WO2016065860A1 - 一种事件型动态口令防伪标签合法性实时验证方法及系统 - Google Patents

一种事件型动态口令防伪标签合法性实时验证方法及系统 Download PDF

Info

Publication number
WO2016065860A1
WO2016065860A1 PCT/CN2015/076684 CN2015076684W WO2016065860A1 WO 2016065860 A1 WO2016065860 A1 WO 2016065860A1 CN 2015076684 W CN2015076684 W CN 2015076684W WO 2016065860 A1 WO2016065860 A1 WO 2016065860A1
Authority
WO
WIPO (PCT)
Prior art keywords
unit
module
dynamic password
electronic tag
data
Prior art date
Application number
PCT/CN2015/076684
Other languages
English (en)
French (fr)
Inventor
樊晓东
Original Assignee
杭州沃朴物联科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 杭州沃朴物联科技有限公司 filed Critical 杭州沃朴物联科技有限公司
Publication of WO2016065860A1 publication Critical patent/WO2016065860A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the invention belongs to the technical field of electronic anti-counterfeiting, and particularly relates to a real-time verification method and system for event-type dynamic password anti-counterfeiting label legality.
  • the field of electronic tag modules mainly uses RFID, NFC, etc.
  • This type of tag requires a special verification terminal to be read, and a professional system is required to perform legality verification. It is not conducive to popularization to each user, and it is not convenient for users to perform real-time verification anytime, anywhere.
  • the dynamic port token output is a time-varying password. Each generated password has a validity and has anti-counterfeiting characteristics.
  • the traditional clock-type dynamic port token is mainly applied to the online banking identity authentication system. You need to log in to the website and manually enter the dynamic password data into the server for verification. If it is applied to the anti-counterfeiting industry, users cannot easily use it, which also makes the dynamic port token difficult to promote in the anti-counterfeiting industry.
  • the purpose of the embodiments of the present invention is to provide a real-time verification method and system for event-type dynamic password anti-counterfeiting label legality, which aims to solve the problem that the electronic tag module field needs to adopt a special verification terminal to read, and also needs to rely on a professional system.
  • Legitimacy verification is possible, which is not conducive to popularization to each user Use, can not let users easily carry out real-time verification problems anytime, anywhere.
  • the embodiment of the present invention is implemented by the method for real-time verification of the event type dynamic password anti-counterfeit label legality.
  • the event-type dynamic password anti-counterfeit label legality real-time verification method comprises the following steps:
  • Step 1 assign a unique ID number to each electronic label module, the ID number is represented as IDS1, and is placed on the surface position of the electronic label module; and the product information represented by the ID number IDS1 of the electronic label module is written in the service configuration unit. And associated information; defining a seed file for associating the electronic tag module and the authentication service module, the seed file comprising: initial trigger number data DCF1, random number RandomD, electronic tag module ID number IDS1; storing data TDSH in the application hive The self-destruct device representing the electronic tag module has been destroyed; a PSW field is set in the record corresponding to the IDS1 in the service configuration unit, and is used to represent the dynamic password generation algorithm type adopted by the electronic tag module whose ID is IDS1;
  • Step 2 The user opens the electronic tag module through the switch unit, and the management unit detects whether the self-destruction trigger unit has been damaged. If the self-destruction trigger unit has been damaged, the electronic tag module outputs a specific data TDSH through the display unit to indicate the electronic tag.
  • the module has stopped working; if the self-destruction trigger unit works normally, the management unit of the electronic tag module reads the seed file in the storage unit, and in the first password change period, the initial number of triggers of the switch unit is DCF1; The number of triggers DCF1 of the switch unit in the seed file, the random number RandomD, and the ID number IDS1 of the electronic tag module are used as calculation factors, and the dynamic password data DKS1 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit, and the DKS1 is displayed on the display. In the unit; then the management unit accumulates the number of triggers DCF1 of the initial switching unit according to the pre-defined trigger number accumulation period to obtain DCF2, saves DCF2 to the seed file of the storage unit, and overwrites DCF1;
  • Step 3 The application management unit of the user verification terminal module controls the image acquisition unit to collect the image data IDT1 of the electronic tag module, and the image data IDT1 of the electronic tag module includes the dynamic password data DKS1 displayed by the display unit and the electronic tag placed on the surface of the electronic tag module.
  • the ID number of the module IDS1 the application management unit of the user verification terminal module locates, segments and analyzes the image data IDT1 through the image analysis unit, and obtains the dynamic password data DZXS1 and the ID number of the electronic tag module displayed by the display unit in the electronic tag module.
  • Step 4 The management unit of the electronic tag module reads the seed file in the storage unit again.
  • the management unit uses the number of triggers of the switch unit in the seed file DCF2, the random number RandomD, and the ID of the electronic tag module.
  • the IDS1 is used as a calculation factor
  • the dynamic password data DKS2 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit, and the DKS2 is displayed in the display unit; then the management unit triggers the initial number of triggers of the switching unit DCF2 according to a predefined trigger.
  • the DCF3 is obtained by accumulating the number of accumulated cycles, and the DCF3 is saved in the seed file of the storage unit, and the DCF2 is overwritten;
  • Step 5 The application management unit of the user verification terminal module controls the image acquisition unit to acquire the image data IDT2 of the electronic tag module, and the image data IDT2 of the electronic tag module includes the dynamic password data DKS2 displayed by the display unit and the electrons placed on the surface of the electronic tag module.
  • the ID number IDS1 of the label module the application management unit of the user verification terminal module locates, segments and analyzes the image data IDT2 through the image analysis unit, and obtains the dynamic password data DZXS2 and the ID of the electronic label module displayed by the display unit in the electronic label module. IDS1, and then query in the application configuration unit.
  • DZXS2 is equal to TDSH, the self-destruct device representing the electronic tag module is damaged, and the verification process is ended; if DZXS2 is not equal to TDSH, IDS1 and DZXS2 are saved to the application configuration unit. And then send IDS1, DZXS1 and DZXS2 to the authentication service module through the data communication unit to connect to the internet;
  • Step 6 After the authentication service module receives the data IDS1, DZXS1, and DZXS2 sent by the user verification terminal module, the authentication service unit queries the record corresponding to the IDS1 in the service configuration unit by the IDS1 and extracts the switch unit that initially writes the seed file.
  • the password generation algorithm PSW2 calculates the dynamic password data RKS1; and then accumulates the number of triggers DCF1 of the switching unit according to the pre-defined trigger number accumulation period to obtain DCF2.
  • the DCF2 is saved to the service configuration unit to cover the DCF1 in the seed file, and then the RandomD, DCF2, and IDS1 are used as the calculation factors, and the dynamic password data RKS2 is calculated by the dynamic password generation algorithm PSW2 in the second dynamic password configuration unit.
  • step one the electronic tag module needs to be opened by the switch unit, and then the seed file is written into the storage unit through the seed writing unit, and the seed file is written into the service configuration unit of the authentication service module through the Internet to IDS1. Corresponding records.
  • the authentication service unit compares the calculated dynamic password data RKS1 and DZXS1, RKS2 and DZXS2. If RKS1 is equal to DZXS1 and RKS2 is equal to DZXS2, the electronic tag module is legally transmitted to the user authentication terminal module via the Internet. If the results are not equal, the authentication service unit calculates multiple sets of passwords, and then extracts two consecutive groups from DZXS1 and DZXS2 for comparison. After n comparisons, if RKS1 is equal to DZXS1 and RKS2 is equal to DZXS2, then through the Internet. The internet verifies the legal result of the electronic tag module sent by the terminal module to the user; if the two sets of passwords are still not equal, the result of sending the electronic tag module to the user through the Internet to the terminal module is invalid;
  • the user verification terminal module After receiving the feedback from the authentication service module, the user verification terminal module displays the result and completes the legality verification process of the electronic tag module.
  • Another object of the present invention is to provide an event-type dynamic password anti-counterfeiting label legality real-time verification system, and the event-type dynamic password anti-counterfeiting label legality real-time verification system includes: an electronic label module, a user verification terminal module, and an authentication service module. ;
  • An electronic label module configured to generate dynamic password data and display;
  • the electronic label module comprises: a management unit, a switch unit, a seed writing unit, a self-destruct trigger unit, a first dynamic password configuration unit, a storage unit, and a display unit;
  • the user verification terminal module is connected to the electronic tag module, and is configured to collect the dynamic password data generated by the electronic tag module and the image data of the ID number of the electronic tag module, perform analysis and processing, obtain text type data, and then pass the text type data through the internet internet.
  • the user verification terminal module includes: an application management unit, an image acquisition unit, an image analysis unit, an application configuration unit, Data input unit, data communication unit;
  • the authentication service module is connected with the user verification terminal module, and after receiving the text type data, is used for calculation and verification, and obtains a first dynamic password data generation algorithm of the electronic tag module and a second dynamic password data generation algorithm of the authentication service module. Whether the result is consistent, and the result is returned to the user verification terminal module, thereby judging the legality of the electronic tag module;
  • the authentication service module includes: an authentication service unit, a clock control unit, a service configuration unit, and a second dynamic password configuration unit.
  • the electronic tag module includes: a management unit, a switch unit, a seed writing unit, a self-destruct triggering unit, a first dynamic password configuration unit, a storage unit, and a display unit;
  • the management unit is configured to detect whether the self-destruction trigger unit has been damaged.
  • the initial clock data is DSS1 in the first clock change period;
  • the clock data DSS1 in the seed data is random.
  • the number of the IDD1 of the RandomD and the electronic tag module is used as a calculation factor, and the dynamic password data DKS1 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit, and the DKS1 is displayed in the display unit; then the initial clock data DSS1 is The defined clock accumulation period is accumulated to obtain DSS2, and the DSS2 is saved in the cache;
  • a switch unit connected to the management unit, for opening the electronic tag module
  • a seed writing unit connected to the management unit, for writing a seed file
  • a self-destruction trigger unit connected to the management unit for transmitting a damage signal
  • the first dynamic password configuration unit is connected to the management unit, and is used by the dynamic password generation algorithm PSW1 to generate dynamic password data DKS1;
  • a storage unit connected to the management unit, for saving the seed file
  • a display unit connected to the management unit, for displaying the dynamic password data DKS1.
  • the dynamic password generation algorithm in the first dynamic password configuration unit uses a national secret algorithm
  • the management unit transmits the ID number of the electronic tag module itself and the clock data or the number of dynamic password generations as a calculation factor to the first dynamic password configuration unit to obtain dynamic password data; each electronic tag module generates different and has one validity.
  • Dynamic password data, dynamic password data is a digital form, any character, combination of characters and numbers, bar code, two-dimensional code, any form of password expression;
  • the dynamic password display method of the electronic label module displays dynamic password data through the display unit of the electronic label module, and the user verification terminal module controls the image acquisition unit to perform data collection, and the electronic label module adopts NFC, RFID, infrared communication mode to authenticate the terminal to the user.
  • the module passes the data;
  • the dynamic password data verification method of the electronic tag module, the structure of the user verification terminal module and the authentication service module, and the image analysis unit in the user verification terminal module are based on reducing the calculation amount of the user terminal verification module and saving hardware resources.
  • the user verification terminal module is only responsible for collecting the dynamic password data displayed by the electronic tag module, and transmitting the image data to the authentication service module, performing image analysis by the authentication service module, converting the data format and performing data verification;
  • the dynamic password data verification method of the electronic label module, the structure of the user verification terminal module and the authentication service module, and the authentication service unit, the service configuration unit, and the second dynamic password configuration unit in the authentication service module are placed on the user when the network is not smooth.
  • the verification terminal module after the user verification terminal module collects the dynamic password data of the electronic tag module, the authentication service is directly completed in an offline state;
  • the user verification terminal module includes: an application management unit, an image acquisition unit, an image analysis unit, an application configuration unit, a data input unit, and a data communication unit;
  • the application management unit is configured to control the image data acquisition unit to collect the image data IDT1 of the electronic label module, and perform image positioning, segmentation and analysis on the image data IDT1 by the image analysis unit, and obtain the dynamic password data DZXS and the electronic component displayed by the display unit in the electronic label module.
  • An image acquisition unit connected to the application management unit, for collecting image data IDT1 of the electronic tag module
  • An image analysis unit connected to the application management unit, for positioning, segmenting, and analyzing the image data IDT1;
  • the application configuration unit is connected to the application management unit, and is configured to query whether the dynamic password data DZXS is consistent with the ID number IDS1 of the electronic label module;
  • a data input unit connected to the application management unit, for inputting dynamic password data of the query DZXS;
  • the data communication unit is connected to the application management unit for transmitting the IDS1 and the DZXS to the authentication service module by connecting to the Internet.
  • the authentication service module further includes: an authentication service unit, a clock control unit, a service configuration unit, and a second dynamic password configuration unit;
  • the authentication service unit is configured to extract the clock data DSS1, the random number RandomD, and the dynamic password generation algorithm PSW2 used by the electronic tag module represented by the IDS1 to obtain the system time RSS1 of the current authentication service module, and obtain the second
  • the dynamic password generation algorithm PSW2 in the dynamic password configuration unit calculates the dynamic password data RKS1; the calculated dynamic password data RKS1 and DZXS are compared;
  • a clock control unit connected to the authentication service unit, for providing a clock signal to the authentication service unit;
  • a service configuration unit connected to the authentication service unit, for querying a record corresponding to IDS1;
  • the second dynamic password configuration unit is connected to the authentication service unit for the dynamic password generation algorithm PSW2 to calculate the dynamic password data RKS1.
  • the service configuration unit has a database that can be read and written by the authentication service unit; the service configuration unit configures the attribute of the electronic label module with the electronic label module ID, and saves the item information represented by the electronic label module and the attribute of the electronic label module.
  • a plurality of dynamic password generation algorithms corresponding to the electronic tag module are placed in the second dynamic password configuration unit in the authentication service module.
  • the method and system for authenticating the event type dynamic password anti-counterfeiting label legality comprises three parts: an electronic label module, a user verification terminal module and an authentication service module; the electronic tag module generates dynamic password data by using the number of self-switching triggers as a variable factor.
  • the user verification terminal module collects the dynamic password data generated by the electronic tag module and the image data of the ID number of the electronic tag module, performs analysis and processing, obtains text type data, and then sends the text type data to the authentication service module through the internet; After receiving the text type data, the authentication service module calculates and verifies whether the first dynamic password data generation algorithm of the electronic tag module is consistent with the second dynamic password data generation algorithm of the authentication service module, and returns the result to The user verifies the terminal module to determine the electronic standard The legality of the signing module.
  • the change data hidden in the electronic tag module that is, the clock data or the password generation number data is used as a calculation factor, so that the passwords of each electronic tag module are different, and the password data generated by each electronic tag module is only generated at a time. Has one effectiveness, greatly increasing the security of the system;
  • the matching of the password generation algorithm according to the ID of the electronic tag module improves the personalized management of the system and greatly increases the security of the system.
  • FIG. 1 is a schematic structural diagram of a real-time verification system for event-type dynamic password anti-counterfeit tags according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for verifying the legality of an event type dynamic password anti-counterfeit tag according to an embodiment of the present invention
  • FIG. 3 is a schematic structural diagram of a real-time verification system for event-type dynamic password anti-counterfeit tags according to Embodiment 2 of the present invention
  • FIG. 4 is a schematic structural diagram of an event type dynamic password anti-counterfeiting label legality real-time verification system according to Embodiment 3 of the present invention.
  • the event-type dynamic password anti-counterfeiting label legality real-time verification system of the embodiment of the present invention mainly comprises: an electronic label module 1, a user verification terminal module 2, and an authentication service module 3;
  • An electronic tag module 1 for generating dynamic password data and displaying the same;
  • the user verification terminal module 2 is connected to the electronic tag module 1 for collecting the dynamic password data generated by the electronic tag module 1 and the image data of the ID number of the electronic tag module, and performing analysis processing to obtain text type data, and then text data. Sended to the authentication service module 3 via the internet;
  • the authentication service module 3 is connected to the user authentication terminal module 2, and after receiving the text type data, is used for calculation and verification, and obtains the first dynamic password data generation algorithm of the electronic tag module 1 and the second dynamic of the authentication service module 3. The result of the password data generation algorithm being consistent, and returning the result to the user verification terminal module 2, thereby judging the legitimacy of the electronic tag module 1.
  • the electronic tag module 1 further includes: a management unit 1-1, a switch unit 1-2, a seed writing unit 1-3, a self-destruct trigger unit 1-4, a first dynamic password configuration unit 1-5, and a storage unit 1-6.
  • the management unit 1-1 is configured to detect whether the self-destruction trigger unit 1-4 has been damaged.
  • the initial clock data is DSS1 during the first clock change period;
  • the clock data DSS1, the random number RandomD, and the ID number IDS1 of the electronic tag module 1 in the seed data are used as calculation factors, and the dynamic password data DKS1 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit 1-5, and the DKS1 is displayed.
  • the display unit 1-7 then the initial clock data DSS1 is accumulated according to a predefined clock accumulation period to obtain DSS2, and the DSS2 is saved in the buffer;
  • the switch unit 1-2 is connected to the management unit 1-1 for opening the electronic tag module 1;
  • a seed writing unit 1-3 connected to the management unit 1-1, for writing a seed file
  • the self-destruction triggering unit 1-4 is connected to the management unit 1-1 for transmitting a damage signal;
  • the first dynamic password configuration unit 1-5 is connected to the management unit 1-1, and is used by the dynamic password generation algorithm PSW1 to generate dynamic password data DKS1;
  • the storage unit 1-6 is connected to the management unit 1-1 for saving the seed file.
  • the display unit 1-7 is connected to the management unit 1-1 for displaying the dynamic password data DKS1.
  • the user authentication terminal module 2 includes: an application management unit 2-1, an image acquisition unit 2-2, an image analysis unit 2-3, an application configuration unit 2-4, a data input unit 2-5, and a data communication unit 2-6;
  • the application management unit 2-1 is configured to control the image collection unit 2-2 to collect the image data IDT1 of the electronic tag module, and locate, segment and analyze the image data IDT1 by the image analysis unit 2-3, and obtain the electronic tag module 1
  • the dynamic password data DZXS displayed by the display unit 1-7 and the ID number IDS1 of the electronic tag module 1 are then queried in the application configuration unit 2-4;
  • the image acquisition unit 2-2 is connected to the application management unit 2-1 for collecting image data IDT1 of the electronic tag module;
  • the image analyzing unit 2-3 is connected to the application management unit 2-1 for positioning, segmenting and analyzing the image data IDT1;
  • the application configuration unit 2-4 is connected to the application management unit 2-1, and is configured to query whether the dynamic password data DZXS is consistent with the ID number IDS1 of the electronic tag module.
  • the data input unit 2-5 is connected to the application management unit 2-1 for inputting the dynamic password data DZXS of the query;
  • the data communication unit 2-6 is connected to the application management unit 2-1 for transmitting the IDS1 and the DZXS to the authentication service module 3 by connecting to the Internet;
  • the authentication service module 3 further includes: an authentication service unit 3-1, a clock control unit 3-2, a service configuration unit 3-3, and a second dynamic password configuration unit 3-4;
  • the authentication service unit 3-1 is configured to extract the clock data DSS1 and the random number of the initial write seed file.
  • the dynamic password generation algorithm PSW2 used by the electronic tag module represented by RandomD and IDS1 obtains the system time RSS1 of the current authentication service module, and calculates the dynamic state through the dynamic password generation algorithm PSW2 in the second dynamic password configuration unit 3-4.
  • Password data RKS1; the calculated dynamic password data RKS1 and DZXS are compared;
  • the clock control unit 3-2 is connected to the authentication service unit 3-1 for providing a clock signal to the authentication service unit 3-1.
  • the service configuration unit 3-3 is connected to the authentication service unit 3-1 for querying the record corresponding to the IDS1;
  • the second dynamic password configuration unit 3-4 is connected to the authentication service unit 3-1 for the dynamic password generation algorithm PSW2 to calculate the dynamic password data RKS1.
  • the real-time verification method for the event type dynamic password anti-counterfeiting label legality includes the following steps:
  • S201 assigning each electronic label module a unique ID number, the ID number is represented as IDS1, and is placed on the surface position of the electronic label module; and the product information represented by the ID number IDS1 of the electronic label module is written in the service configuration unit and Correlation information; defining a seed file for associating the electronic tag module and the authentication service module, the seed file includes: initial trigger number data DCF1, random number RandomD, electronic tag module ID number IDS1; storing data TDSH representative in the application configuration unit The self-destruct device of the electronic tag module has been destroyed; the PSW field is set in the record corresponding to the IDS1 in the service configuration unit, and is used to represent the dynamic password generation algorithm type adopted by the electronic tag module whose ID is IDS1;
  • S202 opening the electronic tag module through the switch unit, and then writing the seed file to the storage unit through the seed writing unit, and simultaneously writing the seed file to the record corresponding to the IDS1 in the service configuration unit of the authentication service module through the Internet;
  • S203 The user opens the electronic tag module through the switch unit, and the management unit detects whether the self-destruction trigger unit has been damaged. If the self-destruction trigger unit has been damaged, the electronic tag module outputs a specific data TDSH through the display unit to indicate the electronic tag module.
  • the management unit of the electronic tag module reads the seed file in the storage unit, at the first port
  • the number of triggers of the initial switch unit is DCF1
  • the management unit uses the number of triggers DCF1 of the switch unit in the seed file, the random number RandomD, and the ID number IDS1 of the electronic tag module as the calculation factor, and the first dynamic password configuration unit
  • the dynamic password generation algorithm PSW1 generates the dynamic password data DKS1 and displays the DKS1 in the display unit.
  • the management unit accumulates the initial number of triggers DCF1 according to the preset trigger number accumulation period to obtain DCF2, and saves the DCF2 to the storage unit.
  • overwrite DCF1 In the torrent file, overwrite DCF1;
  • the application management unit of the user verification terminal module controls the image acquisition unit to collect the image data IDT1 of the electronic tag module, and the image data IDT1 of the electronic tag module includes the dynamic password data DKS1 displayed by the display unit and the electronic tag module placed on the surface of the electronic tag module.
  • the ID number IDS1; the application management unit of the user verification terminal module locates, segments and analyzes the image data IDT1 through the image analysis unit, and obtains the dynamic password data DZXS1 displayed by the display unit in the electronic tag module and the ID number IDS1 of the electronic tag module. And then querying in the application configuration unit.
  • DZXS1 is equal to TDSH, the self-destruct device representing the electronic tag module is damaged, and the verification process is ended; if DZXS1 is not equal to TDSH, IDS1 and DZXS1 are saved to the application configuration unit;
  • the management unit of the electronic label module reads the seed file in the storage unit again.
  • the management unit uses the trigger number DCF2 of the switch unit in the seed file, the random number RandomD, and the ID number of the electronic label module.
  • IDS1 is used as a calculation factor
  • the dynamic password data DKS2 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit, and the DKS2 is displayed in the display unit; then the management unit sets the number of triggers DCF2 of the initial switch unit according to a preset number of triggers.
  • the DCF3 is obtained, and the DCF3 is saved in the seed file of the storage unit, and the DCF2 is overwritten;
  • the application management unit of the user verification terminal module controls the image collection unit to acquire the image data IDT2 of the electronic label module.
  • the image data IDT2 of the electronic label module includes the dynamic password data DKS2 displayed by the display unit and the electronic label placed on the surface of the electronic label module.
  • the ID number of the module IDS1; the application management unit of the user verification terminal module locates, segments and analyzes the image data IDT2 through the image analysis unit, and obtains the dynamic password data displayed by the display unit in the electronic tag module.
  • the ID number IDS1 of the DZXS2 and the electronic tag module is then queried in the application configuration unit.
  • DZXS2 is equal to TDSH, the self-destruct device representing the electronic tag module is damaged, and the verification process is ended; if DZXS2 is not equal to TDSH, IDS1 and DZXS2 is saved to the application configuration unit; then IDS1, DZXS1 and DZXS2 are connected to the authentication service module through the data communication unit to connect to the Internet;
  • the authentication service unit After the authentication service module receives the data IDS1, DZXS1, and DZXS2 sent by the user verification terminal module, the authentication service unit queries the record corresponding to the IDS1 in the service configuration unit by the IDS1 and extracts the switch unit of the initial write seed file.
  • the dynamic password generation algorithm PSW2 adopted by the electronic tag module represented by the number of triggers DCF1, random number RandomD, and IDS1; then, the authentication service unit uses RandomD, DCF1, and IDS1 as calculation factors, and the dynamic password in the second dynamic password configuration unit
  • the algorithm PSW2 is generated, and the dynamic password data RKS1 is calculated; then the number of triggers DCF1 of the switch unit is accumulated according to the preset trigger number accumulation period to obtain DCF2, and the DCF2 is saved to the service configuration unit to cover the DCF1 in the seed file, and then Using RandomD, DCF2 and IDS1 as calculation factors, the dynamic password data RKS2 is calculated by the dynamic password generation algorithm PSW2 in the second dynamic password configuration unit;
  • the authentication service unit compares the calculated dynamic password data RKS1 with DZXS1, RKS2, and DZXS2. If RKS1 is equal to DZXS1 and RKS2 is equal to DZXS2, the legal result of transmitting the electronic tag module to the user verification terminal module through the Internet; If the two are not equal, the authentication service unit calculates the multiple sets of passwords by using the rule of step S207, and then extracts two consecutive groups from DZXS1 and DZXS2 for comparison.
  • the service configuration unit has a database that can be read and written by the authentication service unit; service configuration The unit configures the attribute of the electronic label module by using the electronic label module ID, and saves the item information represented by the electronic label module and the attribute of the electronic label module in a database;
  • the dynamic password generation algorithm in the dynamic password configuration unit may use a national secret algorithm, a self-written or an arbitrary dynamic password generation algorithm; and the dynamic password algorithm may be one type or multiple combinations; the present invention emphasizes electronic The first dynamic password configuration unit of the label module and the second dynamic password configuration unit of the authentication service module adopt the same dynamic password generation algorithm;
  • the continuous two sets of dynamic password data are used for comparison, because the calculation factor includes the number of triggers accumulated according to the pre-defined trigger number accumulation period, and the two calculation factors are In real time, the two sets of passwords are not equal to the previously generated two sets of passwords. Therefore, the present invention uses two consecutive sets of passwords as the verification conditions;
  • the management unit of the electronic tag module transmits the ID number of the electronic tag module itself and the number of clock data or dynamic password generation as a calculation factor to the first dynamic password configuration unit to obtain dynamic password data; since each electronic tag module is given A unique ID number, and the clock data or dynamic password generation times are constantly changing data, each electronic tag module generates different dynamic password data with one validity.
  • the dynamic password data may be in digital form or may be Any character, any combination of characters, a combination of numbers, a bar code, a two-dimensional code, and the like;
  • the dynamic password display method of the electronic tag module displays dynamic password data through the display unit of the electronic tag module, and the user verification terminal module controls the image acquisition unit to perform data collection, and the electronic tag module can also adopt NFC, RFID, infrared, and the like. , passing data to the user verification terminal module;
  • the user verifies that the terminal module collects the dynamic password data of the electronic tag module, and the electronic
  • the display unit of the label module displays dynamic password data
  • the user verification terminal module controls the image acquisition unit to collect image data of the dynamic password data of the electronic label module and converts it into text type data
  • the user verification terminal module can also adopt infrared, RFID, NFC
  • the communication mode collects the dynamic password data of the electronic tag module, or manually inputs the dynamic password data displayed by the display unit in the electronic tag module into the user verification terminal module through the data input unit by using a touch screen or a button;
  • the dynamic password data verification method of the electronic tag module, the structure of the user verification terminal module and the authentication service module, and the image analysis in the user verification terminal module can be performed based on reducing the calculation amount of the user terminal verification module and saving hardware resources.
  • the unit is placed in the authentication service module, and the user verification terminal module is only responsible for collecting the dynamic password data displayed by the electronic label module, and transmitting the image data to the authentication service module, performing image analysis by the authentication service module, converting the data format and performing data verification. ;
  • the dynamic password data verification method of the electronic tag module, the structure of the user verification terminal module and the authentication service module, and the authentication service unit, the service configuration unit, and the second dynamic password configuration unit in the authentication service module may be based on when the network is not smooth.
  • the user verification terminal module collects the dynamic password data of the electronic tag module, and directly completes the authentication service in an offline state;
  • the authentication service module is characterized in that a plurality of dynamic password generation algorithms corresponding to the electronic tag module can be placed in the second dynamic password configuration unit in the authentication service module.
  • Embodiment 1 Based on the structure shown in FIG. 1, the apparatus used in the present invention includes three parts: an electronic tag module 1, a user authentication terminal module 2, and an authentication service module 3.
  • the real-time verification method for the validity of dynamic passwords includes the following steps:
  • Step A Each electronic tag module 1 is given a unique ID number, the ID number is represented as IDS1, placed on the surface position of the electronic tag module 1, and the equal number of triggers is defined in the electronic tag module 1 and the authentication service module 3.
  • the seed file of the authentication service module 3, the seed file includes: initial trigger number data DCF1, random number RandomD, ID number IDS1 of the electronic tag module 1; storing data TDSH in the application configuration unit 2-4 represents self-destruction of the electronic tag module 1
  • the device has been destroyed; a PSW field is set in the record corresponding to the IDS1 in the service configuration unit 3-3, and is used to represent the dynamic password generation algorithm type adopted by the electronic tag module 1 whose ID is IDS1;
  • Step B The electronic tag module 1 is opened by the switch unit 1-2, and then the seed file is written into the storage unit 1-6 through the seed writing unit 1-3, and the seed file is written to the authentication service module through the Internet.
  • Step C The user opens the electronic tag module 1 through the switch unit 1-2.
  • the management unit 1-1 detects whether the self-destruction trigger unit 1-4 has been damaged. If the self-destruction trigger unit 1-4 has been damaged, the electronic tag module 1 outputting a specific data TDSH through the display unit 1-7, indicating that the electronic tag module 1 has stopped working; if the self-destruction triggering unit 1-4 is working normally, the management unit 1-1 of the electronic tag module reads the storage unit 1 In the seed file of 6, in the first password change period, the number of triggers of the initial switch unit 1-2 is DCF1; the management unit 1-1 uses the number of triggers DCF1, random number RandomD of the switch unit 1-2 in the seed file, The ID number IDS1 of the electronic tag module is used as a calculation factor, and the dynamic password data DKS1 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit 1-5, and the DKS1 is displayed in the display unit 1-7; then the management unit 1 1 The initial number of triggers DCF
  • Step D The application management unit 2-1 of the user verification terminal module 2 controls the image acquisition unit 2-2 to collect the image data IDT1 of the electronic tag module 1, and the image data IDT1 of the electronic tag module 1 includes the dynamic password displayed by the display unit 1-7.
  • the dynamic password data DZXS1 displayed by the display unit 1-7 in the electronic label module 1 and the ID number IDS1 of the electronic label module 1 are obtained, and then the query is performed in the application configuration unit 2-4.
  • DZXS1 is equal to the TDSH, the electronic label is represented.
  • the self-destruct device of module 1 is damaged, and the verification process is ended; if DZXS1 is not equal to TDSH, IDS1 and DZXS1 are saved to the application configuration unit 2-4;
  • Step E The management unit 1-1 of the electronic tag module 1 reads the seed file in the storage unit 1-6 again, and in the second password change period, the management unit 1-1 takes the switch unit 1-2 in the seed file.
  • the trigger number DCF2, the random number RandomD, and the ID number IDS1 of the electronic tag module are used as a calculation factor, and the dynamic password data DKS2 is generated by the dynamic password generation algorithm PSW1 of the first dynamic password configuration unit 1-5, and the DKS2 is displayed on the display unit 1 7; then the management unit 1-1 accumulates the number of triggers DCF2 of the initial switching unit 1-2 according to a preset number of triggering times to obtain DCF3, saves the DCF3 to the seed file of the storage unit 1-6, and overwrites the DCF2 in;
  • Step F The application management unit 2-1 of the user verification terminal module 2 controls the image acquisition unit 2-2 to again acquire the image data IDT2 of the electronic tag module 1.
  • the image data IDT2 of the electronic tag module 1 includes the dynamics displayed by the display unit 1-7.
  • the dynamic password data DZXS2 displayed by the display unit 1-7 in the electronic label module 1 and the ID number IDS1 of the electronic label module 1 are obtained, and then the query is performed in the application configuration unit 2-4.
  • DZXS2 is equal to the TDSH, the electronic label is represented.
  • the self-destruct device of module 1 is damaged, and the verification process is ended; if DZXS2 is not equal to TDSH, IDS1 and DZXS2 are saved to the application configuration unit 2-4; then IDS1, DZXS1 and DZXS2 are connected to the Internet through the data communication unit 2-6.
  • the internet is sent to the authentication service module 3;
  • Step G After the authentication service module 3 receives the data IDS1, DZXS1, and DZXS2 sent by the user verification terminal module 2, the authentication service unit 3-1 queries the service configuration unit 3-3 for the record corresponding to the IDS1 and extracts it by the IDS1.
  • the number of triggers DCF1 of the switch unit 1-2 initially written to the seed file, the random number RandomD, and the dynamic password generation algorithm PSW2 employed by the electronic tag module 1 represented by IDS1; then, the authentication service unit 3-1 uses RandomD, DCF1, and IDS1 is used as a calculation factor, and the dynamic password data RKS1 is calculated by the dynamic password generation algorithm PSW2 in the second dynamic password configuration unit 3-4; then the number of triggers DCF1 of the switch unit 1-2 is determined according to a predefined trigger number.
  • the DCF2 is obtained by accumulating the number accumulation period, and the DCF2 is saved to the service configuration unit 3-3 to cover the DCF1 in the seed file, and then the RandomD, DCF2, and IDS1 are used as the calculation factors, and the second dynamic password is configured in the unit 3-4.
  • the dynamic password generation algorithm PSW2 calculates the dynamic password data RKS2;
  • Step H The authentication service unit 3-1 compares the calculated dynamic password data RKS1 with DZXS1, RKS2 and DZXS2. If RKS1 is equal to DZXS1 and RKS2 is equal to DZXS2, the electronic tag module is sent to the user authentication terminal module 2 via the Internet.
  • the authentication service unit 3-1 calculates multiple sets of passwords by using the rule of step G, and then takes out two consecutive groups and compares them with DZXS1 and DZXS2, after n comparisons, if RKS1 If it is equal to DZXS1 and RKS2 is equal to DZXS2, the user terminal verifies that the terminal module 2 sends the electronic tag module 1 legally through the internet; if the two consecutive sets of passwords are still not equal, the electronic module sends the electronic device to the user terminal 2 via the Internet. Label module 1 is not legal result;
  • Step I After the user verifies that the terminal module 2 receives the feedback result from the authentication service module 3, the result is displayed, and the legality verification process for the electronic label module 1 is completed.
  • Embodiment 2 Based on the structure of FIG. 1, when the network is unstable or has no network environment, the authentication service unit 3-1, the service configuration unit 3-3, and the second dynamic password configuration unit 3-4 in the authentication service module may be used.
  • the storage unit 1-6 is placed in the user authentication terminal module 2. After the user verifies that the terminal module 2 collects the data of the electronic tag module 1, the user verifies that the terminal module 2 directly completes the authentication service in an offline state.
  • the apparatus used in the modified invention includes two parts, an electronic tag module 1 and a user authentication terminal module 2.
  • the electronic tag module 1 generates and displays dynamic password data with the number of self-switching triggers as a variable factor;
  • the user verification terminal module 3 collects image data of the dynamic password data of the electronic tag module 1 and performs analysis processing to obtain text-type password data, and then After verification, it is determined whether the first dynamic password generation algorithm of the electronic tag module 1 and the second dynamic password generation algorithm of the user verification terminal module 2 are consistent, thereby determining the legitimacy of the electronic tag module 1.
  • Embodiment 3 Based on the structure of FIG. 1, when the network is stable and the local computing amount of the user verification terminal module 2 needs to be reduced, the image analysis unit 2-3 in the user verification terminal module 2 can be placed in the authentication.
  • the user authentication terminal module 2 is only responsible for collecting the data displayed by the electronic tag module 1, and transmitting the image format data to the authentication service module 3 via the Internet, and the authentication service module 3 performs image analysis and provides an authentication service.
  • the apparatus used in the modified invention includes three parts: an electronic tag module 1, a user authentication terminal module 2, and an authentication service module 3.
  • the electronic tag module 1 generates and displays dynamic password data with the number of self-switching triggers as a variable factor; the user authentication terminal module 2 collects the password data generated by the electronic tag module 1 and the image data of the electronic tag module 1 ID number, and passes the image data through the Internet.
  • the internet is sent to the authentication service module 3, and after receiving the image data sent by the user verification terminal module 2, the authentication service module 3 obtains the text type password data after the analysis processing, and then performs verification; after the authentication service module 3 is verified, it is obtained.
  • the first dynamic password generation algorithm of the electronic tag module 1 is consistent with the second dynamic password generation algorithm of the authentication service module 3, and returns the result to the user verification terminal module 2 via the Internet, thereby determining the electronic tag module 1 legality.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本发明公开了一种事件型动态口令防伪标签合法性实时验证方法及系统，包括电子标签模块、用户验证终端模块和认证服务模块；电子标签模块以自身开关触发次数作为可变因子生成动态口令数据并显示；用户验证终端模块采集电子标签模块生成的动态口令数据和电子标签模块ID号的图像数据，得到文本型数据；认证服务模块接收到文本型数据后，经过计算和验证，得出电子标签模块的第一动态口令数据生成算法与认证服务模块的第二动态口令数据生成算法是否一致结果，返回用户验证终端模块，判断出电子标签模块的合法性。本发明克服了现有标签的不变性和可复制性；使得动态口令的安全性大大提升；使得每个电子标签模块口令均不同，大大增加了系统安全性。

Description

一种事件型动态口令防伪标签合法性实时验证方法及系统 技术领域
本发明属于电子防伪技术领域，尤其涉及一种事件型动态口令防伪标签合法性实时验证方法及系统。
背景技术
随着社会的高速发展，人们的消费能力不断提高，很多不法分子开始利用假冒的手段牟取巨大的利益，这样不仅对人们造成了经济甚至身体上的伤害，也对社会发展造成严重不良影响，在这种环境下，防伪行业变的尤为重要，但通常的防伪标签一般为激光、刮刮卡、、条形码或二维码等多种形式，每种标签均有其便捷性，但这些标签均为不可变标签，可被复制使用。
电子标签模块领域主要采用的是RFID、NFC等方式，此类型标签均需采用特殊的验证终端才可以进行读取，还需要依附专业的系统才可进行合法性验证。不利于普及到每个用户使用，更不能让用户随时随地便捷的进行实时验证。
动态口令牌输出的是一种定时变化口令，每次产生的口令均有一次有效性，具有防伪的特性，但传统的时钟型的动态口令牌，主要应用于网上银行的身份认证系统，使用者需要登陆网站，手动将动态口令数据输入服务器进行验证。若应用于防伪行业用户不能便捷的使用也造成了动态口令牌在防伪行业较难推广。
发明内容
本发明实施例的目的在于提供一种事件型动态口令防伪标签合法性实时验证方法及系统，旨在解决电子标签模块领域需采用特殊的验证终端才可以进行读取，还需要依附专业的系统才可进行合法性验证，不利于普及到每个用户使 用，不能让用户随时随地便捷进行实时验证的问题。
本发明实施例是这样实现的，一种事件型动态口令防伪标签合法性实时验证方法，该事件型动态口令防伪标签合法性实时验证方法包括以下步骤：
步骤一，给每一个电子标签模块赋予一个唯一的ID号，ID号表示为IDS1，放置于电子标签模块的表面位置；在服务配置单元中写入电子标签模块的ID号IDS1所代表的产品信息和关联信息；定义一个用于关联电子标签模块和认证服务模块的种子文件，种子文件包含：初始触发次数数据DCF1、随机数RandomD、电子标签模块的ID号IDS1；在应用配置单元中存储数据TDSH代表电子标签模块的自毁装置已被破坏；在服务配置单元中IDS1对应的记录中设置PSW字段，用来代表ID为IDS1的电子标签模块所采用的动态口令生成算法类型；
步骤二，用户通过开关单元打开电子标签模块，管理单元检测自毁触发单元是否已被损坏，若自毁触发单元已被损坏，则电子标签模块通过显示单元输出一个特定的数据TDSH，表示电子标签模块已经停止工作；若自毁触发单元正常工作，则电子标签模块的管理单元读取存储单元中的种子文件，在第一个口令变化周期时，初始开关单元的触发次数为DCF1；管理单元以种子文件中开关单元的触发次数DCF1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2，将DCF2保存到存储单元的种子文件中，覆盖掉DCF1；
步骤三，用户验证终端模块的应用管理单元控制图像采集单元采集电子标签模块的图像数据IDT1，电子标签模块的图像数据IDT1包含显示单元显示的动态口令数据DKS1和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT1进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS1和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS1 等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS1不等于TDSH，则将IDS1和DZXS1保存到应用配置单元中；
步骤四，电子标签模块的管理单元再次读取存储单元中的种子文件，在第二个口令变化周期时，管理单元以种子文件中开关单元的触发次数DCF2、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS2，并将DKS2显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF2按照事先定义的触发次数累加周期累加后得到DCF3，将DCF3保存到存储单元的种子文件中，覆盖掉DCF2中；
步骤五，用户验证终端模块的应用管理单元再次控制图像采集单元采集电子标签模块的图像数据IDT2，电子标签模块的图像数据IDT2包含显示单元显示的动态口令数据DKS2和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT2进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS2和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS2等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS2不等于TDSH，则将IDS1和DZXS2保存到应用配置单元中；然后将IDS1、DZXS1和DZXS2通过数据通信单元连接互联网internet发送到认证服务模块；
步骤六，认证服务模块接收到用户验证终端模块发来的数据IDS1、DZXS1和DZXS2后，由认证服务单元以IDS1在服务配置单元中查询IDS1所对应的记录并提取初始写入种子文件的开关单元的触发次数DCF1、随机数RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2；然后，认证服务单元以RandomD、DCF1和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；然后将开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2， 并将DCF2保存到服务配置单元覆盖掉种子文件中的DCF1，再以RandomD、DCF2和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS2。
进一步，在步骤一之后需要通过开关单元打开电子标签模块，然后通过种子写入单元向存储单元中写入种子文件，同时将种子文件通过互联网internet写入到认证服务模块的服务配置单元中IDS1所对应的记录中。
进一步，在步骤六之后认证服务单元将计算得出动态口令数据RKS1和DZXS1、RKS2和DZXS2进行对比，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若不能同时相等，则认证服务单元计算出多组口令，再从中取出连续的两组和DZXS1、DZXS2进行对比，经过n次对比后，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若仍无法达到连续两组口令相等，则通过互联网internet向用户验证终端模块发送此电子标签模块不合法的结果；
用户验证终端模块收到认证服务模块反馈的结果后，将结果显示出来，完成本次对电子标签模块的合法性验证过程。
本发明实施例的另一目的在于提供一种事件型动态口令防伪标签合法性实时验证系统，该事件型动态口令防伪标签合法性实时验证系统包括：电子标签模块、用户验证终端模块和认证服务模块；
电子标签模块，用于生成动态口令数据并显示；电子标签模块包括：管理单元、开关单元、种子写入单元、自毁触发单元、第一动态口令配置单元、存储单元、显示单元；
用户验证终端模块，与电子标签模块连接，用于采集电子标签模块生成的动态口令数据和电子标签模块ID号的图像数据，进行分析处理后，得到文本型数据，然后将文本型数据通过互联网internet发送到认证服务模块；用户验证终端模块包括：应用管理单元、图像采集单元、图像分析单元、应用配置单元、 数据输入单元、数据通信单元；
认证服务模块，与用户验证终端模块连接，接收到文本型数据后，用于经过计算和验证，得出电子标签模块的第一动态口令数据生成算法与认证服务模块的第二动态口令数据生成算法是否一致的结果，并将结果返回到用户验证终端模块，从而判断出电子标签模块的合法性；认证服务模块包括：认证服务单元、时钟控制单元、服务配置单元、第二动态口令配置单元。
进一步，电子标签模块包括：管理单元、开关单元、种子写入单元、自毁触发单元、第一动态口令配置单元、存储单元、显示单元；
管理单元，用于检测自毁触发单元是否已被损坏，根据自毁触发单元的时钟变化周期，在第一个时钟变化周期时，初始时钟数据为DSS1；以种子数据中的时钟数据DSS1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元中；然后将初始时钟数据DSS1按照事先定义的时钟累加周期累加后得到DSS2，将DSS2保存缓存中；
开关单元，与管理单元连接，用于打开电子标签模块；
种子写入单元，与管理单元连接，用于写入种子文件；
自毁触发单元，与管理单元连接，用于发送损坏信号；
第一动态口令配置单元，与管理单元连接，用于动态口令生成算法PSW1生成动态口令数据DKS1；
存储单元，与管理单元连接，用于保存种子文件；
显示单元，与管理单元连接，用于显示动态口令数据DKS1。
进一步，第一动态口令配置单元中的动态口令生成算法采用国密算法；
管理单元将电子标签模块自身的ID号和时钟数据或动态口令生成次数作为计算因子，传递到第一动态口令配置单元得到动态口令数据；每个电子标签模块均生成不同的且具有一次有效性的动态口令数据，动态口令数据是数字形式、任意字符、字符数字组合、条码、二维码任意一种口令表达形式；
电子标签模块的动态口令显示方法，通过电子标签模块的显示单元显示动态口令数据，由用户验证终端模块控制图像采集单元进行数据采集，电子标签模块采用NFC、RFID、红外通信方式，向用户验证终端模块传递数据；
进一步，电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于降低用户终端验证模块的运算量和节省硬件资源的情况下，将用户验证终端模块中的图像分析单元放置于认证服务模块中，用户验证终端模块仅负责将电子标签模块显示的动态口令数据采集，并将图像数据发送到认证服务模块，由认证服务模块进行图像分析，转换数据格式并进行数据验证；
电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于网络不通畅时，将认证服务模块中的认证服务单元、服务配置单元和第二动态口令配置单元放置到用户验证终端模块中，用户验证终端模块将电子标签模块的动态口令数据采集后，在离线状态下，直接完成认证服务；
进一步，用户验证终端模块包括：应用管理单元、图像采集单元、图像分析单元、应用配置单元、数据输入单元、数据通信单元；
应用管理单元，用于控制图像采集单元采集电子标签模块的图像数据IDT1，通过图像分析单元对图像数据IDT1进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询；
图像采集单元，与应用管理单元连接，用于采集电子标签模块的图像数据IDT1；
图像分析单元，与应用管理单元连接，用于对图像数据IDT1进行定位、分割和分析；
应用配置单元，与应用管理单元连接，用于查询动态口令数据DZXS与电子标签模块的ID号IDS1是否一致；
数据输入单元，与应用管理单元连接，用于输入查询的动态口令数据 DZXS；
数据通信单元，与应用管理单元连接，用于通过连接互联网internet将IDS1和DZXS发送到认证服务模块。
进一步，认证服务模块还包括：认证服务单元、时钟控制单元、服务配置单元、第二动态口令配置单元；
认证服务单元，用于提取初始写入种子文件的时钟数据DSS1、随机数RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2，获取当前认证服务模块的系统时间RSS1，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；将计算得出动态口令数据RKS1和DZXS进行对比；
时钟控制单元，与认证服务单元连接，用于为认证服务单元提供时钟信号；
服务配置单元，与认证服务单元连接，用于查询IDS1所对应的记录；
第二动态口令配置单元，与认证服务单元连接，用于动态口令生成算法PSW2，计算得出动态口令数据RKS1。
进一步，服务配置单元是具有能被认证服务单元读写的数据库；服务配置单元是以电子标签模块ID配置电子标签模块的属性，并将电子标签模块所代表的物品信息和电子标签模块的属性保存在数据库中；在认证服务模块中第二动态口令配置单元中放置多个与电子标签模块对应的动态口令生成算法。
本发明提供的事件型动态口令防伪标签合法性实时验证方法及系统，包括电子标签模块、用户验证终端模块和认证服务模块三部分；电子标签模块以自身开关触发次数作为可变因子生成动态口令数据并显示；用户验证终端模块采集电子标签模块生成的动态口令数据和电子标签模块ID号的图像数据，进行分析处理后，得到文本型数据，然后将文本型数据通过互联网internet发送到认证服务模块；认证服务模块接收到文本型数据后，经过计算和验证，得出电子标签模块的第一动态口令数据生成算法与认证服务模块的第二动态口令数据生成算法是否一致的结果，并将结果返回到用户验证终端模块，从而判断出电子标 签模块的合法性。
本发明与现有技术相比具有以下的优益效果：
1、克服了现有标签的不变性和可复制性；
2、为用户提供了一种便捷的验证方法；
3、由于采用了多重动态口令算法的组合，使得动态口令的安全性大大提升；
4、采用了隐藏在电子标签模块内的变化数据，即时钟数据或口令生成次数数据作为计算因子，使得每个电子标签模块的口令均不同，同时每个电子标签模块每次生成的口令数据仅具有一次有效性，大大增加了系统的安全性；
5、根据电子标签模块的ID进行口令生成算法的匹配，提高了系统的个性化管理，也大大增加了系统的安全性。
附图说明
图1是本发明实施例提供的事件型动态口令防伪标签合法性实时验证系统结构示意图；
图2是本发明实施例提供的事件型动态口令防伪标签合法性实时验证方法流程图；
图3是本发明实施例提供的实施例2的事件型动态口令防伪标签合法性实时验证系统结构示意图；
图4是本发明实施例提供的实施例3的事件型动态口令防伪标签合法性实时验证系统结构示意图；
图中：1、电子标签模块；1-1、管理单元；1-2、开关单元；1-3、种子写入单元；1-4、自毁触发单元；1-5、第一动态口令配置单元；1-6、存储单元；1-7、显示单元；2、用户验证终端模块；2-1、应用管理单元；2-2、图像采集单元；2-3、图像分析单元；2-4、应用配置单元；2-5、数据输入单元；2-6、数据通信单元；3、认证服务模块；3-1、认证服务单元；3-2、时钟控制单元；3-3、服务 配置单元；3-4、第二动态口令配置单元。
具体实施方式
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。
下面结合附图及具体实施例对本发明的应用原理作进一步描述。
如图1所示，本发明实施例的事件型动态口令防伪标签合法性实时验证系统主要由：电子标签模块1、用户验证终端模块2和认证服务模块3；
电子标签模块1，用于生成动态口令数据并显示；
用户验证终端模块2，与电子标签模块1连接，用于采集电子标签模块1生成的动态口令数据和电子标签模块ID号的图像数据，进行分析处理后，得到文本型数据，然后将文本型数据通过互联网internet发送到认证服务模块3；
认证服务模块3，与用户验证终端模块2连接，接收到文本型数据后，用于经过计算和验证，得出电子标签模块1的第一动态口令数据生成算法与认证服务模块3的第二动态口令数据生成算法是否一致的结果，并将结果返回到用户验证终端模块2，从而判断出电子标签模块1的合法性。
电子标签模块1还包括：管理单元1-1、开关单元1-2、种子写入单元1-3、自毁触发单元1-4、第一动态口令配置单元1-5、存储单元1-6、显示单元1-7；
管理单元1-1，用于检测自毁触发单元1-4是否已被损坏，根据自毁触发单元1-4的时钟变化周期，在第一个时钟变化周期时，初始时钟数据为DSS1；以种子数据中的时钟数据DSS1、随机数RandomD、电子标签模块1的ID号IDS1作为计算因子，通过第一动态口令配置单元1-5的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元1-7中；然后将初始时钟数据DSS1按照事先定义的时钟累加周期累加后得到DSS2，将DSS2保存缓存中；
开关单元1-2，与管理单元1-1连接，用于打开电子标签模块1；
种子写入单元1-3，与管理单元1-1连接，用于写入种子文件；
自毁触发单元1-4，与管理单元1-1连接，用于发送损坏信号；
第一动态口令配置单元1-5，与管理单元1-1连接，用于动态口令生成算法PSW1生成动态口令数据DKS1；
存储单元1-6，与管理单元1-1连接，用于保存种子文件；
显示单元1-7，与管理单元1-1连接，用于显示动态口令数据DKS1。
用户验证终端模块2包括：应用管理单元2-1、图像采集单元2-2、图像分析单元2-3、应用配置单元2-4、数据输入单元2-5、数据通信单元2-6；
应用管理单元2-1，用于控制图像采集单元2-2采集电子标签模块的图像数据IDT1，通过图像分析单元2-3对图像数据IDT1进行定位、分割和分析，得出电子标签模块1中显示单元1-7显示的动态口令数据DZXS和电子标签模块1的ID号IDS1，然后在应用配置单元2-4中进行查询；
图像采集单元2-2，与应用管理单元2-1连接，用于采集电子标签模块的图像数据IDT1；
图像分析单元2-3，与应用管理单元2-1连接，用于对图像数据IDT1进行定位、分割和分析；
应用配置单元2-4，与应用管理单元2-1连接，用于查询动态口令数据DZXS与电子标签模块的ID号IDS1是否一致；
数据输入单元2-5，与应用管理单元2-1连接，用于输入查询的动态口令数据DZXS；
数据通信单元2-6，与应用管理单元2-1连接，用于通过连接互联网internet将IDS1和DZXS发送到认证服务模块3；
认证服务模块3还包括：认证服务单元3-1、时钟控制单元3-2、服务配置单元3-3、第二动态口令配置单元3-4；
认证服务单元3-1，用于提取初始写入种子文件的时钟数据DSS1、随机数 RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2，获取当前认证服务模块的系统时间RSS1，通过第二动态口令配置单元3-4中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；将计算得出动态口令数据RKS1和DZXS进行对比；
时钟控制单元3-2，与认证服务单元3-1连接，用于为认证服务单元3-1提供时钟信号；
服务配置单元3-3，与认证服务单元3-1连接，用于查询IDS1所对应的记录；
第二动态口令配置单元3-4，与认证服务单元3-1连接，用于动态口令生成算法PSW2，计算得出动态口令数据RKS1。
如图2所示，本发明实施例的事件型动态口令防伪标签合法性实时验证方法包括以下步骤：
S201：给每一个电子标签模块赋予一个唯一的ID号，ID号表示为IDS1，放置于电子标签模块的表面位置；在服务配置单元中写入电子标签模块的ID号IDS1所代表的产品信息和关联信息；定义一个用于关联电子标签模块和认证服务模块的种子文件，种子文件包含：初始触发次数数据DCF1、随机数RandomD、电子标签模块的ID号IDS1；在应用配置单元中存储数据TDSH代表电子标签模块的自毁装置已被破坏；在服务配置单元中IDS1对应的记录中设置PSW字段，用来代表ID为IDS1的电子标签模块所采用的动态口令生成算法类型；
S202：通过开关单元打开电子标签模块，然后通过种子写入单元向存储单元中写入种子文件，同时将种子文件通过互联网internet写入到认证服务模块的服务配置单元中IDS1所对应的记录中；
S203：用户通过开关单元打开电子标签模块，管理单元检测自毁触发单元是否已被损坏，若自毁触发单元已被损坏，则电子标签模块通过显示单元输出一个特定的数据TDSH，表示电子标签模块已经停止工作；若自毁触发单元正常工作，则电子标签模块的管理单元读取存储单元中的种子文件，在第一个口 令变化周期时，初始开关单元的触发次数为DCF1；管理单元以种子文件中开关单元的触发次数DCF1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2，将DCF2保存到存储单元的种子文件中，覆盖掉DCF1；
S204：用户验证终端模块的应用管理单元控制图像采集单元采集电子标签模块的图像数据IDT1，电子标签模块的图像数据IDT1包含显示单元显示的动态口令数据DKS1和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT1进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS1和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS1等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS1不等于TDSH，则将IDS1和DZXS1保存到应用配置单元中；
S205：电子标签模块的管理单元再次读取存储单元中的种子文件，在第二个口令变化周期时，管理单元以种子文件中开关单元的触发次数DCF2、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS2，并将DKS2显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF2按照事先定义的触发次数累加周期累加后得到DCF3，将DCF3保存到存储单元的种子文件中，覆盖掉DCF2中；
S206：用户验证终端模块的应用管理单元再次控制图像采集单元采集电子标签模块的图像数据IDT2，电子标签模块的图像数据IDT2包含显示单元显示的动态口令数据DKS2和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT2进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据 DZXS2和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS2等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS2不等于TDSH，则将IDS1和DZXS2保存到应用配置单元中；然后将IDS1、DZXS1和DZXS2通过数据通信单元连接互联网internet发送到认证服务模块；
S207：认证服务模块接收到用户验证终端模块发来的数据IDS1、DZXS1和DZXS2后，由认证服务单元以IDS1在服务配置单元中查询IDS1所对应的记录并提取初始写入种子文件的开关单元的触发次数DCF1、随机数RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2；然后，认证服务单元以RandomD、DCF1和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；然后将开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2，并将DCF2保存到服务配置单元覆盖掉种子文件中的DCF1，再以RandomD、DCF2和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS2；
S208：认证服务单元将计算得出动态口令数据RKS1和DZXS1、RKS2和DZXS2进行对比，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若不能同时相等，则认证服务单元采用步骤S207的规则计算出多组口令，再从中取出连续的两组和DZXS1、DZXS2进行对比，经过n次对比后，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若仍无法达到连续两组口令相等，则通过互联网internet向用户验证终端模块发送此电子标签模块不合法的结果；
S209：用户验证终端模块收到认证服务模块反馈的结果后，将结果显示出来，完成本次对电子标签模块的合法性验证过程。
进一步，服务配置单元是具有能被认证服务单元读写的数据库；服务配置 单元是以电子标签模块ID配置电子标签模块的属性，并将电子标签模块所代表的物品信息和电子标签模块的属性保存在数据库中；
进一步，动态口令配置单元中的动态口令生成算法可以采用国密算法、自行编写或任意动态口令生成算法；而且动态口令算法可以是一种，也可以是多种进行组合；本发明强调的是电子标签模块的第一动态口令配置单元和认证服务模块的第二动态口令配置单元是采用同一种动态口令生成算法；
进一步，动态口令的合法性实时验证方法的S207中，采用连续两组动态口令数据进行对比，是由于计算因子中包含了按照事先定义的触发次数累加周期累加的触发次数，这两个计算因子是实时变化的，不会产生连续两组口令和以前生成的连续两组口令相等的情况，因此本发明以连续两组口令相等作为验证的条件；
进一步，动态口令的合法性实时验证方法的S208中，若不能同时相等时，仍算出多组口令进行对比，是针对电子标签模块被触发，但没有使用用户验证终端模块进行验证，所出现的电子标签模块触发次数与认证服务模块的触发次数不同步的问题；
进一步，电子标签模块的管理单元将电子标签模块自身的ID号和时钟数据或动态口令生成次数作为计算因子，传递到第一动态口令配置单元得到动态口令数据；由于每个电子标签模块均赋予了一个唯一的ID号，且时钟数据或动态口令生成次数为不断变化数据，则每个电子标签模块均生成不同的且具有一次有效性的动态口令数据，动态口令数据可以是数字形式，也可以是任意字符、字符数字组合、条码、二维码等任意一种口令表达形式；
进一步，电子标签模块的动态口令显示方法，通过电子标签模块的显示单元显示动态口令数据，由用户验证终端模块控制图像采集单元进行数据采集，电子标签模块还可采用NFC、RFID、红外等通信方式，向用户验证终端模块传递数据；
进一步，用户验证终端模块采集电子标签模块动态口令数据的方式，电子 标签模块的显示单元显示动态口令数据，用户验证终端模块控制图像采集单元采集电子标签模块动态口令数据的图像数据，并转换成文本型数据的方式；用户验证终端模块还可以采用红外、RFID、NFC等通信方式采集电子标签模块的动态口令数据，或者由人工将电子标签模块中显示单元显示的动态口令数据使用触摸屏、按键等方式通过数据输入单元手动输入进用户验证终端模块；
进一步，电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于降低用户终端验证模块的运算量和节省硬件资源的情况下，可将用户验证终端模块中的图像分析单元放置于认证服务模块中，用户验证终端模块仅负责将电子标签模块显示的动态口令数据采集，并将图像数据发送到认证服务模块，由认证服务模块进行图像分析，转换数据格式并进行数据验证；
进一步，电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于网络不通畅时，可将认证服务模块中的认证服务单元、服务配置单元和第二动态口令配置单元放置到用户验证终端模块中，用户验证终端模块将电子标签模块的动态口令数据采集后，在离线状态下，直接完成认证服务；
进一步，认证服务模块中，其特征在于：在认证服务模块中第二动态口令配置单元中可以放置多个与电子标签模块对应的动态口令生成算法。
本发明的具体实施例：
实施例1：基于附图1所示结构，本发明所使用的装置包括电子标签模块1、用户验证终端模块2和认证服务模块3三部分。动态口令的合法性实时验证方法包括如下步骤：
步骤A：给每一个电子标签模块1赋予一个唯一的ID号，ID号表示为IDS1，放置于电子标签模块1的表面位置；在电子标签模块1和认证服务模块3中定义相等的触发次数累加周期；在服务配置单元3-3中写入电子标签模块1的ID号IDS1所代表的产品信息和关联信息；定义一个用于关联电子标签模块1和 认证服务模块3的种子文件，种子文件包含：初始触发次数数据DCF1、随机数RandomD、电子标签模块1的ID号IDS1；在应用配置单元2-4中存储数据TDSH代表电子标签模块1的自毁装置已被破坏；在服务配置单元3-3中IDS1对应的记录中设置PSW字段，用来代表ID为IDS1的电子标签模块1所采用的动态口令生成算法类型；
步骤B：通过开关单元1-2打开电子标签模块1，然后通过种子写入单元1-3向存储单元1-6中写入种子文件，同时将种子文件通过互联网internet写入到认证服务模块的服务配置单元3-3中IDS1所对应的记录中；
步骤C：用户通过开关单元1-2打开电子标签模块1，管理单元1-1检测自毁触发单元1-4是否已被损坏，若自毁触发单元1-4已被损坏，则电子标签模块1通过显示单元1-7输出一个特定的数据TDSH，表示电子标签模块1已经停止工作；若自毁触发单元1-4正常工作，则电子标签模块的管理单元1-1读取存储单元1-6中的种子文件，在第一个口令变化周期时，初始开关单元1-2的触发次数为DCF1；管理单元1-1以种子文件中开关单元1-2的触发次数DCF1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元1-5的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元1-7中；然后管理单元1-1将初始开关单元1-2的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2，将DCF2保存到存储单元1-6的种子文件中，覆盖掉DCF1；
步骤D：用户验证终端模块2的应用管理单元2-1控制图像采集单元2-2采集电子标签模块1的图像数据IDT1，电子标签模块1的图像数据IDT1包含显示单元1-7显示的动态口令数据DKS1和放置在电子标签模块1表面的电子标签模块1的ID号IDS1；用户验证终端模块2的应用管理单元2-1通过图像分析单元2-3对图像数据IDT1进行定位、分割和分析，得出电子标签模块1中显示单元1-7显示的动态口令数据DZXS1和电子标签模块1的ID号IDS1，然后在应用配置单元2-4中进行查询，若DZXS1等于TDSH，则代表电子标签 模块1的自毁装置已损坏，结束验证过程；若DZXS1不等于TDSH，则将IDS1和DZXS1保存到应用配置单元2-4中；
步骤E：电子标签模块1的管理单元1-1再次读取存储单元1-6中的种子文件，在第二个口令变化周期时，管理单元1-1以种子文件中开关单元1-2的触发次数DCF2、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元1-5的动态口令生成算法PSW1生成动态口令数据DKS2，并将DKS2显示在显示单元1-7中；然后管理单元1-1将初始开关单元1-2的触发次数DCF2按照事先定义的触发次数累加周期累加后得到DCF3，将DCF3保存到存储单元1-6的种子文件中，覆盖掉DCF2中；
步骤F：用户验证终端模块2的应用管理单元2-1再次控制图像采集单元2-2采集电子标签模块1的图像数据IDT2，电子标签模块1的图像数据IDT2包含显示单元1-7显示的动态口令数据DKS2和放置在电子标签模块1表面的电子标签模块1的ID号IDS1；用户验证终端模块2的应用管理单元2-1通过图像分析单元2-3对图像数据IDT2进行定位、分割和分析，得出电子标签模块1中显示单元1-7显示的动态口令数据DZXS2和电子标签模块1的ID号IDS1，然后在应用配置单元2-4中进行查询，若DZXS2等于TDSH，则代表电子标签模块1的自毁装置已损坏，结束验证过程；若DZXS2不等于TDSH，则将IDS1和DZXS2保存到应用配置单元2-4中；然后将IDS1、DZXS1和DZXS2通过数据通信单元2-6连接互联网internet发送到认证服务模块3；
步骤G：认证服务模块3接收到用户验证终端模块2发来的数据IDS1、DZXS1和DZXS2后，由认证服务单元3-1以IDS1在服务配置单元3-3中查询IDS1所对应的记录并提取初始写入种子文件的开关单元1-2的触发次数DCF1、随机数RandomD和IDS1所代表的电子标签模块1所采用的动态口令生成算法PSW2；然后，认证服务单元3-1以RandomD、DCF1和IDS1作为计算因子，通过第二动态口令配置单元3-4中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；然后将开关单元1-2的触发次数DCF1按照事先定义的触发次 数累加周期累加后得到DCF2，并将DCF2保存到服务配置单元3-3覆盖掉种子文件中的DCF1，再以RandomD、DCF2和IDS1作为计算因子，通过第二动态口令配置单元3-4中的动态口令生成算法PSW2，计算得出动态口令数据RKS2；
步骤H：认证服务单元3-1将计算得出动态口令数据RKS1和DZXS1、RKS2和DZXS2进行对比，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块2发送此电子标签模块1合法的结果；若不能同时相等，则认证服务单元3-1采用步骤G的规则计算出多组口令，再从中取出连续的两组和DZXS1、DZXS2进行对比，经过n次对比后，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块2发送此电子标签模块1合法的结果；若仍无法达到连续两组口令相等，则通过互联网internet向用户验证终端模块2发送此电子标签模块1不合法的结果；
步骤I：用户验证终端模块2收到认证服务模块3反馈的结果后，将结果显示出来，完成本次对电子标签模块1的合法性验证过程。
实施例2：基于附图1结构，在网络不稳定或无网络环境时，可将认证服务模块中的认证服务单元3-1、服务配置单元3-3、第二动态口令配置单元3-4和存储单元1-6放置到用户验证终端模块2中，用户验证终端模块2将电子标签模块1数据采集后，由用户验证终端模块2在离线状态下直接完成认证服务。
结合附图3结构，变化过的本发明所使用的装置包括电子标签模块1、用户验证终端模块2两部分。电子标签模块1以自身开关触发次数作为可变因子生成动态口令数据并显示；用户验证终端模块3采集电子标签模块1的动态口令数据的图像数据，进行分析处理后，得到文本型口令数据，然后经过验证后，得出电子标签模块1的第一动态口令生成算法与用户验证终端模块2的第二动态口令生成算法是否一致的结果，从而判断出电子标签模块1的合法性。
实施例3：基于附图1结构，在网络稳定、需要降低用户验证终端模块2的本地运算量时，可将用户验证终端模块2中的图像分析单元2-3放置于认证 服务模块3中，用户验证终端模块2仅负责将电子标签模块1显示的数据采集，并以图像格式数据通过互联网internet发送到认证服务模块3，认证服务模块3进行图像分析，并提供认证服务。
结合附图4结构，变化过的本发明所使用的装置包括电子标签模块1、用户验证终端模块2和认证服务模块3三部分。电子标签模块1以自身开关触发次数作为可变因子生成动态口令数据并显示；用户验证终端模块2采集电子标签模块1生成的口令数据和电子标签模块1ID号的图像数据，并将图像数据通过互联网internet发送到认证服务模块3，认证服务模块3接收到用户验证终端模块2发送的图像数据后，进行分析处理后，得到文本型口令数据，然后进行验证；认证服务模块3经过验证后，得出电子标签模块1的第一动态口令生成算法与认证服务模块3的第二动态口令生成算法是否一致的结果，并将结果通过互联网internet返回到用户验证终端模块2，从而判断出电子标签模块1的合法性。
以上所述仅为本发明的较佳实施例而已，并不用以限制本发明，凡在本发明的精神和原则之内所作的任何修改、等同替换和改进等，均应包含在本发明的保护范围之内。

Claims (10)

  1. 一种事件型动态口令防伪标签合法性实时验证方法，其特征在于，该事件型动态口令防伪标签合法性实时验证方法包括以下步骤：
    步骤一，给每一个电子标签模块赋予一个唯一的ID号，ID号表示为IDS1，放置于电子标签模块的表面位置；在服务配置单元中写入电子标签模块的ID号IDS1所代表的产品信息和关联信息；定义一个用于关联电子标签模块和认证服务模块的种子文件，种子文件包含：初始触发次数数据DCF1、随机数RandomD、电子标签模块的ID号IDS1；在应用配置单元中存储数据TDSH代表电子标签模块的自毁装置已被破坏；在服务配置单元中IDS1对应的记录中设置PSW字段，用来代表ID为IDS1的电子标签模块所采用的动态口令生成算法类型；
    步骤二，用户通过开关单元打开电子标签模块，管理单元检测自毁触发单元是否已被损坏，若自毁触发单元已被损坏，则电子标签模块通过显示单元输出一个特定的数据TDSH，表示电子标签模块已经停止工作；若自毁触发单元正常工作，则电子标签模块的管理单元读取存储单元中的种子文件，在第一个口令变化周期时，初始开关单元的触发次数为DCF1；管理单元以种子文件中开关单元的触发次数DCF1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2，将DCF2保存到存储单元的种子文件中，覆盖掉DCF1；
    步骤三，用户验证终端模块的应用管理单元控制图像采集单元采集电子标签模块的图像数据IDT1，电子标签模块的图像数据IDT1包含显示单元显示的动态口令数据DKS1和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT1进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS1和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS1 等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS1不等于TDSH，则将IDS1和DZXS1保存到应用配置单元中；
    步骤四，电子标签模块的管理单元再次读取存储单元中的种子文件，在第二个口令变化周期时，管理单元以种子文件中开关单元的触发次数DCF2、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS2，并将DKS2显示在显示单元中；然后管理单元将初始开关单元的触发次数DCF2按照事先定义的触发次数累加周期累加后得到DCF3，将DCF3保存到存储单元的种子文件中，覆盖掉DCF2中；
    步骤五，用户验证终端模块的应用管理单元再次控制图像采集单元采集电子标签模块的图像数据IDT2，电子标签模块的图像数据IDT2包含显示单元显示的动态口令数据DKS2和放置在电子标签模块表面的电子标签模块的ID号IDS1；用户验证终端模块的应用管理单元通过图像分析单元对图像数据IDT2进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS2和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询，若DZXS2等于TDSH，则代表电子标签模块的自毁装置已损坏，结束验证过程；若DZXS2不等于TDSH，则将IDS1和DZXS2保存到应用配置单元中；然后将IDS1、DZXS1和DZXS2通过数据通信单元连接互联网internet发送到认证服务模块；
    步骤六，认证服务模块接收到用户验证终端模块发来的数据IDS1、DZXS1和DZXS2后，由认证服务单元以IDS1在服务配置单元中查询IDS1所对应的记录并提取初始写入种子文件的开关单元的触发次数DCF1、随机数RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2；然后，认证服务单元以RandomD、DCF1和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；然后将开关单元的触发次数DCF1按照事先定义的触发次数累加周期累加后得到DCF2， 并将DCF2保存到服务配置单元覆盖掉种子文件中的DCF1，再以RandomD、DCF2和IDS1作为计算因子，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS2。
  2. 如权利要求1所述的事件型动态口令防伪标签合法性实时验证方法，其特征在于，在步骤一之后需要通过开关单元打开电子标签模块，然后通过种子写入单元向存储单元中写入种子文件，同时将种子文件通过互联网internet写入到认证服务模块的服务配置单元中IDS1所对应的记录中。
  3. 如权利要求1所述的事件型动态口令防伪标签合法性实时验证方法，其特征在于，在步骤六之后认证服务单元将计算得出动态口令数据RKS1和DZXS1、RKS2和DZXS2进行对比，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若不能同时相等，则认证服务单元计算出多组口令，再从中取出连续的两组和DZXS1、DZXS2进行对比，经过n次对比后，若RKS1等于DZXS1且RKS2等于DZXS2，则通过互联网internet向用户验证终端模块发送此电子标签模块合法的结果；若仍无法达到连续两组口令相等，则通过互联网internet向用户验证终端模块发送此电子标签模块不合法的结果；
    用户验证终端模块收到认证服务模块反馈的结果后，将结果显示出来，完成本次对电子标签模块的合法性验证过程。
  4. 一种事件型动态口令防伪标签合法性实时验证系统，其特征在于，该事件型动态口令防伪标签合法性实时验证系统包括：电子标签模块、用户验证终端模块和认证服务模块；
    电子标签模块，用于生成动态口令数据并显示；电子标签模块包括：管理单元、开关单元、种子写入单元、自毁触发单元、第一动态口令配置单元、存储单元、显示单元；
    用户验证终端模块，与电子标签模块连接，用于采集电子标签模块生成的动态口令数据和电子标签模块ID号的图像数据，进行分析处理后，得到文本型 数据，然后将文本型数据通过互联网internet发送到认证服务模块；用户验证终端模块包括：应用管理单元、图像采集单元、图像分析单元、应用配置单元、数据输入单元、数据通信单元；
    认证服务模块，与用户验证终端模块连接，接收到文本型数据后，用于经过计算和验证，得出电子标签模块的第一动态口令数据生成算法与认证服务模块的第二动态口令数据生成算法是否一致的结果，并将结果返回到用户验证终端模块，从而判断出电子标签模块的合法性；认证服务模块包括：认证服务单元、时钟控制单元、服务配置单元、第二动态口令配置单元。
  5. 如权利要求4所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，电子标签模块包括：管理单元、开关单元、种子写入单元、自毁触发单元、第一动态口令配置单元、存储单元、显示单元；
    管理单元，用于检测自毁触发单元是否已被损坏，根据自毁触发单元的时钟变化周期，在第一个时钟变化周期时，初始时钟数据为DSS1；以种子数据中的时钟数据DSS1、随机数RandomD、电子标签模块的ID号IDS1作为计算因子，通过第一动态口令配置单元的动态口令生成算法PSW1生成动态口令数据DKS1，并将DKS1显示在显示单元中；然后将初始时钟数据DSS1按照事先定义的时钟累加周期累加后得到DSS2，将DSS2保存缓存中；
    开关单元，与管理单元连接，用于打开电子标签模块；
    种子写入单元，与管理单元连接，用于写入种子文件；
    自毁触发单元，与管理单元连接，用于发送损坏信号；
    第一动态口令配置单元，与管理单元连接，用于动态口令生成算法PSW1生成动态口令数据DKS1；
    存储单元，与管理单元连接，用于保存种子文件；
    显示单元，与管理单元连接，用于显示动态口令数据DKS1。
  6. 如权利要求5所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，第一动态口令配置单元中的动态口令生成算法采用国密算法；
    管理单元将电子标签模块自身的ID号和时钟数据或动态口令生成次数作为计算因子，传递到第一动态口令配置单元得到动态口令数据；每个电子标签模块均生成不同的且具有一次有效性的动态口令数据，动态口令数据是数字形式、任意字符、字符数字组合、条码、二维码任意一种口令表达形式；
    电子标签模块的动态口令显示方法，通过电子标签模块的显示单元显示动态口令数据，由用户验证终端模块控制图像采集单元进行数据采集，电子标签模块采用NFC、RFID、红外通信方式，向用户验证终端模块传递数据。
  7. 如权利要求4所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于降低用户终端验证模块的运算量和节省硬件资源的情况下，将用户验证终端模块中的图像分析单元放置于认证服务模块中，用户验证终端模块仅负责将电子标签模块显示的动态口令数据采集，并将图像数据发送到认证服务模块，由认证服务模块进行图像分析，转换数据格式并进行数据验证；
    电子标签模块的动态口令数据验证方法，用户验证终端模块和认证服务模块的结构，基于网络不通畅时，将认证服务模块中的认证服务单元、服务配置单元和第二动态口令配置单元放置到用户验证终端模块中，用户验证终端模块将电子标签模块的动态口令数据采集后，在离线状态下，直接完成认证服务。
  8. 如权利要求4所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，用户验证终端模块包括：应用管理单元、图像采集单元、图像分析单元、应用配置单元、数据输入单元、数据通信单元；
    应用管理单元，用于控制图像采集单元采集电子标签模块的图像数据IDT1，通过图像分析单元对图像数据IDT1进行定位、分割和分析，得出电子标签模块中显示单元显示的动态口令数据DZXS和电子标签模块的ID号IDS1，然后在应用配置单元中进行查询；
    图像采集单元，与应用管理单元连接，用于采集电子标签模块的图像数据 IDT1；
    图像分析单元，与应用管理单元连接，用于对图像数据IDT1进行定位、分割和分析；
    应用配置单元，与应用管理单元连接，用于存储代表电子标签模块的自毁装置已被破坏的数据TDSH，和临时存放动态口令数据DZXS与电子标签模块的ID号IDS1的小型数据库；
    数据输入单元，与应用管理单元连接，用于输入查询的动态口令数据DZXS；
    数据通信单元，与应用管理单元连接，用于通过连接互联网internet将IDS1和DZXS发送到认证服务模块。
  9. 如权利要求4所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，认证服务模块还包括：认证服务单元、时钟控制单元、服务配置单元、第二动态口令配置单元；
    认证服务单元，用于提取初始写入种子文件的时钟数据DSS1、随机数RandomD和IDS1所代表的电子标签模块所采用的动态口令生成算法PSW2，获取当前认证服务模块的系统时间RSS1，通过第二动态口令配置单元中的动态口令生成算法PSW2，计算得出动态口令数据RKS1；将计算得出动态口令数据RKS1和DZXS进行对比；
    时钟控制单元，与认证服务单元连接，用于为认证服务单元提供时钟信号；
    服务配置单元，与认证服务单元连接，用于存储IDS1各类属性的数据库；；
    第二动态口令配置单元，与认证服务单元连接，用于动态口令生成算法PSW2，计算得出动态口令数据RKS1。
  10. 如权利要求9所述的事件型动态口令防伪标签合法性实时验证系统，其特征在于，服务配置单元是具有能被认证服务单元读写的数据库；服务配置单元是以电子标签模块ID配置电子标签模块的属性，并将电子标签模块所代表的物品信息和电子标签模块的属性保存在数据库中；在认证服务模块中第二动 态口令配置单元中放置多个与电子标签模块对应的动态口令生成算法。
PCT/CN2015/076684 2014-10-31 2015-04-15 一种事件型动态口令防伪标签合法性实时验证方法及系统 WO2016065860A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410606036.4 2014-10-31
CN201410606036.4A CN104410492B (zh) 2014-10-31 2014-10-31 一种事件型动态口令防伪标签合法性实时验证方法及系统

Publications (1)

Publication Number Publication Date
WO2016065860A1 true WO2016065860A1 (zh) 2016-05-06

Family

ID=52648090

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/076684 WO2016065860A1 (zh) 2014-10-31 2015-04-15 一种事件型动态口令防伪标签合法性实时验证方法及系统

Country Status (2)

Country Link
CN (1) CN104410492B (zh)
WO (1) WO2016065860A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104410492B (zh) * 2014-10-31 2016-01-13 杭州沃朴物联科技有限公司 一种事件型动态口令防伪标签合法性实时验证方法及系统
CN107766914B (zh) * 2016-08-23 2021-04-13 华大恒芯科技有限公司 用于电子标签有限次操作的安全防护方法
CN106709537A (zh) * 2016-11-14 2017-05-24 珠海晶通科技有限公司 一种具有电子墨水技术的动态信息防伪系统及其防伪方法
CN109117927A (zh) * 2017-06-22 2019-01-01 杭州沃朴物联科技有限公司 一种基于动态条形码的分散抽拉式防伪标签
CN109117922B (zh) * 2017-06-22 2021-08-24 杭州沃朴物联科技有限公司 一种基于动态二维码的分散旋转式防伪标签
CN109117912B (zh) * 2017-06-22 2024-02-27 杭州沃朴物联科技有限公司 一种基于动态密码的球形防伪标签
CN109117923A (zh) * 2017-06-22 2019-01-01 杭州沃朴物联科技有限公司 一种嵌入式动态条形码防伪标签
CN109117916B (zh) * 2017-06-22 2021-07-20 杭州沃朴物联科技有限公司 一种基于动态二维码的分散嵌入式防伪标签
CN109117926B (zh) * 2017-06-22 2021-08-24 杭州沃朴物联科技有限公司 一种基于动态二维码的环绕式防伪标签
CN109117914A (zh) * 2017-06-22 2019-01-01 杭州沃朴物联科技有限公司 一种基于动态条形码的抽拉式防伪标签

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102968606A (zh) * 2012-10-30 2013-03-13 上海孚恩电子科技有限公司 Rfid双向认证方法
CN103312516A (zh) * 2013-06-21 2013-09-18 樊晓东 一种动态口令的合法性实时验证方法
CN103354499A (zh) * 2013-06-21 2013-10-16 樊晓东 一种动态口令的合法性实时验证方法
CN104410492A (zh) * 2014-10-31 2015-03-11 杭州沃朴物联科技有限公司 一种事件型动态口令防伪标签合法性实时验证方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102968606A (zh) * 2012-10-30 2013-03-13 上海孚恩电子科技有限公司 Rfid双向认证方法
CN103312516A (zh) * 2013-06-21 2013-09-18 樊晓东 一种动态口令的合法性实时验证方法
CN103354499A (zh) * 2013-06-21 2013-10-16 樊晓东 一种动态口令的合法性实时验证方法
CN104410492A (zh) * 2014-10-31 2015-03-11 杭州沃朴物联科技有限公司 一种事件型动态口令防伪标签合法性实时验证方法及系统

Also Published As

Publication number Publication date
CN104410492B (zh) 2016-01-13
CN104410492A (zh) 2015-03-11

Similar Documents

Publication Publication Date Title
WO2016065861A1 (zh) 时钟同步型动态口令防伪标签合法性实时验证系统及方法
WO2016065860A1 (zh) 一种事件型动态口令防伪标签合法性实时验证方法及系统
CN105354604B (zh) 一种有效的基于物理不可克隆函数的防伪方法
CN105893829A (zh) 基于图像的密钥交换
CN110351239A (zh) 一种基于区块链的电子合同存储方法及装置、电子设备
CN107209821A (zh) 用于对电子文件进行数字签名的方法以及认证方法
CN114996675A (zh) 数据查询方法、装置、计算机设备及存储介质
CN106709534A (zh) 电子证件防伪验证系统
CN103312516A (zh) 一种动态口令的合法性实时验证方法
Prasanalakshmi et al. Two-way handshake user authentication scheme for e-banking system
You et al. A cancelable multi-biometric template generation algorithm based on bloom filter
CN103295169B (zh) 房地产实人登记信息安全监管方法及系统
CN103390121A (zh) 数字作品权属认证方法和系统
Ameh et al. Securing cardless automated teller machine transactions using bimodal authentication system
Lee et al. A Rhythm‐Based Authentication Scheme for Smart Media Devices
Abdulhak et al. A systematic review of features identification and extraction for behavioral biometrie authentication in touchscreen mobile devices
Paul et al. Fingerprint authentication is here but are we ready for what it brings?
Xie et al. Research and application of security and privacy in industrial internet of things based on fingerprint encryption
Salem et al. Blockchain-based biometric identity management
CN103354499A (zh) 一种动态口令的合法性实时验证方法
CN107220813A (zh) 一种基于实体公章的强制认证云电子公章系统
Bezzateev et al. Signing Documents by Hand: Model for Multi-Factor Authentication
Ninassi et al. Privacy Compliant Multi-biometric Authentication on Smartphones.
CN117201144A (zh) 基于人工智能的请求处理方法、装置、设备及存储介质
Vila et al. An Analysis of n-factor Authentication in e-Banking Environments.

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15855169

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15855169

Country of ref document: EP

Kind code of ref document: A1