile terminal interacts with the physical device to obtain a request for generating the first virtual device from the physical device.
  • the first device may also be a third virtual device disposed on another mobile terminal, such as a virtual bank card or a virtual access card disposed on the mobile phone, and the identifier may be a virtual bank card number or a virtual serial number.
  • the mobile terminal communicates with another mobile terminal provided with the third virtual device, and acquires a request to generate the first virtual device from the other mobile terminal.
  • a virtual device capable of authorizing the generation of a virtual device may be restricted in authority, that is, only a virtual device having a certain authority may authorize generation of another virtual device.
  • the first device is not limited to the form of a card, and the present invention does not specifically limit this.
  • the first authentication information is information used for performing identity verification, and specifically may be a dynamic password or authentication information generated by a PKI method.
  • the dynamic password authentication method will be described in detail later.
  • the mobile terminal receives the right information of the first virtual device that is input by the user.
  • the above permission information differs depending on the first device. For example, for the bank card, the usage time, the amount, and the category can be set. For the access card, the usage time, the number of times, and the type of the door that the access card can be opened can be set.
  • the user can input the permission information of the first virtual device that is to be set by manually inputting. Because the privilege information of the virtual device must be within the privilege of the first device, in the preferred embodiment of the present invention, the mobile terminal can also obtain the privilege information of the first device and display it on the mobile terminal, so that the user can perform the Input to increase the success rate of authorization to generate virtual devices.
  • the mobile terminal generates an identifier of the first virtual device according to the identifier of the first device, and generates a first virtual device according to the identifier of the first virtual device and the rights information of the first virtual device.
  • the mobile terminal may generate an identifier of the corresponding first virtual device by using an encryption algorithm on the identifier of the first device.
  • the SM3 cryptographic hash algorithm can be used.
  • the identifier of the first virtual device may be the same as the identifier of the first device.
  • the mobile terminal sends a request for generating the second virtual device to the server.
  • the request for generating the second virtual device includes the identifier of the first device, the first authentication information, and the rights information of the first virtual device.
  • the server performs, according to the identifier of the first device, the rights information of the first device, and the related authentication information of the first device, the first authentication information in the request for generating the second virtual device, and the rights information of the first virtual device. Certification.
  • the server first searches for a corresponding identifier in the database according to the identifier of the first device, and obtains authentication information and rights information related to the corresponding identifier.
  • the server then performs authentication verification on the first authentication information and the rights information of the first virtual device according to the authentication information and the authority information.
  • the usage time of the first virtual device setting, the usage quota, the usage category are within the usage time of the first device, the usage quota, and the usage category, if yes, the verification is passed.
  • the above authentication can be performed by using a dynamic password or a PKI method.
  • the server If the authentication is passed, the server generates an identifier of the second virtual device according to the identifier of the first device, and generates a second virtual device according to the identifier of the second virtual device and the permission information of the first virtual device, and the second virtual device is generated. Associated with the first device for storage.
  • the server may use an encryption algorithm to generate an identifier of the corresponding second virtual device by using the identifier of the first device.
  • an encryption algorithm to generate an identifier of the corresponding second virtual device by using the identifier of the first device.
  • the SM3 cryptographic hash algorithm can be used.
  • the identifier of the second virtual device may be the same as the identifier of the first device.
  • Step S13 can be performed after step S16.
  • the mobile terminal can use the virtual device.
  • the steps of using a virtual device in the present invention are as follows:
  • the mobile terminal When receiving the use request input by the user, the mobile terminal generates the second authentication information and sends the use request and the second authentication information to the server; the use request includes the current use state of the first virtual device and the first virtual device. logo.
  • the user selects the first virtual device to be used by inputting or selecting a corresponding identifier in the mobile terminal, and then transmits the use request and the second authentication information to the server.
  • the usage request includes a current usage status of the first virtual device, such as a current usage time, a usage count, a usage category, or an amount used.
  • the server searches for the corresponding second virtual device according to the identifier of the first virtual device, performs authentication on the second authentication information and the use request according to the corresponding second virtual device, and sends the authentication result to the mobile terminal, so that the mobile terminal performs the authentication result according to the authentication result. Go to the next step.
  • the above authentication can be performed by using a dynamic password or a PKI method.
  • the server may find the second virtual device according to the identifier of the first virtual device, and then according to the second virtual device.
  • the authentication information and the authority information stored by the user are authenticated, and the authentication result is returned to the mobile terminal.
  • the first device may send a random code to the mobile terminal, and then send the data to the server through the mobile terminal.
  • the mobile terminal and the server respectively generate the identifier of the first virtual device and the identifier of the second virtual device by using a certain encryption algorithm, such as an SM3 cryptographic hash algorithm, according to the identifier of the first device and the random code.
  • step S21 and step S22 may be repeated after the authorization to generate the virtual card.
  • the invention sets the authentication of the authority information in the process of generating the authorization to generate the virtual device and the process of using the virtual device, and improves the security compared with the prior art.
  • the first virtual device in the present invention is bound to the mobile terminal, and if another mobile terminal is to be used, it is required to authorize the generation in another mobile terminal. This approach also increases the security of virtual device usage.
  • the present invention details the process of authorizing a physical card to generate a virtual card through a dynamic password. As shown in FIG. 3, the process includes:
  • the physical card interacts with the mobile terminal to obtain a request to generate the first virtual card.
  • the request to generate the first virtual card includes an identifier of the physical card, a first dynamic password, and a key of the first virtual card.
  • the mobile terminal can be manually input, two-dimensional code recognition or NFC ( Near Field Communication, short-range wireless communication technology) reads the identification of the physical card and the first dynamic password generated in the physical card.
  • NFC Near Field Communication, short-range wireless communication technology
  • the physical card in this mode has a dynamic password generation function. When passing NFC or the like, the user only needs to brush the physical card in the corresponding position.
  • the mobile terminal receives the right information of the first virtual card input by the user.
  • the above permission information may be at least one of an authorization time, an authorization amount (such as a ceiling), and an authorization category.
  • the mobile terminal generates an identifier of the first virtual card according to the identifier of the physical card, and generates a first virtual card according to the identifier of the first virtual card, the key of the first virtual card, and the authority information of the first virtual card.
  • the process may be triggered automatically based on a request to generate a first virtual card, or may be triggered upon receipt of a command entered by the user. There are no specific restrictions here.
  • the mobile terminal further sends a request for generating the second virtual card to the server; the request for generating the second virtual card includes the identifier of the physical card, the first dynamic password, and the right information of the first virtual card.
  • the request for generating the second virtual card may be triggered automatically after the mobile terminal receives the request to generate the first virtual card, or may be triggered after the user inputs the relevant instruction.
  • the server After receiving the request for generating the second virtual card, the server generates the first dynamic password and the first virtual one in the request for generating the second virtual card according to the identifier of the physical card stored by the server, the permission information of the physical card, and the key pair of the physical card.
  • the card's permission information is authenticated.
  • the server may first authenticate the first dynamic password according to the key of the physical card stored by itself, and if the authentication passes, obtain the permission information of the corresponding physical card stored by itself, and generate a second virtual card for receiving.
  • the permission information in the request is authenticated and verified for legal validity.
  • the server If the authentication is passed, the server generates an identifier of the second virtual card according to the identifier of the physical card, and generates a key of the second virtual card according to the key of the physical card. If the authentication does not pass, the server refuses to generate the second virtual card.
  • the server generates a second virtual card according to the identifier of the second virtual card, the key of the second virtual card, and the right information of the first virtual card, and stores the second virtual card in association with the physical card. For example, a one-to-one correspondence between the identifier of the second virtual card and the identifier of the physical card is set.
  • the identifier of the first virtual card and the identifier of the second virtual card may be generated by hashing the identifier of the physical card and the random code through a certain encryption algorithm, and the density of the first virtual card is
  • the key of the key and the second virtual card may be generated by hashing the key of the physical card and the random code by a certain encryption algorithm.
  • SM3 password hash algorithm Such as SM3 password hash algorithm.
  • the random code can be sent to the mobile terminal through the physical card and delivered to the server through the mobile terminal.
  • the first dynamic password may be generated by encrypting a key of the dynamic primer and the physical card.
  • the dynamic primer can be the current time or the current time plus some identifiers known to both the front end and the background.
  • the encryption algorithm can use the SM3 cryptographic hash algorithm described above.
  • the encryption algorithm used by the physical card corresponds to the encryption algorithm used on the server for the first dynamic password verification to ensure that the server performs the correct authentication.
  • the mobile terminal can use the virtual card.
  • the process includes:
  • the mobile terminal When receiving the use request input by the user, the mobile terminal generates a second dynamic password according to the key of the first virtual card and sends the use request and the second dynamic password to the server; the use request includes the current use status of the first virtual card. And an identifier of the first virtual card; the current usage state of the first virtual card corresponds to the permission information of the first virtual card.
  • the permission information is the usage quota and the usage time
  • the current usage state is the current usage time and the current transaction amount.
  • the server searches for the corresponding second virtual card according to the identifier of the first virtual card, performs authentication on the second dynamic password and the use request according to the corresponding second virtual card, and sends the authentication result to the mobile terminal, so that the mobile terminal performs the next according to the authentication result.
  • One step operation One step operation.
  • the second dynamic instruction may be obtained by the mobile terminal according to the key of the first virtual card and the dynamic reference by an encryption algorithm.
  • the dynamic primer can be the current time or the current time plus an identifier known to both the mobile terminal and the server, such as the transaction amount.
  • the SM3 cryptographic hash algorithm can be used.
  • the key of the first virtual card corresponds to the key of the second virtual card
  • the identifier of the first virtual card corresponds to the identifier of the second virtual card.
  • the encryption algorithm for generating the second dynamic password by the mobile terminal corresponds to the encryption algorithm for the second dynamic password authentication in the server. Corresponding in the present invention may mean the same as the two.
  • the key of the first virtual card and the key of the second virtual card are respectively generated in the physical card and the server, thereby avoiding network transmission of the key, and further improving security.
  • the virtual card may also be authorized to be generated in another mobile terminal by the virtual card already generated in the mobile terminal.
  • the mobile terminal in which the virtual card is generated is equivalent to the physical card described above, and the first dynamic password and the key of the first virtual card are generated therein.
  • Another mobile terminal is equivalent to the mobile terminal in the above embodiment.
  • the specific authorization and use process is similar to the above embodiment, and will not be described in detail herein.
  • the present invention also provides an authorized use device for a virtual device.
  • the device includes a mobile terminal 11 and a server 12.
  • the virtual device terminal software is installed on the mobile terminal 11.
  • the mobile terminal 11 is configured to receive, by the first device, a request for generating a first virtual device and rights information of the first virtual device that is input by the user, and generate an identifier of the first virtual device according to the identifier of the first device, according to the first virtual device.
  • the permission information of the first virtual device generates a first virtual device and sends a request for generating the second virtual device to the server 12;
  • the request for generating the first virtual device includes the identifier of the first device and the first authentication information; generating the second
  • the request of the virtual device includes the identifier of the first device, the first authentication information, and the rights information of the first virtual device.
  • the mobile terminal 11 is further configured to: when receiving the use request input by the user, generate second authentication information, send the use request and the second authentication information to the server 12, and perform the next operation according to the authentication result returned by the server 12; The current usage status of the first virtual device and the identity of the first virtual device are included.
  • the server 12 is configured to: according to the identifier of the first device, the rights information of the first device, and the related authentication information of the first device, the first authentication information and the first virtual device in the request for generating the second virtual device.
  • the privilege information is authenticated.
  • the identifier of the second virtual device is generated according to the identifier of the first device
  • the second virtual device is generated according to the identifier of the second virtual device and the privilege information of the first virtual device
  • the second The virtual device is associated with the first device for storage.
  • the server 12 is further configured to search for the corresponding second virtual device according to the identifier of the first virtual device, perform authentication on the second authentication information and the use request according to the corresponding second virtual device, and send the authentication result to the mobile terminal 11.
  • the mobile terminal 11 is configured to interact with the physical device 13 to obtain a request for generating the first generated virtual card from the physical device 13.
  • the specific can be obtained by manual input, NFC reading, Bluetooth transmission, and two-dimensional code recognition.
  • the physical device may specifically be a physical card, such as a physical bank card.
  • the mobile terminal 11 is configured to communicate with another mobile terminal 14 that has generated the third virtual device, and obtain a request to generate the first virtual card from the other mobile terminal 14.
  • the above device can authenticate the virtual device and the use of the virtual device through the PKI mode or the dynamic password mode.
  • the mobile terminal 11 and the server 12 complete the authorization generation and use of the virtual device by means of a dynamic password.
  • the mobile terminal 11 is configured to receive a request for generating a first virtual device of the first device and rights information of the first virtual device that is input by the user, and generate an identifier of the first virtual device according to the identifier of the first device, and according to the first virtual
  • the identifier of the device, the key of the first virtual device, and the rights information of the first virtual device generate a first virtual device and send a request for generating the second virtual device to the server;
  • the request for generating the first virtual device includes the identifier of the first device, a first dynamic password and a key of the first virtual device;
  • the first dynamic password is obtained by the first device according to the key of the first device and the dynamic primer;
  • the key of the first virtual device is determined by the first device according to the first
  • the key of the device is encrypted;
  • the request for generating the second virtual device includes the identifier of the first device, the first dynamic password, and the rights information of the first virtual device.
  • the mobile terminal is further configured to: when receiving the use request input by the user, generate a second dynamic password according to the key of the first virtual device, and send the use request and the second dynamic password to the server 12 and according to the authentication returned by the server 12 The result is the next step.
  • the usage request includes a current usage status of the first virtual device and an identifier of the first virtual device; the current usage status of the first virtual device corresponds to the rights information of the first virtual device.
  • the server 12 is configured to generate, according to the identifier of the first device, the rights information of the first device, and the key pair of the first device, the first dynamic password and the rights information of the first virtual device.
  • the authentication is performed, and when the authentication is passed, the identifier of the second virtual device is generated according to the identifier of the first device, and the key of the second virtual device is generated according to the key of the first device, and according to the identifier of the second virtual device, the second
  • the key of the virtual device and the rights information of the first virtual device generate a second virtual device, and store the second virtual device in association with the first device.
  • the server 12 is further configured to search for a corresponding second virtual device according to the identifier of the first virtual device, perform authentication on the second dynamic password and the use request according to the corresponding second virtual device, and send the authentication result to the mobile terminal.
  • the foregoing permission information includes at least one of a time, a category, and a quota
  • the current usage state of the first virtual device includes at least one of a current usage time, a usage category, and a usage quota of the first virtual device.

Abstract

本发明公开了一种虚拟设备的授权使用方法及装置，其中方法包括：移动终端接收生成虚拟设备的请求后，设置第一虚拟设备的权限信息，生成第一虚拟设备，并与服务器进行交互，将设置的第一虚拟设备的权限信息和相关认证信息发送至服务器进行认证。服务器认证通过后生成具有上述权限信息的第二虚拟设备。在使用时，移动终端生成认证信息并将认证信息和第一虚拟设备的当前使用状态发送至服务器进行认证，并返回认证结果。本发明通过在授权生成虚拟设备和虚拟设备使用过程中增加关于权限信息的认证，提高了安全性。

Description

一种虚拟设备的授权使用方法及装置 一种虚拟设备的授权使用方法及装置
技术领域
本发明涉及虚拟设备领域，尤其涉及一种可设置权限的虚拟设备的授权使用方法及装置。
背景技术
目前的购物支付方式主要有两种，一种是利用物理卡，即实体银行卡，物理卡安全性高，但在各种场合使用容易造成泄漏或丢失，而且也无法同时多地点、多人使用。第二种是利用纯虚拟卡，纯虚拟卡虽然使用方便，但安全性很低，只凭卡号、有效期、验证码等信息完成交易验证，而且密码等信息在网络中传播也容易造成泄漏。
在其他的领域也存在类似的情况，比如门禁卡的使用。实体门禁卡同实体银行卡一样，虽然安全性高，但需要经常携带，而这样很容易造成丢失。若使用纯虚拟卡，如将相关身份信息嵌入到智能手机中，利用智能手机开启门禁。虽然使用方便，但安全性同样比较低。
发明内容
本发明的目的在于提供一种虚拟设备的授权使用方法及装置，以提高虚拟设备授权过程及使用过程中的安全性。
基于上述目的，本发明实施例提供了一种虚拟设备的授权使用方法，包括；
移动终端接收第一设备发送的生成第一虚拟设备的请求，所述生成第一虚拟设备的请求包括所述第一设备的标识和第一认证信息；所述移动终端上安装有虚拟设备终端软件；
所述移动终端接收用户输入的第一虚拟设备的权限信息；
所述移动终端生成第一虚拟设备且服务器生成第二虚拟设备；
当接收到用户输入的使用请求时，所述移动终端生成第二认证信息并将所述使用请求和所述第二认证信息发送至所述服务器；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；
所述服务器根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二认证信息和所述使用请求进行认证并将认证结果发送至所述移动终端，以便所述移动终端根据所述认证结果进行下一步操作；
其中，
所述移动终端生成第一虚拟设备包括：所述移动终端根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识和所述第一虚拟设备的权限信息生成第一虚拟设备；
所述服务器生成第二虚拟设备包括：
所述服务器接收所述移动终端发送的生成第二虚拟设备的请求；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一认证信息和所述第一虚拟设备的权限信息，所述服务器根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的相关认证信息对所述生成第二虚拟设备的请求中的所述第一认证信息和所述第一虚拟设备的权限信息进行认证，
若认证通过，则所述服务器根据所述第一设备的标识生成第二虚拟设备的标识，并根据所述第二虚拟设备的标识和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储。
优选的，所述移动终端接收第一设备发送的生成第一虚拟设备的请求包括：
所述移动终端与物理设备进行交互，从所述物理设备获取所述生成第一虚拟设备的请求；
或，
所述移动终端与生成有第三虚拟设备的另一移动终端进行通信，从所述另一移动终端获取所述生成第一虚拟设备的请求。
优选的，所述虚拟设备的授权生成及使用方法通过PKI方式进行认证。
优选的，所述虚拟设备的授权生成及使用方法通过动态口令的方式进行认证；所述方法包括：
所述移动终端与所述第一设备交互获得所述生成第一虚拟设备的请求，所述生成第一虚拟设备的请求包括所述第一设备的标识、第一动态口令和所述第一虚拟设备的密钥；所述第一动态口令由所述第一设备根据所述第一设备的密钥与动态引子加密得到；所述第一虚拟设备的密钥由所述第一设备根据所述第一设备的密钥加密得到；
所述移动终端接收用户输入的第一虚拟设备的权限信息；
所述移动终端根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识、所述第一虚拟设备的密钥和所述第一虚拟设备的权限信息生成第一虚拟设备；
所述移动终端发送生成第二虚拟设备的请求至服务器；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一动态口令和所述第一虚拟设备的权限信息；
所述服务器根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的密钥对所述生成第二虚拟设备的请求中的所述第一动态口令和所述第一虚拟设备的权限信息进行认证；
若认证通过，则所述服务器根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第一设备的密钥加密生成第二虚拟设备的密钥；
所述服务器根据所述第二虚拟设备的标识、所述第二虚拟设备的密钥和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
当接收到用户输入的使用请求时，所述移动终端根据所述第一虚拟设备的密钥生成第二动态口令并将所述使用请求和所述第二动态口令发送至所述服务器；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；所述第一虚拟设备的当前使用状态与所述第一虚拟设备的权限信息相对应；
所述服务器根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二动态口令和所述使用请求进行认证并将认证结果发送至所述移动终端，以便所述移动终端根据所述认证结果进行下一步操作。
优选的，所述生成第一虚拟卡的请求还包括随机码；
所述第一虚拟设备的密钥由所述第一设备根据所第一设备的密钥和所述随机码通过SM3密码杂凑算法散列生成；
所述第二生成虚拟卡的请求还包括所述随机码；
若认证通过，则所述服务器根据所述第一设备的密钥和所述随机码通过SM3密码杂凑算法散列生成所述第二虚拟设备的密钥。
优选的，所述权限信息包括时间、类别、额度中的至少一种，所述第一虚拟设备的当前使用状态包括所述第一虚拟设备的当前使用时间、使用类别、使用额度中的至少一种。
本发明实施例还提供了一种虚拟设备的授权使用装置，包括移动终端和服务器；
所述移动终端，用于接收第一设备发送的生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据所述第一设备的标识生成第一虚拟设备的标识，根据所述第一虚拟设备的标识和所述第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器；所述生成第一虚拟设备的请求包括所述第一设备的标识和第一认证信息；所述移动终端上安装有虚拟设备终端软件；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一认证信息和所述第一虚拟设备的权限信息；
所述移动终端还用于当接收到用户输入的使用请求时，生成第二认证信息，将所述使用请求和所述第二认证信息发送至所述服务器并根据所述服务器返回的认证结果进行下一步操作；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；
所述服务器，用于根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的相关认证信息对所述生成第二虚拟设备的请求中的所述第一认证信息和所述第一虚拟设备的权限信息进行认证，在认证通过使=时，根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第二虚拟设备的标识和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
所述服务器，还用于根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二认证信息和所述使用请求进行认证并将认证结果发送至所述移动终端。
优选的，
所述移动终端，用于与物理设备进行交互，从所述物理设备获取所述生成第一虚拟设备的请求；
或，
所述移动终端，用于与生成有第三虚拟设备的另一移动终端进行通信，从所述另一移动终端获取所述生成第一虚拟设备的请求。
优选的，所述移动终端和所述服务器通过PKI方式完成虚拟设备的授权生成及使用。
优选的，所述移动终端和所述服务器通过动态口令的方式完成虚拟设备的授权生成及使用；
所述移动终端，用于接收所述第一设备的所述生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识、所述第一虚拟设备的密钥和所述第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器；所述生成第一虚拟设备的请求包括所述第一设备的标识、第一动态口令和所述第一虚拟设备的密钥；所述第一动态口令由所述第一设备根据所述第一设备的密钥与动态引子加密得到；所述第一虚拟设备的密钥由所述第一设备根据所述第一设备的密钥加密得到；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一动态口令和所述第一虚拟设备的权限信息；
所述移动终端，还用于当接收到用户输入的使用请求时，根据所述第一虚拟设备的密钥生成第二动态口令并将所述使用请求和所述第二动态口令发送至所述服务器并根据所述服务器返回的认证结果进行下一步操作；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；所述第一虚拟设备的当前使用状态与所述第一虚拟设备的权限信息相对应；
所述服务器，用于根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的密钥对所述生成第二虚拟设备的请求中的所述第一动态口令和所述第一虚拟设备的权限信息进行认证并在认证通过时，根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第一设备的密钥加密生成第二虚拟设备的密钥，并根据所述第二虚拟设备的标识、所述第二虚拟设备的密钥和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
所述服务器，还用于根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二动态口令和所述使用请求进行认证并将认证结果发送至所述移动终端。
优选的，所述权限信息包括时间、类别、额度中的至少一种，所述第一虚拟设备的当前使用状态包括所述第一虚拟设备的当前使用时间、使用类别、使用额度中的至少一种。
本发明的有益效果是：
本发明通过在移动终端上安装虚拟设备终端软件，在移动终端上授权生成具有一定权限限制（时间、类别、额度）的虚拟设备，并与授权过程和使用过程中，与服务器进行交互认证，在方便使用的同时提高了安全性。而且本发明中可以通过在虚拟设备终端软件中刷卡立即可以生成虚拟设备，其过程方便且安全。在与服务器进行认证（虚拟设备授权生成和虚拟设备使用过程中都有）时，可支持动态口令技术、PKI技术等，而且采用动态口令技术时，密钥分别在服务器和第一设备内散列生成、不进行网络传输，进一步提高了安全性。而且本发明中具有相应权限的虚拟设备也可以授权生成新的虚拟设备。
附图说明
图1为本发明授权生成虚拟设备的流程图；
图2为本发明虚拟设备使用流程图；
图3为本发明使用动态口令授权生成虚拟卡的流程图；
图4为本发明使用动态口令使用虚拟卡的流程图；
图5为本发明装置结构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
实施例一
本发明实施例一提供了一种虚拟设备的授权使用方法，该方法具体包括授权生成虚拟设备的过程和具体使用虚拟设备进行相关操作如支付或开启门禁的过程。这两个过程均需要在移动终端和服务器之间进行认证。除去身份认证信息外，该方法还增加了权限信息的认证。用户在移动终端上设置虚拟设备的使用权限，然后发送至服务器中进行校验。如果校验通过即设置的虚拟设备的使用权限在第一设备的权限范围内，则在服务器上授权生成虚拟设备。在使用时，移动终端发送虚拟设备的当前使用状态至服务器进行认证，如果符合上述设置的虚拟设备的使用权限，则认证通过。为实现上述方法，本发明需要部署授权生成虚拟设备的运营平台，即设置服务器，在服务器中预先存储用于进行认证的信息，如设备标识、设备的密钥以及设备的权限信息等。还需要在移动终端上安装虚拟设备终端软件，并发行带有OTP （One-time Password,动态口令）功能或PKI(Public Key Infrastructure，公钥基础设施）功能的物理设备。上述准备工作完成之后，就需要在移动终端和服务器中进行授权生成虚拟设备。参见图1，为授权生成虚拟设备的步骤：
S11、移动终端接收第一设备发送的生成第一虚拟设备的请求。其中生成第一虚拟设备的请求包述第一设备的标识和第一认证信息；移动终端上安装有虚拟设备终端软件。
上述第一设备可以为物理设备，如物理卡，具体的如实体的银行卡、门禁卡等，其标识具体的可以为银行卡号或序列号等。移动终端与物理设备进行交互，从物理设备获取生成第一虚拟设备的请求。
上述第一设备也可以是一设置在另一移动终端上的第三虚拟设备，如设置在手机上的虚拟银行卡或虚拟门禁卡，其标识具体的可以为虚拟银行卡号或虚拟序列号。移动终端与设置有第三虚拟设备的另一移动终端进行通信，从另一移动终端获取生成第一虚拟设备的请求。
本发明中，为提高安全性，可对能够授权生成虚拟设备的虚拟设备进行权限限制，即只有具有一定权限的虚拟设备才可以授权生成另一虚拟设备。
上述第一设备并不局限于卡的形式，本发明对此不作具体限制。
上述第一认证信息为用于进行身份验证的信息，具体的可以为动态口令或PKI方式生成的认证信息。后续将会对动态口令的认证方式进行详细介绍。
S12、移动终端接收用户输入的第一虚拟设备的权限信息。
上述权限信息根据第一设备的不同而不同。比如对于银行卡可以设置使用时间、额度以及类别等，对于门禁卡可以设置使用时间、次数、门禁卡可开启的房门类型等。
用户可以通过手动输入的方式输入想要设置的第一虚拟设备的权限信息。因为虚拟设备的权限信息必须在第一设备的权限范围内，为此，在本发明优选实施例中，移动终端还可以获取第一设备的权限信息并在移动终端上显示，以便用户据此进行输入，提高授权生成虚拟设备的成功率。
S13、移动终端根据第一设备的标识生成第一虚拟设备的标识并根据第一虚拟设备的标识和第一虚拟设备的权限信息生成第一虚拟设备。
移动终端可以对第一设备的标识采用加密算法生成对应的第一虚拟设备的标识。其具体的可以采用SM3密码杂凑算法。
在具体实施例中，该第一虚拟设备的标识可以与第一设备的标识相同。
S14、移动终端发送生成第二虚拟设备的请求至服务器；生成第二虚拟设备的请求中包含第一设备的标识、第一认证信息和第一虚拟设备的权限信息。
S15、服务器根据自身存储的第一设备的标识、第一设备的权限信息和第一设备的相关认证信息对生成第二虚拟设备的请求中的第一认证信息和第一虚拟设备的权限信息进行认证。
服务器首先根据第一设备的标识在自身数据库中查找对应的标识，并获取与该对应的标识相关的认证信息和权限信息。
服务器接着根据自身的认证信息和权限信息对第一认证信息和第一虚拟设备的权限信息进行认证校验。
具体的如验证第一虚拟设备设置的使用时间、使用额度、使用类别是否在第一设备的使用时间、使用额度和使用类别范围内，若是，则校验通过。
上述认证可以采用动态口令或PKI方式进行。
S16、若认证通过，则服务器根据第一设备的标识生成第二虚拟设备的标识，并根据第二虚拟设备的标识和第一虚拟设备的权限信息生成第二虚拟设备，并将第二虚拟设备与第一设备进行关联存储。
服务器可以对第一设备的标识采用加密算法生成对应的第二虚拟设备的标识。其具体的可以采用SM3密码杂凑算法。
若认证没有通过，则拒绝生成第二虚拟设备的请求。
在具体实施例中，该第二虚拟设备的标识可以与第一设备的标识相同。
需要说明的是，上述步骤的标号顺序仅是本发明顺序的一种，其还包括通过文字限定的其他所有可能的顺序。如步骤S13可以在步骤S16之后进行。
移动终端和服务器中生成虚拟设备后，移动终端便可以使用虚拟设备。参见图2，为本发明中使用虚拟设备的步骤：
S21、当接收到用户输入的使用请求时，移动终端生成第二认证信息并将使用请求和第二认证信息发送至服务器；使用请求中包含第一虚拟设备的当前使用状态和第一虚拟设备的标识。
用户通过在移动终端中输入或选择对应的标识选定要使用的第一虚拟设备，之后发送使用请求和第二认证信息至服务器。其中，使用请求中包含第一虚拟设备的当前使用状态，如当前的使用时间、使用次数、使用类别或使用的金额等。
S22、服务器根据第一虚拟设备的标识查找对应的第二虚拟设备，根据对应的第二虚拟设备对第二认证信息和使用请求进行认证并将认证结果发送至移动终端，以便移动终端根据认证结果进行下一步操作。
上述认证可以采用动态口令或PKI方式进行。
如前所述第一虚拟设备的标识和第二虚拟设备的标识均与第一设备的标识对应，因此，服务器可根据第一虚拟设备的标识查找到第二虚拟设备，然后根据第二虚拟设备自身存储的认证信息和权限信息进行认证，并返回认证结果给移动终端。
在上述实施例中，为进一步提高安全性，可以通过第一设备下发随机码到移动终端，继而通过移动终端发送至服务器。这样移动终端和服务器分别可以根据第一设备的标识和随机码通过一定的加密算法如SM3密码杂凑算法散列生成第一虚拟设备的标识和第二虚拟设备的标识。
需要说明的是，虚拟卡的使用过程即步骤S21和步骤S22在授权生成虚拟卡之后，可重复进行。
本发明在生成授权生成虚拟设备的过程以及使用虚拟设备的过程中设置了对权限信息的认证，同现有技术相比，提高了安全性。
另外，本发明中的第一虚拟设备与移动终端绑定，如果要使用另一移动终端时，需要在另一移动终端中授权生成。这一方式也提高了虚拟设备使用的安全性。
实施例二
本发明通过实施例二详细介绍物理卡通过动态口令方式授权生成虚拟卡的过程，如图3所示，该过程包括：
首先，将物理卡与移动终端进行交互获取生成第一虚拟卡的请求。生成第一虚拟卡的请求中包括物理卡的标识、第一动态口令和第一虚拟卡的密钥。移动终端具体可通过手工输入、二维码识别或NFC ( Near Field Communication，近距离无线通讯技术)读取方式获取物理卡的标识和物理卡内生成的第一动态口令。该种方式中的物理卡具有动态口令生成功能。当通过NFC等方式时，用户只需要将物理卡在相应位置一刷即可。
接着，移动终端接收用户输入的第一虚拟卡的权限信息。上述权限信息可以是授权时间、授权额度（如最高限额）和授权类别中的至少一种。
之后，移动终端根据物理卡的标识生成第一虚拟卡的标识并根据第一虚拟卡的标识、第一虚拟卡的密钥和第一虚拟卡的权限信息生成第一虚拟卡。该过程可以是基于生成第一虚拟卡的请求自动触发，也可以是在接收到用户输入的命令时触发。此处不作具体限制。
移动终端还发送生成第二虚拟卡的请求至服务器；生成第二虚拟卡的请求中包含物理卡的标识、第一动态口令和第一虚拟卡的权限信息。该生成第二虚拟卡的请求可以是移动终端在接收到生成第一虚拟卡请求后自动触发的，也可以是经用户输入相关指令后触发的。
接收到生成第二虚拟卡的请求后，服务器根据自身存储的物理卡的标识、物理卡的权限信息和物理卡的密钥对生成第二虚拟卡的请求中的第一动态口令和第一虚拟卡的权限信息进行认证。在具体认证时，服务器可以先根据自身存储的物理卡的密钥对第一动态口令进行认证，若认证通过，再获取自身存储的对应的物理卡的权限信息，对接收的生成第二虚拟卡的请求中的权限信息进行认证，校验其合法有效性。
若认证通过，则服务器根据物理卡的标识生成第二虚拟卡的标识，根据物理卡的密钥加密生成第二虚拟卡的密钥。如果认证没有通过，则服务器拒绝生成第二虚拟卡。
之后，服务器根据第二虚拟卡的标识、第二虚拟卡的密钥和第一虚拟卡的权限信息生成第二虚拟卡，并将第二虚拟卡与物理卡进行关联存储。如设定第二虚拟卡的标识和物理卡的标识的一一对应关系。
本发明具体实施例中，为提高安全性，第一虚拟卡的标识和第二虚拟卡的标识可以是将物理卡的标识和随机码通过一定的加密算法散列生成，第一虚拟卡的密钥和第二虚拟卡的密钥可以是将物理卡的密钥和随机码通过一定的加密算法散列生成。如SM3密码杂凑算法。其中随机码可通过物理卡下发至移动终端并通过移动终端下发至服务器。
本发明具体实施例中，第一动态口令可以是通过对动态引子和物理卡的密钥加密生成。该动态引子可以是当前时间或者是当前时间加某些前端和后台都知道的标识。其加密算法可以采用上述的SM3密码杂凑算法。
需要说明的是物理卡所使用的加密算法和服务器上对第一动态口令验证时所使用的加密算法相对应，以保证服务器进行的是正确的认证。
移动终端和服务器中生成虚拟卡后，移动终端便可以使用虚拟卡。
接上述实施例，对使用虚拟卡的过程进行说明，如图4所示，该过程包括：
当接收到用户输入的使用请求时，移动终端根据第一虚拟卡的密钥生成第二动态口令并将使用请求和第二动态口令发送至服务器；使用请求中包含第一虚拟卡的当前使用状态和第一虚拟卡的标识；第一虚拟卡的当前使用状态与第一虚拟卡的权限信息相对应。
上述的相对应如当使用虚拟银行卡时，其权限信息为使用额度以及使用时间，那么当前使用状态即为当前使用时间及当前交易金额。
服务器根据第一虚拟卡的标识查找对应的第二虚拟卡，根据对应的第二虚拟卡对第二动态口令和使用请求进行认证并将认证结果发送至移动终端，以便移动终端根据认证结果进行下一步操作。
上述第二动态指令可以是移动终端根据第一虚拟卡的密钥和动态引子通过加密算法得到。该动态引子可以是当前时间或当前时间加移动终端和服务器都知道的标识，比如交易金额。其具体的可以采用SM3密码杂凑算法。
本发明中，第一虚拟卡的密钥和第二虚拟卡的密钥相对应，第一虚拟卡的标识和第二虚拟卡的标识相对应。移动终端生成第二动态口令的加密算法与服务器中对第二动态口令认证的加密算法相对应。本发明中的相对应可以指两者相同。
而且在使用动态口令进行认证时，第一虚拟卡的密钥和第二虚拟卡的密钥分别在物理卡和服务器中生成，避免了密钥的网络传输，进一步提高了安全性。
需要说明的是，上述认证也可以通过PKI的方式进行。与PKI相关的认证部分可结合现有技术进行。
在本发明的另一实施例中，还可以通过移动终端中已经生成的虚拟卡在另一移动终端中授权生成虚拟卡。其中生成有虚拟卡的移动终端相当于上述的物理卡，在其中生成第一动态口令和第一虚拟卡的密钥。另一移动终端相当于上述实施例中的移动终端。具体授权和使用过程同上述实施例类似，此处不再详述。
实施例三
本发明还提供了一种虚拟设备的授权使用装置，参见图5，该装置包括移动终端11和服务器12。
移动终端11上安装有虚拟设备终端软件。
移动终端11，用于接收第一设备发送的生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据第一设备的标识生成第一虚拟设备的标识，根据第一虚拟设备的标识和第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器12；生成第一虚拟设备的请求包括第一设备的标识和第一认证信息；生成第二虚拟设备的请求中包含第一设备的标识、第一认证信息和第一虚拟设备的权限信息。
移动终端11还用于当接收到用户输入的使用请求时，生成第二认证信息，将使用请求和第二认证信息发送至服务器12并根据服务器12返回的认证结果进行下一步操作；使用请求中包含第一虚拟设备的当前使用状态和第一虚拟设备的标识。
服务器12，用于根据自身存储的第一设备的标识、第一设备的权限信息和第一设备的相关认证信息对生成第二虚拟设备的请求中的第一认证信息和所述第一虚拟设备的权限信息进行认证，在认证通过时，根据第一设备的标识生成第二虚拟设备的标识，根据第二虚拟设备的标识和第一虚拟设备的权限信息生成第二虚拟设备，并将第二虚拟设备与第一设备进行关联存储。
服务器12，还用于根据第一虚拟设备的标识查找对应的第二虚拟设备，根据对应的第二虚拟设备对第二认证信息和使用请求进行认证并将认证结果发送至移动终端11。
本发明的一个具体实施例中，移动终端11，用于与物理设备13进行交互，从物理设备13获取生成第一生成虚拟卡的请求。具体的可通过手动输入、NFC读取、蓝牙发送以及二维码识别等方式获取。该物理设备具体可以为物理卡，如实体银行卡。
或者移动终端11，用于与生成有第三虚拟设备的另一移动终端14进行通信，从另一移动终端14获取生成第一虚拟卡的请求。
上述装置可通过PKI方式或动态口令方式进行虚拟设备的授权以及虚拟设备的使用的认证。
本发明另一实施例中，移动终端11和服务器12通过动态口令的方式完成虚拟设备的授权生成及使用。
其中，移动终端11，用于接收第一设备的生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据第一设备的标识生成第一虚拟设备的标识并根据第一虚拟设备的标识、第一虚拟设备的密钥和第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器；生成第一虚拟设备的请求包括第一设备的标识、第一动态口令和第一虚拟设备的密钥；第一动态口令由第一设备根据第一设备的密钥与动态引子加密得到；第一虚拟设备的密钥由所述第一设备根据第一设备的密钥加密得到；生成第二虚拟设备的请求中包含第一设备的标识、第一动态口令和第一虚拟设备的权限信息。
11移动终端，还用于当接收到用户输入的使用请求时，根据第一虚拟设备的密钥生成第二动态口令并将使用请求和第二动态口令发送至服务器12并根据服务器12返回的认证结果进行下一步操作。使用请求中包含第一虚拟设备的当前使用状态和第一虚拟设备的标识；第一虚拟设备的当前使用状态与第一虚拟设备的权限信息相对应。
服务器12，用于根据自身存储的第一设备的标识、第一设备的权限信息和第一设备的密钥对生成第二虚拟设备的请求中的第一动态口令和第一虚拟设备的权限信息进行认证并在认证通过时，根据第一设备的标识生成第二虚拟设备的标识，根据第一设备的密钥加密生成第二虚拟设备的密钥，并根据第二虚拟设备的标识、第二虚拟设备的密钥和第一虚拟设备的权限信息生成第二虚拟设备，并将第二虚拟设备与第一设备进行关联存储。
服务器12，还用于根据第一虚拟设备的标识查找对应的第二虚拟设备，根据对应的第二虚拟设备对第二动态口令和使用请求进行认证并将认证结果发送至移动终端。
根据第一设备的不同，上述权限信息包括时间、类别、额度中的至少一种，第一虚拟设备的当前使用状态包括第一虚拟设备的当前使用时间、使用类别、使用额度中的至少一种。
需要说明的是，本发明的装置和方法实施例相对应，相关部分可互相参考。
以上的具体实施例，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应注意的是，以上仅为本发明的一个具体实施例而已，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (1)

  1. 1、一种虚拟设备的授权使用方法，其特征在于，所述方法包括；
    移动终端接收第一设备发送的生成第一虚拟设备的请求，所述生成第一虚拟设备的请求包括所述第一设备的标识和第一认证信息；所述移动终端上安装有虚拟设备终端软件；
    所述移动终端接收用户输入的第一虚拟设备的权限信息；
    所述移动终端生成第一虚拟设备且服务器生成第二虚拟设备；
    当接收到用户输入的使用请求时，所述移动终端生成第二认证信息并将所述使用请求和所述第二认证信息发送至所述服务器；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；
    所述服务器根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二认证信息和所述使用请求进行认证并将认证结果发送至所述移动终端，以便所述移动终端根据所述认证结果进行下一步操作；
    其中，
    所述移动终端生成第一虚拟设备包括：所述移动终端根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识和所述第一虚拟设备的权限信息生成第一虚拟设备；
    所述服务器生成第二虚拟设备包括：
    所述服务器接收所述移动终端发送的生成第二虚拟设备的请求；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一认证信息和所述第一虚拟设备的权限信息，所述服务器根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的相关认证信息对所述生成第二虚拟设备的请求中的所述第一认证信息和所述第一虚拟设备的权限信息进行认证，
    若认证通过，则所述服务器根据所述第一设备的标识生成第二虚拟设备的标识，并根据所述第二虚拟设备的标识和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储。
    2、如权利要求1所述的方法，其特征在于，所述移动终端接收第一设备发送的生成第一虚拟设备的请求包括：
    所述移动终端与物理设备进行交互，从所述物理设备获取所述生成第一虚拟设备的请求；
    或，
    所述移动终端与生成有第三虚拟设备的另一移动终端进行通信，从所述另一移动终端获取所述生成第一虚拟设备的请求。
    3、如权利要求1所述的方法，其特征在于，所述虚拟设备的授权生成及使用方法通过PKI方式进行认证。
    4、如权利要求1所述的方法，其特征在于，所述虚拟设备的授权生成及使用方法通过动态口令的方式进行认证；所述方法包括：
    所述移动终端与所述第一设备交互获得所述生成第一虚拟设备的请求，所述生成第一虚拟设备的请求包括所述第一设备的标识、第一动态口令和所述第一虚拟设备的密钥；所述第一动态口令由所述第一设备根据所述第一设备的密钥与动态引子加密得到；所述第一虚拟设备的密钥由所述第一设备根据所述第一设备的密钥加密得到；
    所述移动终端接收用户输入的第一虚拟设备的权限信息；
    所述移动终端根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识、所述第一虚拟设备的密钥和所述第一虚拟设备的权限信息生成第一虚拟设备；
    所述移动终端发送生成第二虚拟设备的请求至服务器；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一动态口令和所述第一虚拟设备的权限信息；
    所述服务器根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的密钥对所述生成第二虚拟设备的请求中的所述第一动态口令和所述第一虚拟设备的权限信息进行认证；
    若认证通过，则所述服务器根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第一设备的密钥加密生成第二虚拟设备的密钥；
    所述服务器根据所述第二虚拟设备的标识、所述第二虚拟设备的密钥和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
    当接收到用户输入的使用请求时，所述移动终端根据所述第一虚拟设备的密钥生成第二动态口令并将所述使用请求和所述第二动态口令发送至所述服务器；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；所述第一虚拟设备的当前使用状态与所述第一虚拟设备的权限信息相对应；
    所述服务器根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二动态口令和所述使用请求进行认证并将认证结果发送至所述移动终端，以便所述移动终端根据所述认证结果进行下一步操作。
    5、如权利要求4所述的方法，其特征在于，所述生成第一虚拟卡的请求还包括随机码；
    所述第一虚拟设备的密钥由所述第一设备根据所第一设备的密钥和所述随机码通过SM3密码杂凑算法散列生成；
    所述第二生成虚拟卡的请求还包括所述随机码；
    若认证通过，则所述服务器根据所述第一设备的密钥和所述随机码通过SM3密码杂凑算法散列生成所述第二虚拟设备的密钥。
    6、如权利要求1-5任意一项所述的方法，其特征在于，所述权限信息包括时间、类别、额度中的至少一种，所述第一虚拟设备的当前使用状态包括所述第一虚拟设备的当前使用时间、使用类别、使用额度中的至少一种。
    7、一种虚拟设备的授权使用装置，其特征在于，所述装置包括移动终端和服务器；
    所述移动终端，用于接收第一设备发送的生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据所述第一设备的标识生成第一虚拟设备的标识，根据所述第一虚拟设备的标识和所述第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器；所述生成第一虚拟设备的请求包括所述第一设备的标识和第一认证信息；所述移动终端上安装有虚拟设备终端软件；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一认证信息和所述第一虚拟设备的权限信息；
    所述移动终端还用于当接收到用户输入的使用请求时，生成第二认证信息，将所述使用请求和所述第二认证信息发送至所述服务器并根据所述服务器返回的认证结果进行下一步操作；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；
    所述服务器，用于根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的相关认证信息对所述生成第二虚拟设备的请求中的所述第一认证信息和所述第一虚拟设备的权限信息进行认证，在认证通过使=时，根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第二虚拟设备的标识和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
    所述服务器，还用于根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二认证信息和所述使用请求进行认证并将认证结果发送至所述移动终端。
    8、如权利要求7所述的装置，其特征在于，
    所述移动终端，用于与物理设备进行交互，从所述物理设备获取所述生成第一虚拟设备的请求；
    或，
    所述移动终端，用于与生成有第三虚拟设备的另一移动终端进行通信，从所述另一移动终端获取所述生成第一虚拟设备的请求。
    9、如权利要求7所述的装置，其特征在于，所述移动终端和所述服务器通过PKI方式完成虚拟设备的授权生成及使用。
    10、如权利要求7所述的装置，其特征在于，所述移动终端和所述服务器通过动态口令的方式完成虚拟设备的授权生成及使用；
    所述移动终端，用于接收所述第一设备的所述生成第一虚拟设备的请求和用户输入的第一虚拟设备的权限信息，根据所述第一设备的标识生成第一虚拟设备的标识并根据所述第一虚拟设备的标识、所述第一虚拟设备的密钥和所述第一虚拟设备的权限信息生成第一虚拟设备并发送生成第二虚拟设备的请求至服务器；所述生成第一虚拟设备的请求包括所述第一设备的标识、第一动态口令和所述第一虚拟设备的密钥；所述第一动态口令由所述第一设备根据所述第一设备的密钥与动态引子加密得到；所述第一虚拟设备的密钥由所述第一设备根据所述第一设备的密钥加密得到；所述生成第二虚拟设备的请求中包含所述第一设备的标识、所述第一动态口令和所述第一虚拟设备的权限信息；
    所述移动终端，还用于当接收到用户输入的使用请求时，根据所述第一虚拟设备的密钥生成第二动态口令并将所述使用请求和所述第二动态口令发送至所述服务器并根据所述服务器返回的认证结果进行下一步操作；所述使用请求中包含所述第一虚拟设备的当前使用状态和所述第一虚拟设备的标识；所述第一虚拟设备的当前使用状态与所述第一虚拟设备的权限信息相对应；
    所述服务器，用于根据自身存储的所述第一设备的标识、所述第一设备的权限信息和所述第一设备的密钥对所述生成第二虚拟设备的请求中的所述第一动态口令和所述第一虚拟设备的权限信息进行认证并在认证通过时，根据所述第一设备的标识生成第二虚拟设备的标识，根据所述第一设备的密钥加密生成第二虚拟设备的密钥，并根据所述第二虚拟设备的标识、所述第二虚拟设备的密钥和所述第一虚拟设备的权限信息生成第二虚拟设备，并将所述第二虚拟设备与所述第一设备进行关联存储；
    所述服务器，还用于根据所述第一虚拟设备的标识查找对应的所述第二虚拟设备，根据对应的所述第二虚拟设备对所述第二动态口令和所述使用请求进行认证并将认证结果发送至所述移动终端。
    11、如权利要求7-10任意一项所述的装置，其特征在于，所述权限信息包括时间、类别、额度中的至少一种，所述第一虚拟设备的当前使用状态包括所述第一虚拟设备的当前使用时间、使用类别、使用额度中的至少一种。
PCT/CN2014/089225 2013-12-06 2014-10-23 一种虚拟设备的授权使用方法及装置 WO2015081763A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/102,137 US10305878B2 (en) 2013-12-06 2014-10-23 Virtual device authorization method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310653256.8 2013-12-06
CN201310653256.8A CN104702566B (zh) 2013-12-06 2013-12-06 一种虚拟设备的授权使用方法及装置

Publications (1)

Publication Number Publication Date
WO2015081763A1 true WO2015081763A1 (zh) 2015-06-11

Family

ID=53272854

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/089225 WO2015081763A1 (zh) 2013-12-06 2014-10-23 一种虚拟设备的授权使用方法及装置

Country Status (3)

Country Link
US (1) US10305878B2 (zh)
CN (1) CN104702566B (zh)
WO (1) WO2015081763A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105046492B (zh) * 2015-07-10 2022-04-05 苏州海博智能系统有限公司 一种授权消费方法及系统
TWI588676B (zh) * 2016-03-07 2017-06-21 Walton Advanced Eng Inc 裝置配對方法
WO2020063138A1 (zh) * 2018-09-28 2020-04-02 京东数字科技控股有限公司 获得虚拟银行卡支付权限的方法、系统、电子设备和介质
US11102068B1 (en) * 2018-12-19 2021-08-24 Worldpay, Llc Systems and methods to configure pin pad for microprocessor-enabled and contactless payment vehicles
CN110213248B (zh) * 2019-05-20 2022-02-18 武汉市灯塔互动文化传播有限公司 一种离线环境下授权方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090043647A1 (en) * 2007-08-08 2009-02-12 Korea Smart Card Co., Ltd. Metthod to activate electronic payment means in mobile terminal and activity server thereof
CN101754466A (zh) * 2008-12-10 2010-06-23 运软网络科技(上海)有限公司 移动虚拟化的基础设施以及基础平台
CN102103778A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 移动支付系统、移动终端及移动支付业务的实现方法
CN102187353A (zh) * 2008-09-05 2011-09-14 吉弗坦戈公司 用于虚拟储值卡的身份验证的系统和方法

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309272B (zh) * 2008-07-09 2012-12-19 中兴通讯股份有限公司 认证服务器及虚拟专用网的移动通信终端接入控制方法
CN101414370A (zh) * 2008-12-15 2009-04-22 阿里巴巴集团控股有限公司 利用虚拟卡提高支付安全的支付方法、系统及支付平台
US8689213B2 (en) * 2009-12-14 2014-04-01 Citrix Systems, Inc. Methods and systems for communicating between trusted and non-trusted virtual machines
CN101853416B (zh) * 2010-06-02 2013-05-29 东信和平科技股份有限公司 设有虚拟智能卡的物理智能卡及虚拟智能卡的配置方法
GB2483300A (en) * 2010-09-06 2012-03-07 Fonleap Ltd Transferring virtual machine state between host systems with common portions using a portable device
CN103154960A (zh) * 2010-10-19 2013-06-12 惠普发展公司，有限责任合伙企业 用于生成授权虚拟设备的系统和方法
CN102571698B (zh) * 2010-12-17 2017-03-22 中国移动通信集团公司 一种虚拟机访问权限的控制方法、系统及装置
US9021005B2 (en) * 2011-03-04 2015-04-28 Mformation Software Technologies Llc System and method to provide remote device management for mobile virtualized platforms
CN102707985A (zh) * 2011-03-28 2012-10-03 中兴通讯股份有限公司 一种虚拟机系统的访问控制方法和系统
US8984610B2 (en) * 2011-04-18 2015-03-17 Bank Of America Corporation Secure network cloud architecture
US8893261B2 (en) * 2011-11-22 2014-11-18 Vmware, Inc. Method and system for VPN isolation using network namespaces
CN102412971B (zh) * 2011-11-30 2015-04-29 西安西电捷通无线网络通信股份有限公司 基于sm2密钥交换协议的密钥协商方法及装置
CN102577315A (zh) * 2011-12-21 2012-07-11 华为技术有限公司 设定用户访问虚拟机权限的方法、设备和系统
US8739257B1 (en) * 2012-03-28 2014-05-27 Emc Corporation Managing authentication of virtual clients
US9462081B2 (en) * 2012-04-17 2016-10-04 Igt Cloud based virtual environment validation
US9953310B2 (en) * 2012-05-10 2018-04-24 Mastercard International Incorporated Systems and method for providing multiple virtual secure elements in a single physical secure element of a mobile device
US9317689B2 (en) * 2012-06-15 2016-04-19 Visa International Service Association Method and apparatus for secure application execution
US20130346305A1 (en) * 2012-06-26 2013-12-26 Carta Worldwide Inc. Mobile wallet payment processing

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090043647A1 (en) * 2007-08-08 2009-02-12 Korea Smart Card Co., Ltd. Metthod to activate electronic payment means in mobile terminal and activity server thereof
CN102187353A (zh) * 2008-09-05 2011-09-14 吉弗坦戈公司 用于虚拟储值卡的身份验证的系统和方法
CN101754466A (zh) * 2008-12-10 2010-06-23 运软网络科技(上海)有限公司 移动虚拟化的基础设施以及基础平台
CN102103778A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 移动支付系统、移动终端及移动支付业务的实现方法

Also Published As

Publication number Publication date
US20160359832A1 (en) 2016-12-08
CN104702566B (zh) 2021-08-06
US10305878B2 (en) 2019-05-28
CN104702566A (zh) 2015-06-10

Similar Documents

Publication Publication Date Title
WO2011066704A1 (zh) 一种公交一卡通业务系统及其实现方法
WO2016126052A2 (ko) 인증 방법 및 시스템
WO2014139403A1 (zh) 一种终端主密钥tmk安全下载方法及系统
WO2015081763A1 (zh) 一种虚拟设备的授权使用方法及装置
WO2014139342A1 (zh) 密钥下载方法、管理方法、下载管理方法及装置和系统
WO2019001110A1 (zh) 权限认证方法、系统、设备及计算机可读存储介质
WO2015172684A1 (en) Ap connection method, terminal, and server
WO2016108468A1 (en) User terminal, service providing apparatus, driving method of user terminal, driving method of service providing apparatus, and encryption indexing-based search system
WO2019231252A1 (en) Electronic device for authenticating user and operating method thereof
WO2017054481A1 (zh) 一种信息验证和处理方法、装置、以及信息处理系统
WO2019033904A1 (zh) 登录验证方法、系统及计算机可读存储介质
WO2016076638A1 (en) Apparatus and method for payment
WO2021075867A1 (ko) 블록체인 기반 시스템을 위한 키의 저장 및 복구 방법과 그 장치
WO2019100531A1 (zh) 数字签名生成、验证方法及其设备和存储介质
WO2018034491A1 (en) A primary device, an accessory device, and methods for processing operations on the primary device and the accessory device
WO2019056867A1 (zh) 基于物联网的共享车辆停车管理系统及方法
WO2019132555A1 (ko) 이모지가 포함된 메시지를 송수신하는 전자 장치 및 그 전자 장치를 제어하는 방법
WO2019134218A1 (zh) 基于vtm的转账方法、装置、服务器和存储介质
WO2019037395A1 (zh) 密钥管理方法、装置及可读存储介质
WO2021080316A1 (ko) 권한 정보에 기초한 인증서를 사용하여 액세스 컨트롤하는 방법 및 장치
WO2019136881A1 (zh) 一种无卡取款的保护方法、设备及存储介质
WO2019161599A1 (zh) Im信息保护方法、装置、设备和计算机存储介质
WO2017188497A1 (ko) 무결성 및 보안성이 강화된 사용자 인증방법
WO2020105892A1 (ko) 디바이스가 디지털 키를 공유하는 방법
WO2017113587A1 (zh) 创建wep密码的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14867123

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 15102137

Country of ref document: US

122 Ep: pct application non-entry in european phase

Ref document number: 14867123

Country of ref document: EP

Kind code of ref document: A1