WO2016107333A1 - 一种在线激活移动终端令牌的设备和系统的工作方法 - Google Patents

一种在线激活移动终端令牌的设备和系统的工作方法 Download PDF

Info

Publication number
WO2016107333A1
WO2016107333A1 PCT/CN2015/095278 CN2015095278W WO2016107333A1 WO 2016107333 A1 WO2016107333 A1 WO 2016107333A1 CN 2015095278 W CN2015095278 W CN 2015095278W WO 2016107333 A1 WO2016107333 A1 WO 2016107333A1
Authority
WO
WIPO (PCT)
Prior art keywords
token
activation
mobile terminal
cloud authentication
authentication server
Prior art date
Application number
PCT/CN2015/095278
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US15/533,713 priority Critical patent/US10187381B2/en
Publication of WO2016107333A1 publication Critical patent/WO2016107333A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication

Definitions

  • the present invention relates to a method for operating a device and a system for activating a mobile terminal token. It belongs to the field of information security technology, and is particularly applicable to a system including a cloud authentication management platform, a cloud authentication server, a terminal, and a mobile terminal token.
  • the mobile terminal token is a mobile terminal software for generating a dynamic password.
  • the mobile terminal token generates a dynamic password by a program running on the mobile terminal, and the dynamic password is bound to the mobile terminal for identity.
  • Authentication, password generation process does not generate communication and cost, has the advantages of simple use, high security, low cost, no need to carry extra equipment, easy to access, no logistics, etc.
  • Mobile terminal token is the development trend of dynamic password authentication in 3G era .
  • the OTP Cloud Authentication Center is a SaaS-based identity authentication platform deployed on the Internet to provide a reliable identity authentication infrastructure for individuals, homes and businesses.
  • the OTP Cloud Certification Center provides a standalone cloud-based OTP service for websites with simple integration. With the free mobile terminal token, you can greatly enhance the security of your website login.
  • the two-dimensional code also known as the two-dimensional bar code, is a black and white graphic that is distributed on a square meter with a certain geometric pattern according to a certain rule. It is a key to all information data and is widely used.
  • the object of the present invention is to provide a working method of a device and a system for activating a mobile terminal token online, which can realize a secure interaction between a mobile terminal token and a cloud authentication server during a mobile terminal token activation process.
  • the activation of the mobile terminal token enhances the security of the activation process.
  • a system working method for online activation of a mobile terminal token comprising:
  • Step S1 The cloud authentication server receives a first activation request from the cloud authentication management platform, generates a first activation response according to the first activation request, and returns it to the cloud authentication management platform;
  • Step S2 The cloud authentication management platform sends the first activation response to the terminal;
  • Step S3 After the mobile terminal token acquires the first activation response from the terminal, access the cloud authentication server according to the first activation response, and generate a second according to the first activation response. Activating the request, and sending the second activation request to the cloud authentication server;
  • Step S4 After receiving the second activation request, the cloud authentication server generates a token serial number and a seed generation factor, generates a server seed key according to the seed generation factor, and saves the token serial number and the Server seed key;
  • Step S5 The cloud authentication server generates a second activation response according to the token serial number and the seed generation factor, and returns the second activation response to the mobile terminal token.
  • Step S6 The mobile terminal token acquires the seed generation factor and the token serial number from the second activation response, generates a token seed key according to the seed generation factor, and saves the token sequence. Number and the token seed key;
  • Step S7 The mobile terminal token calculates the token seed key and the built-in dynamic factor, generates a dynamic password, generates a third activation request according to the dynamic password, and sends the third activation request to The cloud authentication server;
  • Step S8 The cloud authentication server acquires a dynamic password from the received third activation request, acquires a saved server seed key, calculates the server seed key and the built-in dynamic factor, and generates a dynamic password. Determining whether the generated dynamic password matches the obtained dynamic password, and if yes, executing step S10, otherwise returning to the mobile terminal token a third activation response that fails to be activated, and ending;
  • Step S9 The cloud authentication server generates a third activation response that is successfully activated, and returns the third activation response. To the mobile terminal token, the activation is successful.
  • the cloud authentication management platform is set in the same device as the cloud authentication server, or is set in a different device.
  • the generating the first activation response according to the first activation request comprises: the cloud authentication server calling a random number generation function, generating a first random number, and the first random number The number is used as an activation request ID and saved, and a first activation response is generated according to the activation request ID;
  • the generating the second activation request according to the first activation response specifically: the mobile terminal token acquiring the activation request ID from the first activation response and saving, according to the Activating the request ID to generate a second activation request;
  • the method further includes: the cloud authentication server acquiring the activation request ID from the second activation request, and determining the activation request ID and the saved activation. Whether the request ID is the same, if yes, continue the subsequent operation, otherwise it will report an error and end;
  • the step S5 and the step S6 further include: the mobile terminal token obtaining the activation request ID from the second activation response, determining whether the activation request ID is the same as the saved activation request ID, and if yes, executing step S6. Otherwise, an error is reported and the end is completed.
  • the generating the first activation response according to the first activation request includes:
  • Step a1 The cloud authentication server acquires the username from the first activation request.
  • Step a2 The cloud authentication server obtains the corresponding enterprise identifier according to the username, and generates the first activation response according to the preset prefix identifier, the preset domain name, the enterprise identifier, and the activation request ID.
  • the accessing the cloud authentication server according to the first activation response specifically includes: the mobile terminal token acquiring the preset domain name and the enterprise identifier from the first activation response, and Obtaining a terminal port number, obtaining an activation URL according to the preset domain name, the enterprise identifier, and the terminal port number, accessing the cloud authentication server by using the activation URL, and establishing a network data link with the cloud authentication server.
  • the method further includes: the cloud authentication server acquiring and recording a server system time;
  • the step S4 further includes: the cloud authentication server acquiring the current server system time, determining whether the difference between the current server system time and the recorded server system time is within a preset range, and if yes, continuing the subsequent operation, otherwise Delete the saved activation request ID.
  • the generating the second activation request according to the first activation response specifically: the mobile terminal token acquiring the saved token identification code and the token version number, and calling the acquisition system a type function, obtaining a mobile terminal system type, and generating a second activation request according to the token identification code, the token version number, and the mobile terminal system type;
  • the method further includes: the cloud authentication server acquiring the token identification code, the token version number, and the mobile terminal system from the second activation request. Type, and obtain the saved token ID, token version number and mobile terminal system type to determine whether it matches. If yes, continue the subsequent operation, otherwise it will report an error and end.
  • the cloud authentication server generates the seed according to the token identification code Encrypting the factor to obtain an encrypted seed generation factor, and generating a second activation response according to the token identification code and the encrypted seed generation factor;
  • the acquiring the seed generation factor and the token serial number from the second activation response specifically includes: the cloud authentication server acquiring a token sequence from the second activation response And an encryption seed generation factor, which decrypts the encrypted seed generation factor according to the token identification code to obtain a seed generation factor.
  • the method further includes:
  • Step b1 The cloud authentication management platform waits to receive a user record selected by an administrator and needs to be activated;
  • Step b2 The cloud authentication management platform generates the first activation request according to the username in the user record.
  • Step b3 The cloud authentication management platform sends the first activation request to the cloud authentication server.
  • the method further includes:
  • Step c0 The cloud authentication management platform sets the number of failed verification passwords to an initial value
  • Step c1 The cloud authentication management platform waits for the receiving administrator to input an administrator account and a password
  • Step c2 The cloud authentication management platform determines whether the administrator account and password input by the administrator are correct, and if yes, step c1 is performed, otherwise step c3 is performed;
  • Step c3 The cloud authentication management platform updates the number of failed verification passwords, determines whether the number of failed authentication passwords reaches a preset number of times, and if yes, reports an error, and locks the cloud authentication management platform, otherwise returns to step c1.
  • the cloud authentication management platform receives an activation button clicked by the administrator, obtains the last activation time and the current system time, and determines whether the difference between the two is greater than a preset duration, and if so, Allow activation again, execute step b2, otherwise return the activated response, end;
  • the step b2 is specifically: the cloud authentication management platform generates a first activation request according to the user name and the reactivation identifier in the user record;
  • the step S1 further includes: the cloud authentication server records the reactivation identifier;
  • the step S4 specifically includes: the cloud authentication server determines whether a reactivation identifier is recorded, and if yes, generates a seed generation factor, and otherwise generates a token serial number and a seed generation factor.
  • the step S9 further comprises: acquiring the current system time, and saving the current system time as the last activation time.
  • the step S2 specifically includes:
  • Step S2-1 After receiving the first activation response, the cloud authentication management platform generates a two-dimensional code picture according to the first activation response.
  • Step S2-2 The cloud authentication management platform acquires a corresponding email account, and sends the two-dimensional code image to the mobile terminal by using an email according to the email account;
  • Step S2-3 The terminal displays the received two-dimensional code picture
  • the mobile terminal token acquires the first activation response, specifically: the mobile terminal receives a scan of the two-dimensional code picture, parses the two-dimensional code picture, and obtains the The first activation response.
  • the step S2 includes: the cloud authentication management platform acquires a terminal number, and sends the first activation response to the terminal corresponding to the terminal number by using a short message according to the terminal number;
  • the mobile terminal token acquires the first activation response, specifically: the mobile terminal token starts to receive the data mechanism, and receives the first activation response.
  • the step S4 specifically includes:
  • Step d1 The cloud authentication server invokes a random number generation function to generate a second random number as a seed generation factor, and generates a token serial number according to the token serial number generation algorithm and saves;
  • Step d2 The cloud authentication server applies a preset derivation algorithm, and derivates the seed generation factor to obtain a server seed key.
  • Step d3 The cloud authentication server acquires an enterprise key, encrypts the server seed key by using the enterprise key, obtains an encrypted server seed key, and saves the same.
  • the obtained server seed key is obtained, and the server seed key is calculated to generate a dynamic password, which is specifically:
  • Step e1 The cloud authentication server acquires the corresponding enterprise key and the encryption server seed key
  • Step e2 The cloud authentication server decrypts the encryption server seed key by using a preset decryption algorithm according to the enterprise key, to obtain a server seed key.
  • Step e3 The cloud authentication server applies a password generation algorithm, calculates the server seed key and the built-in dynamic factor, and generates a dynamic password.
  • the obtaining the corresponding enterprise key further includes:
  • Step f1 The key operation and maintenance platform receives the administrator key of the key holder
  • Step f2 The key operation and maintenance platform performs a preset operation on the administrator key to obtain a master key, and saves the master key.
  • Step f3 The cloud authentication server periodically obtains a master key from the key operation and maintenance platform, and determines whether the obtained master key is the same as the saved master key. If yes, step f4 is performed; The master key updates the saved master key, and performs step f4;
  • Step f4 The cloud authentication server acquires a corresponding enterprise ID, hashes the master key and the enterprise ID, obtains an enterprise key, and saves the enterprise key.
  • the step S6 specifically includes:
  • Step S6-1 The mobile terminal token acquires a seed generation factor and the token serial number from the second activation response;
  • Step S6-2 the mobile terminal token generates a token seed key according to the seed generation factor
  • Step S6-3 the mobile terminal token encrypts the token seed key by applying the token serial number to obtain an encrypted token seed key, and the encrypted token seed key and the order The card serial number is saved.
  • the calculating the token seed key to generate a dynamic password is specifically:
  • Step S7-1 The mobile terminal token applies the token sequence number to decrypt the encrypted token seed key to obtain a token seed key.
  • Step S7-2 The mobile terminal token applies a password generation algorithm, calculates the token seed key and the built-in dynamic factor, and generates a dynamic password.
  • the mobile terminal token determines the third activation response after receiving the third activation response, and if it is an activation success response, the activation succeeds, ends, if it is activated If the response fails, the token seed key is deleted, the activation fails, and the process ends.
  • a method for operating a cloud authentication server in a system for activating a mobile terminal token online includes:
  • Step T1 The cloud authentication server receives a first activation request from the cloud authentication management platform, generates a first activation response according to the first activation request, and transmits the first activation response to the mobile terminal token.
  • Step T2 The cloud authentication server receives a second activation request sent by the mobile terminal token, generates a token serial number and a seed generation factor, generates a server seed key according to the seed generation factor, and saves the token sequence. Number with the server seed key;
  • Step T3 The cloud authentication server generates a second activation response according to the token serial number and the seed generation factor, and returns the token to the mobile terminal through the network data link.
  • Step T4 The cloud authentication server receives the third activation request sent by the mobile terminal token, obtains a dynamic password from the third activation request, and obtains the saved server seed key, and calculates the server seed key. , generating a dynamic password;
  • Step T5 The cloud authentication server determines whether the generated dynamic password matches the obtained dynamic password, and if yes, performs step T6, otherwise returns a third activation response that fails to activate to the mobile terminal token, and ends;
  • Step T6 The cloud authentication server generates a third activation response that is successfully activated and returns to the mobile terminal token through the network data link, and the activation is successful.
  • the generating the first activation response according to the first activation request, and transmitting the first activation response to the mobile terminal token specifically includes:
  • Step T1-1 The cloud authentication server acquires a username from the first activation request.
  • Step T1-2 The cloud authentication server obtains a corresponding preset prefix identifier, a preset domain name, and an enterprise identifier according to the username.
  • Step T1-3 The cloud authentication server generates a first activation response according to the username, the preset prefix identifier, the preset domain name, and the enterprise identifier, and passes the first activation response through cloud authentication. Management platform and terminal transfer to the office The mobile terminal token.
  • the cloud authentication server determines whether the reactivation identifier can be obtained from the first activation request, and if yes, records the reactivation identifier, and performs step T2; otherwise, directly Perform step T2;
  • the step T2 specifically includes: the cloud authentication server receiving a second activation request sent by the mobile terminal token, determining whether the reactivation identifier is recorded, and if yes, generating a seed generation factor, generating according to the seed The factor generates a server seed key and saves, otherwise generates a token serial number and a seed generation factor, generates a server seed key according to the seed generation factor, and saves the token serial number and the server seed key.
  • the step T2 is specifically:
  • Step T2-1 The cloud authentication server receives the second activation request sent by the mobile terminal token, invokes a random number generation function, generates a second random number, and uses the token generation number generation algorithm according to the token serial number generation algorithm. a token serial number and save it;
  • Step T2-2 The cloud authentication server applies a preset derivation algorithm, and derives the seed generation factor to obtain a server seed key.
  • Step T2-3 The cloud authentication server acquires an enterprise key, encrypts the server seed key by using the enterprise key, obtains an encrypted server seed key, and saves the file.
  • the obtained server seed key is obtained, and the server seed key is calculated to generate a dynamic password, which is specifically:
  • Step T4-1 The cloud authentication server acquires the corresponding enterprise key and the encryption server seed key.
  • Step T4-2 The cloud authentication server decrypts the encryption server seed key by using a preset decryption algorithm according to the enterprise key, to obtain a server seed key.
  • Step T4-3 The cloud authentication server applies a password generation algorithm, calculates the server seed key and the built-in dynamic factor, and generates a dynamic password.
  • the second activation response is generated according to the token serial number and the seed generation factor, where the cloud authentication server obtains the saved token identification code, according to the The card identification code encrypts the seed generation factor to obtain an encrypted seed generation factor, and generates a second activation response according to the token identification code and the encrypted seed generation factor.
  • a method for operating a mobile terminal token in a system for activating a mobile terminal token online includes:
  • Step X1 The mobile terminal token receives a first activation response from the cloud authentication server, accesses the cloud authentication server according to the first activation response, establishes a network data link with the cloud authentication server, and according to the The first activation response generates a second activation request, and is sent to the cloud authentication server by using the network data link;
  • Step X2 The mobile terminal token receives a second activation response sent by the cloud authentication server, acquires a seed generation factor and a token sequence number from the second activation response, and generates a token seed key according to the seed generation factor. Saving the token serial number and the token seed key;
  • Step X3 The mobile terminal token calculates the token seed key, generates a dynamic password, generates a third activation request according to the dynamic password, and sends the third activation request to the cloud authentication server by using the network data link. ;
  • Step X4 The mobile terminal token receives the third activation response returned by the cloud authentication server, and determines the third activation response. If it is a failure response, the token seed key is deleted, and the activation fails and ends. If the response is successful, the activation is successful and ends.
  • the accessing the cloud authentication server according to the first activation response establishing a network data link with the cloud authentication server, specifically: the mobile terminal token from the first Obtaining a preset domain name and an enterprise identifier in an activation response, obtaining a terminal port number, obtaining an activation URL according to the preset domain name, the enterprise identifier, and the terminal port number, and accessing the cloud authentication server by using the activation URL Establishing a network data link with the cloud authentication server.
  • the mobile terminal token receives a first activation response from the cloud authentication server, Specifically, the mobile terminal receives the two-dimensional code picture generated by the first activation response, parses the two-dimensional code picture, and obtains the first activation response.
  • the mobile terminal token receives the first activation response from the cloud authentication server, specifically: the mobile terminal token starts to receive the data mechanism, and when the detected data includes the preset prefix identifier, Receiving the first activation response.
  • the generating, according to the first activation response, a second activation request specifically: the mobile terminal token acquiring the saved token identification code and the token version number, and calling the acquiring system type function to acquire the mobile terminal
  • the system type generates a second activation request according to the token identification code, the token version number, and the mobile terminal system type.
  • step X2 is specifically:
  • Step X2-1 The mobile terminal token receives a second activation response sent by the cloud authentication server, and obtains a seed generation factor and the token serial number from the second activation response.
  • Step X2-2 The mobile terminal token generates a token seed key according to the seed generation factor
  • Step X2-3 The mobile terminal token encrypts the token seed key by applying the token serial number to obtain an encrypted token seed key, and the encrypted token seed key and the order The card serial number is saved.
  • the calculating the token seed key to generate a dynamic password is specifically:
  • Step X3-1 The mobile terminal token applies the token sequence number to decrypt the encrypted token seed key to obtain a token seed key.
  • Step X3-2 The mobile terminal token applies a password generation algorithm, and calculates the token seed key and the built-in dynamic factor to generate a dynamic password.
  • the present invention it is possible to implement activation of the mobile terminal token through the secure interaction between the mobile terminal token and the cloud authentication server during the activation of the mobile terminal token, thereby improving the security of the activation process.
  • FIG. 2 and FIG. 3 are flowcharts of a system working method for online activation of a mobile terminal token according to Embodiment 1 of the present invention
  • FIG. 4 is a flowchart of a working method of a cloud authentication server in a system for activating a mobile terminal token online according to Embodiment 2 of the present invention
  • FIG. 5 is a flowchart of a working method of a mobile terminal token in a system for activating a mobile terminal token online according to Embodiment 3 of the present invention.
  • the present invention is applied to a system comprising a cloud authentication management platform, a cloud authentication server, a terminal, and a mobile terminal token.
  • the terminal is specifically a PC, an iPad, and a mobile phone.
  • a terminal device capable of receiving a mail such as a terminal device of a mobile terminal token
  • the terminal is specifically a terminal device, such as a mobile phone, loaded with the mobile terminal token and capable of receiving a short message.
  • the server seed key and the token seed key may be stored in an encrypted manner or directly.
  • the first embodiment is implemented by storing an encryption server seed key and an encrypted token seed key.
  • Embodiment 2 and implementation Example 3 is implemented by directly saving the server seed key and the token seed key.
  • the method of encrypting the seed key can be used by each device separately, that is, the server seed key is directly saved, and the token seed key is encrypted and saved. Wait.
  • Embodiment 1 of the present invention provides a system working method for online activation of a mobile terminal token, as shown in FIG. 1 , FIG. 2 and FIG. 3 , including:
  • Step 101 The cloud authentication management platform receives the user record selected by the administrator and needs to be activated, and determines whether the corresponding mobile terminal number, email account, and user name can be obtained according to the user record. If yes, step 102 is performed, otherwise the prompt information is not Complete, end;
  • the method further includes: determining whether the corresponding token identification code and the mobile terminal system version can be obtained, and if yes, performing step 103; otherwise, the prompt information is incomplete and ending;
  • the cloud authentication management platform requires the user to input the token identification code and the mobile terminal system version when the user registers;
  • the cloud authentication management platform receives the user record selected by the administrator as:
  • Token identification code 57987117827971672588
  • the method further includes:
  • A The cloud authentication management platform waits for the administrator to input the administrator account and password
  • the cloud authentication management platform determines whether the received administrator account and password entered by the administrator are correct, and if yes, step 101 is performed, otherwise C is executed;
  • the cloud authentication management platform updates the number of failed authentication passwords, determines whether the number of failed authentication passwords reaches the preset number of times, and if so, reports an error, and locks the cloud authentication management platform, otherwise returns to A;
  • the administrator authentication mode may be configured in advance, that is, the verification account password method may be adopted, or the two-factor authentication may be configured;
  • the two-factor authentication process is as follows: first, the account password is verified. When the account password is matched, the get SMS password button and the SMS password input box are displayed. When the administrator clicks the get SMS password button, the administrator waits for the administrator to input the SMS password. After the SMS password is reached, it is determined whether the SMS password is correct. If yes, the login is successful, and step 103 is performed; otherwise, the SMS password verification times are accumulated. When the preset number of times (preferably 10 times) is reached, the cloud authentication management platform is temporarily locked. The preset duration (preferably 30 minutes) is automatically unlocked;
  • Step 102 The cloud authentication management platform generates a first activation request according to the username in the user record.
  • This step also includes:
  • Step 102-1 The cloud authentication management platform receives an activation button clicked by the administrator;
  • Step 102-2 The cloud authentication management platform determines whether the last activation time can be obtained, if yes, step 102-3 is performed, otherwise step 102 is performed;
  • Step 102-3 The cloud authentication management platform obtains the current system time, determines whether the difference between the current system time and the last activation time is greater than a preset duration, and if yes, performs step 102-4, otherwise returns a non-repeatable activation response, and ends;
  • Step 102-4 The cloud authentication management platform generates a first activation request according to the user name and the reactivation identifier, and performs step 103;
  • Step 103 The cloud authentication management platform sends the first activation request to the cloud authentication server.
  • Step 104 After receiving the first activation request, the cloud authentication server obtains the user name from the first activation request.
  • Step 105 The cloud authentication server invokes a random number generation function, generates a first random number, uses the first random number as an activation request ID, associates the activation request ID with the user name, and saves the result to the server storage area.
  • the two-dimensional code picture is required to be valid only for a predetermined time. Therefore, after the cloud authentication server generates the activation request ID, the activation request ID is saved to the server storage area, and is recorded. Server system time;
  • the generated activation request ID is fasdcvxvdsafdsfzcxcsdfsdafcxz
  • the recording server system time is 1417502570.
  • Step 106 The cloud authentication server obtains a corresponding enterprise identifier according to the user name, and generates a first activation response according to the preset prefix identifier, the preset domain name, the enterprise identifier, and the activation request ID.
  • the preset prefix identifier is yunxin://, and the default domain name is: api-6-bit enterprise identifier. cloudentify.com;
  • the first activation response generated is:
  • the cloud authentication server identifies the yunxin:// according to the preset prefix, the obtained enterprise identifier dfserv, the default domain name api-6-bit enterprise identifier. cloudentify.com, and the activation request IDfasdcvxvdsafdsfzcxcsdfsdafcxz;
  • the first activation response generated is:
  • Step 107 The cloud authentication server returns the first activation response to the cloud authentication management platform.
  • Step 108 The cloud authentication management platform receives the activation mode selected by the administrator. If it is the email activation mode, step 109 is performed, and if it is the SMS activation mode, step 115 is performed:
  • Step 109 The cloud authentication management platform generates a two-dimensional code picture according to the received first activation response.
  • the cloud authentication management platform invokes the two-dimensional code picture generation function according to the first activation response to generate a two-dimensional code picture;
  • Step 110 The cloud authentication management platform obtains an email account from the user record.
  • Step 111 The cloud authentication management platform sends the QR code image to the terminal by using an email account according to the email account;
  • the terminal may be a mobile device (such as an iPad, a mobile phone, etc.) or a PC;
  • Step 112 After receiving the mail, the terminal displays the two-dimensional code picture in the mail;
  • Step 113 The mobile terminal token waits to receive the user to scan the two-dimensional code picture
  • Step 114 After the mobile terminal token receives the two-dimensional code picture, according to the two-dimensional code picture to obtain a first activation response, step 119 is performed;
  • Step 115 The cloud authentication management platform obtains the terminal number from the user record.
  • Step 116 The cloud authentication management platform sends the first activation response to the terminal corresponding to the terminal number by using a short message according to the terminal number.
  • the terminal refers to a mobile device, such as a mobile phone, capable of receiving a short message and device the mobile terminal token;
  • Step 117 After receiving the short message, the terminal displays the first activation response in the short message.
  • Step 118 The mobile terminal token initiates the receiving data mechanism, and receives the first activation response.
  • step 119 is performed;
  • the mobile terminal token receives the user's click trigger on the first activation response and starts the receiving data mechanism, and if the received first activation response is detected, When the preset prefix is specified, step 119 is performed;
  • Step 119 The mobile terminal token obtains a preset domain name, an enterprise identifier, and an activation request ID from the first activation response.
  • the activation request ID obtained by the mobile terminal token from the first activation response is fasdcvxvdsafdsfzcxcsdfsdafcxz;
  • Step 120 The mobile terminal token obtains the terminal port number, obtains the activation URL according to the preset domain name, the enterprise identifier, and the terminal port number, accesses the cloud authentication server by activating the URL, establishes a network data link with the cloud authentication server, and according to the activation request ID. Generating a second activation request;
  • the terminal port number obtained by the mobile terminal token is 1843, the default domain name and the enterprise identity api-dfserv.cloudentify.com;
  • the obtained activation URL is: api-dfserv.cloudentify.com: 1843; accessing the cloud authentication server through the activation URL, establishing a network data link with the cloud authentication server, specifically a TCP connection, and preferably transmitting the data in a JSON data format;
  • the step further includes: acquiring, by the mobile terminal token, a preset online activation request type, acquiring the saved token identification code and the token version number, calling the acquisition system type function, acquiring the mobile terminal system type, and then Presetting the online activation request type, the activation request ID, the token identification code, the mobile terminal system type, and the token version number to perform mac verification, and obtain a mac check code;
  • the obtained terminal port number is 1843
  • the preset online activation request type obtained is 6, that is, "reqtype”: “6”
  • the obtained token identification code is 57987117827971672588, that is, “udid”: "57987117827971672588”
  • the obtained token version number is 2.5, that is, app_version”:"2.5”
  • the system type function is called to obtain the obtained mobile terminal system.
  • the type is Android, the mobile terminal system type is set to 1 (if it is an IOS system, the mobile terminal system type is set to 2), that is, "os”: "1"; the calculated mac check code is e5326079df79129b8bd599301a1b9efb360b0cc6;
  • the second activation request generated according to the preset domain name, the enterprise identity, the activation request ID, and the terminal port number is:
  • Step 121 The mobile terminal token sends the second activation request to the cloud authentication server through the network data link.
  • Step 122 After receiving the second activation request data, the cloud authentication server obtains the activation request ID from the second activation request, and determines whether the activation request ID is correct and valid. If yes, step 123 is performed; otherwise, an error is reported;
  • the activation request ID is correct and valid, specifically: determining whether the activation request ID is the same as the activation request ID saved in the server storage area, and if so, the activation request ID is correct, otherwise the activation request ID is incorrect. And determining whether the difference between the server system time and the system time saved in the server storage area is within a preset range (preferably 120s), and if so, the activation request ID is valid, otherwise the received activation request ID is invalid, and the server is deleted. Activation request ID in the storage area;
  • the method further includes: the cloud authentication server acquires the token identification code and the mobile terminal system type from the second activation request data, and obtains the saved terminal device identification code and the mobile terminal system from the server storage area according to the activation request ID. Type, determine whether it matches, if yes, execute step 123, otherwise report an error and end;
  • Step 123 The cloud authentication server generates a token serial number according to the token serial number generation method, associates the token serial number with the user name, and saves the file to the server storage area.
  • the cloud authentication server determines whether the reactivation identifier can be obtained from the first activation request. If yes, the token sequence number does not need to be regenerated, and step 124 is performed. Otherwise, the process is performed. Step 123;
  • the OTP cloud authentication center generates a token serial number having a length of 10 bits according to the generation order of the token serial number, and may also perform: preset operation on the user name. , generating a token serial number;
  • the token serial number generating method is specifically: generating a token serial number in the order of increasing from 1 to 0000000001 according to the generating sequence of the token serial number;
  • the activated token serial number is 1000000009
  • the token serial number generated this time is 1000000010
  • Step 124 The cloud authentication server invokes a random number generation function to generate a second random number, and uses the second random number as a seed generation factor.
  • the OTP cloud authentication center invokes a random number generation function, Random.nextInt(10), to generate a second random number having a length of 10 decimal digits as a seed generation factor;
  • the second random number generated by the cloud authentication server that is, the seed generation factor is 30750849669824758444;
  • Step 125 The cloud authentication server applies a preset derivation algorithm, and derives a seed generation factor to obtain a server seed key.
  • the cloud authentication server applies the PBKDF2 derivation algorithm to obtain a 20-byte server seed key, and may also be a BF derivation algorithm or the like;
  • the second random number generated by the cloud authentication server that is, the seed generation factor is 6595781253;
  • the resulting server seed key is:
  • Step 126 The cloud authentication server obtains the corresponding enterprise key according to the user name, encrypts the server seed key by using the enterprise key, obtains the encrypted server seed key, associates the encrypted server seed key with the user name, and saves the file to the server.
  • the cloud authentication server obtains the corresponding enterprise key according to the user name, encrypts the server seed key by using the enterprise key, obtains the encrypted server seed key, associates the encrypted server seed key with the user name, and saves the file to the server.
  • the storage area In the storage area;
  • the cloud authentication server encrypts the server seed key by using a preset encryption algorithm according to the token serial number, obtains a binary encryption server seed key, and then performs Base64 conversion on the binary encryption server seed key to obtain a string.
  • the preset encryption algorithm is a 3DES algorithm, and in addition, it may be an SM3, an RSA algorithm, or the like;
  • the enterprise key obtained by the cloud authentication server is:
  • the application server key is encrypted by applying the enterprise key and the encrypted server seed key obtained after the conversion is:
  • the process of generating the enterprise key stored in the cloud authentication server is as follows:
  • Step 1 The key operation and maintenance platform receives the administrator key of the key holder
  • Step 2 The key operation and maintenance platform performs a preset operation on the administrator key to obtain a master key, and saves the master key to the storage area.
  • Step 3 The cloud authentication server periodically obtains the master key from the key operation and maintenance platform, and determines whether the obtained master key is the same as the master key stored in the server storage area. If yes, execute step 4, otherwise update the server storage. The master key in the zone, go to step 4;
  • the cloud authentication server preferably sends a request for obtaining the master key to the key operation and maintenance platform every 2 minutes, and receives the current master returned by the key operation and maintenance platform.
  • Step 4 The cloud authentication server obtains the corresponding enterprise ID according to the user name, hashes the master key and the enterprise ID, obtains the enterprise key, and saves the enterprise key to the server storage area.
  • the enterprise ID is an enterprise ID randomly assigned by the cloud authentication management platform to the enterprise when the administrator registers, and is associated with multiple user names and saved in the server storage area;
  • the server seed key is encrypted by using the enterprise ID, when a server seed key is cracked, the server seed key of other enterprises cannot be simultaneously cracked, and the security is better;
  • Step 127 The cloud authentication server applies a preset composition manner according to the token serial number and the seed generation factor to generate a second activation response.
  • the cloud authentication server encrypts the seed generation factor according to the token identification code to obtain an encrypted seed generation factor.
  • the step further includes: obtaining, by the cloud authentication server, a password generation algorithm, setting an algorithm ID according to the obtained password generation algorithm, and acquiring a current system time;
  • the encryption seed generation factor obtained by the cloud authentication server is 30750849669824758444; if the obtained password generation algorithm is the SM3 password generation algorithm, the algorithm ID is set to 00 (if the obtained password generation algorithm is the AUTH password generation algorithm, the algorithm is used) The ID is set to 01); mac verification is performed on the online activation request type, the activation request ID, the algorithm ID, the token serial number, the encryption seed generation factor, the user name, the enterprise identifier, and the server system time, and the mac check code is obtained;
  • the cloud authentication server composes the response data according to the online activation request type, the activation request ID, the algorithm ID, the token serial number, the encryption seed generation factor, the user name, the enterprise identifier, the server system time, and the mac check code.
  • the negotiation key encrypts the response data to obtain a second activation response;
  • the generated response data is
  • the second activation response obtained by encrypting the response data by applying the preset negotiation key is:
  • Step 128 The cloud authentication server sends a second activation response to the mobile terminal token through the network data link.
  • Step 129 The mobile terminal token obtains a seed generation factor and a token serial number from the second activation response.
  • the step specifically includes: the mobile terminal token applies a preset negotiation key to decrypt the second activation response data, obtains response data, and obtains a seed generation factor and a token serial number from the response data;
  • the mobile terminal token obtains the encrypted seed generation factor from the second activation response, and applies the token identification code to decrypt the encrypted seed generation factor to obtain a seed generation factor.
  • the mobile terminal token obtains the activation request ID from the second activation response, and determines whether the activation request ID is the same as the activation request ID saved in the token. If yes, step 129 is performed; otherwise, the error is reported;
  • Step 130 The mobile terminal token applies a preset derivation algorithm to derive a seed generation factor to obtain a token seed key.
  • the mobile terminal token is used to derive the seed generation factor, and the obtained token seed key is FB80ECDA5EDF464CF7715EE66A25ED079122D429;
  • Step 131 The mobile terminal token generates a dynamic password according to the token seed key, and applies the token serial number to encrypt the token seed key to obtain an encrypted token seed key, and the encrypted token seed key and the token are obtained.
  • the serial number is saved to the token storage area;
  • the step further includes: the mobile terminal token acquires an algorithm ID from the second activation response, acquires a corresponding password generation algorithm according to the algorithm ID, acquires a server system time from the second activation response, and calculates a time with the mobile terminal according to the server system time.
  • the drift value is calculated according to the drift value application selected password generation algorithm to calculate the token seed key and the built-in dynamic factor to generate a dynamic password;
  • the corresponding password generation algorithm obtained according to the algorithm ID is an OATH time type algorithm, and in addition, the national secret time type algorithm SM3 algorithm may be generated, and the generated dynamic password is 179059;
  • Step 132 The mobile terminal token generates a third activation request according to the dynamic password, the token serial number, and the activation request ID.
  • the mobile terminal token generates a third activation request according to the preset online activation request type, the activation request ID, the activation success or failure result, the token version number, the token serial number, and the dynamic password.
  • the generated third activation request is:
  • each token program corresponds to a token serial number
  • the mobile terminal token sends the token serial number to the cloud authentication server
  • the cloud authentication server obtains All the information corresponding to the token serial number, in addition to which the token serial number may not be sent, the cloud authentication server acquires all the corresponding information according to the activation request ID;
  • Step 133 The mobile terminal token sends a third activation request to the cloud authentication server through the network data link.
  • Step 134 After receiving the third activation request, the cloud authentication server obtains the activation request ID from the third activation request, and determines whether the activation request ID is correct. If yes, step 135 is performed; otherwise, an error is reported, and the process ends;
  • the cloud authentication server determines whether the activation request ID is the same as the activation request ID saved in the server storage area. If yes, the activation request ID is correct, otherwise the activation request ID is incorrect.
  • Step 135 The cloud authentication server obtains the encryption server seed key and the enterprise key, decrypts the encryption server seed key by using the enterprise key, obtains the server seed key, and generates a dynamic password according to the server seed key.
  • the cloud authentication server obtains the corresponding encrypted seed server key according to the username ft:
  • the obtained enterprise key is:
  • the generated dynamic password is 179059;
  • Step 136 The cloud authentication server determines whether the generated dynamic password and the dynamic password in the third activation request match, and if so, step 138 is performed, otherwise step 137 is performed;
  • Step 137 The cloud authentication server generates a third activation response that fails to be activated, and performs step 139;
  • Step 138 The cloud authentication server generates a third activation response that is successfully activated, and performs step 139;
  • the cloud authentication server acquires a preset online activation result type and an activation time according to a preset online activation type, Activating the request ID, the activation success result, and the activation time to generate a third activation response;
  • the third activation response of the cloud authentication server to generate a successful activation is:
  • the step further includes: the cloud authentication server acquires the current system time, and saves the current system time as the last activation time;
  • Step 139 The cloud authentication server sends a third activation response to the mobile terminal token through the network data link.
  • Step 140 After receiving the third activation response, the mobile terminal token determines the third activation response. If the activation is successful, the activation is completed and ends. If the response is a failure, the encrypted token seed key is deleted, and the activation fails. End;
  • the method when the activation fails, the method further includes: displaying activation failure information; and when the activation is completed, the method further includes: the mobile terminal token displays activation success information.
  • the working method of the cloud authentication server in the system for activating the mobile terminal token in the second embodiment of the present invention includes:
  • Step 201 The cloud authentication server receives the first activation request from the cloud authentication management platform, generates a first activation response according to the first activation request, and transmits the first activation response to the mobile terminal token.
  • generating the first activation response according to the first activation request, and transmitting the first activation response to the mobile terminal token specifically includes:
  • Step T1-1 The cloud authentication server obtains the username from the first activation request.
  • Step T1-2 The cloud authentication server obtains a corresponding preset prefix identifier, a preset domain name, and an enterprise identifier according to the user name.
  • Step T1-3 The cloud authentication server generates a first activation response according to the user name, the preset prefix identifier, the preset domain name, and the enterprise identifier, and transmits the first activation response to the mobile terminal token through the cloud authentication management platform and the terminal;
  • Step 202 The cloud authentication server receives the second activation request sent by the mobile terminal token, generates a token sequence number and a seed generation factor, generates a server seed key according to the seed generation factor, and saves the token serial number and the server seed key.
  • the cloud authentication server determines whether the reactivation identifier can be obtained from the first activation request, and if yes, records the reactivation identifier, and performs step 202; otherwise, step 202 is directly performed;
  • the step specifically includes: the cloud authentication server receives the first activation request sent by the mobile terminal token, determines whether the reactivation identifier is recorded, and if yes, generates a seed generation factor, generates a server seed key according to the seed generation factor, and saves, otherwise Generating a token serial number and a seed generation factor, generating a server seed key according to the seed generation factor, and saving the token serial number and the server seed key;
  • this step further includes:
  • Step T2-1 The cloud authentication server receives the second activation request sent by the mobile terminal token, invokes a random number generation function, generates a second random number as a seed generation factor, and generates an order according to the token serial number generation algorithm.
  • Step T2-2 The cloud authentication server applies a preset derivation algorithm, and derives a seed generation factor to obtain a server seed key.
  • Step T2-3 The cloud authentication server obtains the enterprise key, encrypts the server seed key by using the enterprise key, obtains the encrypted server seed key, and saves the same;
  • Step 203 The cloud authentication server generates a second activation response according to the token serial number and the seed generation factor, and returns the data to the mobile terminal token through the network data link.
  • the second activation response is generated according to the token serial number and the seed generation factor, where the cloud authentication server obtains the saved token identification code, and encrypts the seed generation factor according to the token identification code. Obtaining an encryption seed generation factor, and generating a second activation response according to the token identification code and the encryption seed generation factor;
  • Step 204 The cloud authentication server receives the third activation request sent by the mobile terminal token, obtains the dynamic password from the third activation request, and obtains the saved server seed key, and calculates the server seed key to generate a dynamic password.
  • the server seed key is calculated to generate a dynamic password, which is specifically:
  • Step T4-1 The cloud authentication server acquires the corresponding enterprise key and the encryption server seed key.
  • Step T4-2 The cloud authentication server decrypts the encryption server seed key by using a preset decryption algorithm according to the enterprise key, to obtain a server seed key.
  • Step T4-3 The cloud authentication server applies a password generation algorithm, calculates a server seed key and a built-in dynamic factor, and generates a dynamic password.
  • Step 205 The cloud authentication server determines whether the generated dynamic password matches the obtained dynamic password, and if yes, performs step 206, otherwise generates a third activation response that fails to be activated, and returns to the mobile terminal token through the network data link. ,End;
  • Step 206 The cloud authentication server generates a third activation response that is successfully activated and returns to the mobile terminal token through the network data link, and the activation succeeds.
  • Embodiment 3 of the present invention provides a working method for a mobile terminal token in a system for activating a mobile terminal token online, as shown in FIG. 5, including:
  • Step 301 The mobile terminal token receives the first activation response from the cloud authentication server, accesses the cloud authentication server according to the first activation response, establishes a network data link with the cloud authentication server, and generates a second activation request according to the first activation response. Send to the cloud authentication server through the network data link;
  • the cloud authentication server is accessed according to the first activation response, and the network data link is established with the cloud authentication server.
  • the mobile terminal token obtains the preset domain name and the enterprise identifier from the first activation response, and obtains the terminal.
  • the port number is obtained according to the preset domain name, the enterprise identifier, and the terminal port number, and the cloud authentication server is accessed through the activation URL to establish a network data link with the cloud authentication server.
  • Receiving, by the mobile terminal token, the first activation response from the cloud authentication server specifically: receiving the two-dimensional code picture generated by the first activation response, parsing the two-dimensional code picture, obtaining the first activation response or starting the receiving data mechanism, when detecting Receiving the first activation response when the received data includes a preset prefix identifier;
  • the mobile terminal token acquires the saved token identification code and the token version number, and invokes the acquiring system type function to obtain the mobile terminal system type, according to the token identification code, The token version number and the mobile terminal system type generate a second activation request;
  • Step 302 The mobile terminal token receives the second activation response sent by the cloud authentication server, obtains the seed generation factor and the token serial number from the second activation response, generates a token seed key according to the seed generation factor, and saves the token serial number. And token seed key;
  • This step is specifically as follows:
  • Step X2-1 The mobile terminal token receives the second activation response sent by the cloud authentication server, and obtains the seed generation factor and the token serial number from the second activation response.
  • Step X2-2 The mobile terminal token generates a token seed key according to the seed generation factor
  • Step X2-3 the mobile terminal token applies the token serial number to encrypt the token seed key, obtains the encrypted token seed key, and saves the encrypted token seed key and the token serial number;
  • Step 303 The mobile terminal token calculates the token seed key, generates a dynamic password, generates a third activation request according to the dynamic password, and sends the third activation request to the cloud authentication server through the network data link.
  • the token seed key is calculated to generate a dynamic password, which is specifically:
  • Step X3-1 The mobile terminal token applies the token serial number to decrypt the encrypted token seed key to obtain a token seed key.
  • Step X3-2 The mobile terminal token applies a password generation algorithm, and calculates a token seed key and a built-in dynamic factor to generate a dynamic password.
  • Step 304 The mobile terminal token receives the third activation response returned by the cloud authentication server, determines the third activation response, and if it is a failure response, deletes the token seed key, the activation fails, and ends. If the response is successful, the activation succeeds. ,End.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种在线激活移动终端令牌的设备和系统的工作方法，属于信息安全领域，应用于包括云认证管理平台、云认证服务器、终端、移动终端令牌组成的系统中，所述方法包括：云认证服务器根据云认证管理平台发送的第一激活请求，生成第一激活响应并发送至云认证管理平台，云认证管理平台将第一激活响应发送至终端进行显示，当移动终端令牌获取到第一激活响应后，访问云认证服务器，并建立网络数据链路，移动终端令牌与云认证服务器通过该网络数据链路发送数据进行激活。本发明能够实现在移动终端令牌激活过程中，通过移动终端令牌与云认证服务器之间的安全交互，实现移动终端令牌的激活，提升激活过程的安全性。

Description

一种在线激活移动终端令牌的设备和系统的工作方法 技术领域
本发明涉及一种在线激活移动终端令牌的设备和系统的工作方法，属于信息安全技术领域，尤其应用于包括云认证管理平台、云认证服务器、终端、移动终端令牌组成的系统中。
背景技术
移动终端令牌，全称动态密码移动终端令牌，是用来生成动态口令的移动终端软件，移动终端令牌是由运行在移动终端上的程序产生动态口令，动态口令与移动终端绑定进行身份认证，口令的生成过程不产生通信及费用，具有使用简单、安全性高、低成本、无需携带额外设备、容易获取、无物流等优势，移动终端令牌是3G时代动态密码身份认证的发展趋势。
OTP云认证中心是基于SaaS模式的身份认证平台，部署在互联网上，为个人、家庭和企业提供可靠的身份认证基础设施，OTP云认证中心为网站提供独立的基于云的OTP服务，通过简单集成，使用免费的移动终端令牌，即可极大的增强网站登录的安全性。
二维码，又称二维条码，它是用特定的几何图形按照一定规律在平米上分布的黑白相间的图形，是所有信息数据的一把钥匙，应用相当广泛。
现有技术中，移动终端令牌在激活过程中，当扫描二维码时，会从二维码中直接获取到敏感信息，安全性低。
发明内容
本发明的目的提供了一种在线激活移动终端令牌的设备和系统的工作方法，其能够实现在移动终端令牌激活过程中，通过移动终端令牌与云认证服务器之间的安全交互，实现移动终端令牌的激活，提升激活过程的安全性。
为此，根据本发明的一个方面，提供了一种在线激活移动终端令牌的系统工作方法，所述方法包括：
步骤S1：所述云认证服务器接收来自所述云认证管理平台的第一激活请求，根据所述第一激活请求生成第一激活响应，并将其返回至所述云认证管理平台；
步骤S2：所述云认证管理平台将所述第一激活响应发送至所述终端；
步骤S3：当所述移动终端令牌从所述终端中获取到所述第一激活响应后，根据所述第一激活响应访问所述云认证服务器，并根据所述第一激活响应生成第二激活请求，将所述第二激活请求发送至所述云认证服务器；
步骤S4：所述云认证服务器接收到所述第二激活请求后，生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥；
步骤S5：所述云认证服务器根据所述令牌序列号和所述种子生成因子生成第二激活响应，并将所述第二激活响应返回给所述移动终端令牌；
步骤S6：所述移动终端令牌从所述第二激活响应中获取所述种子生成因子和所述令牌序列号，根据所述种子生成因子生成令牌种子密钥，保存所述令牌序列号和所述令牌种子密钥；
步骤S7：所述移动终端令牌对所述令牌种子密钥和内置的动态因子进行计算，生成动态口令，根据所述动态口令生成第三激活请求，并将所述第三激活请求发送至所述云认证服务器；
步骤S8：所述云认证服务器从接收到的所述第三激活请求中获取动态口令，并获取保存的服务器种子密钥，对所述服务器种子密钥和内置的动态因子进行计算，生成动态口令，判断生成的动态口令与获取到的动态口令是否匹配，如果是，则执行步骤S10，否则向所述移动终端令牌返回激活失败的第三激活响应，结束；以及
步骤S9：所述云认证服务器生成激活成功的第三激活响应，并将所述第三激活响应返回 至所述移动终端令牌，激活成功。
优选地，所述云认证管理平台与所述云认证服务器设置在同一设备中，或设置在不同的设备中。
优选地，所述步骤S1中，所述根据所述第一激活请求生成第一激活响应，具体包括：所述云认证服务器调用随机数生成函数，生成第一随机数，将所述第一随机数作为激活请求ID并保存，根据所述激活请求ID生成第一激活响应；
所述步骤S3中，所述根据所述第一激活响应生成第二激活请求，具体包括：所述移动终端令牌从所述第一激活响应中获取所述激活请求ID并保存，根据所述激活请求ID生成第二激活请求；
所述步骤S4中，所述接收到所述第二激活请求后还包括：所述云认证服务器从所述第二激活请求中获取所述激活请求ID，判断所述激活请求ID与保存的激活请求ID是否相同，如果是，则继续后续操作，否则报错，结束；
所述步骤S5中，所述根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体包括：所述云认证服务器根据所述令牌序列号、所述种子生成因子和所述激活请求ID生成第二激活响应；
所述步骤S5与步骤S6之间还包括：所述移动终端令牌从第二激活响应中获取激活请求ID，判断激活请求ID与保存的激活请求ID是否相同，如果是，则执行步骤S6，否则报错，结束。
优选地，所述步骤S1中，所述根据所述第一激活请求生成第一激活响应，具体包括：
步骤a1：所述云认证服务器从所述第一激活请求中获取所述用户名；
步骤a2：所述云认证服务器根据所述用户名获取对应的企业标识，根据预设前缀标识、预设域名、所述企业标识和所述激活请求ID生成所述第一激活响应；
所述步骤S3中，所述根据所述第一激活响应访问云认证服务器，具体包括：所述移动终端令牌从所述第一激活响应中获取所述预设域名和所述企业标识，并获取终端端口号，根据所述预设域名、所述企业标识和所述终端端口号得到激活URL，通过所述激活URL访问所述云认证服务器，与所述云认证服务器建立网络数据链路。
优选地，所述步骤S1中，所述生成第一随机数之后还包括：所述云认证服务器获取并记录服务器系统时间；
所述步骤S4还包括：所述云认证服务器获取当前服务器系统时间，判断当前服务器系统时间与记录的所述服务器系统时间的差值是否在预设范围内，如果是，则继续后续操作，否则删除保存的所述激活请求ID。
优选地，所述步骤S3中，所述根据所述第一激活响应生成第二激活请求，具体包括：所述移动终端令牌获取保存的令牌标识码和令牌版本号，并调用获取系统类型函数，获取移动终端系统类型，根据所述令牌标识码、所述令牌版本号和所述移动终端系统类型生成第二激活请求；
所述步骤S4接收到所述第二激活请求后，还包括：所述云认证服务器从所述第二激活请求中获取所述令牌标识码、所述令牌版本号和所述移动终端系统类型，并获取保存的令牌标识码、令牌版本号和移动终端系统类型，判断是否匹配，如果是，则继续后续操作，否则报错，结束。
优选地，所述步骤S5中，所述根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体包括：所述云认证服务器根据所述令牌标识码对所述种子生成因子进行加密，得到加密种子生成因子，根据所述令牌标识码和所述加密种子生成因子生成第二激活响应；
所述步骤S6中，所述从所述第二激活响应中获取所述种子生成因子和所述令牌序列号，具体包括：所述云认证服务器从所述第二激活响应中获取令牌序列号和加密种子生成因子，根据所述令牌标识码对所述加密种子生成因子进行解密，得到种子生成因子。
优选地，所述步骤S1之前还包括：
步骤b1：所述云认证管理平台等待接收管理员选择的需要激活的用户记录；
步骤b2：所述云认证管理平台根据所述用户记录中的用户名，生成所述第一激活请求；
步骤b3：所述云认证管理平台将所述第一激活请求发送给所述云认证服务器。
优选地，所述步骤b1之前还包括：
步骤c0：所述云认证管理平台将验证密码失败次数置为初值；
步骤c1：所述云认证管理平台等待接收管理员输入管理员账号和密码；
步骤c2：所述云认证管理平台判断接收到的管理员输入的管理员账号和密码是否正确，如果是，则执行步骤c1，否则执行步骤c3；
步骤c3：所述云认证管理平台更新验证密码失败次数，判断更新后的验证密码失败次数是否达到预设次数，如果是，则报错，锁定所述云认证管理平台，否则返回步骤c1。
优选地，所述步骤b2之前还包括：所述云认证管理平台接收管理员点击的激活按钮，获取上次激活时间和当前系统时间，判断两者之差是否大于预设时长，如果是，则允许再次激活，执行步骤b2，否则返回已激活响应，结束；
所述步骤b2具体为：所述云认证管理平台根据所述用户记录中的用户名和重新激活标识，生成第一激活请求；
所述步骤S1还包括：所述云认证服务器记录所述重新激活标识；
所述步骤S4具体包括：所述云认证服务器判断是否记录有重新激活标识，如果是，则生成种子生成因子，否则生成令牌序列号和种子生成因子。
优选地，所述步骤S9还包括：获取当前系统时间，将当前系统时间作为上次激活时间保存。
优选地，所述步骤S2具体包括：
步骤S2-1：所述云认证管理平台接收到所述第一激活响应后，根据所述第一激活响应生成二维码图片；
步骤S2-2：所述云认证管理平台获取对应的邮箱账号，根据所述邮箱账号将所述二维码图片通过邮件方式发送至移动终端；
步骤S2-3：所述终端显示接收到的所述二维码图片；
所述步骤S3中，所述移动终端令牌获取到所述第一激活响应，具体为：所述移动终端接收对所述二维码图片的扫描，解析所述二维码图片，得到所述第一激活响应。
优选地，所述步骤S2具体包括：所述云认证管理平台获取终端号码，根据所述终端号码将所述第一激活响应通过短信方式发送至所述终端号码对应的终端；
所述步骤S3中，所述移动终端令牌获取到所述第一激活响应，具体为：所述移动终端令牌开启接收数据机制，接收所述第一激活响应。
优选地，所述步骤S4具体包括：
步骤d1：所述云认证服务器调用随机数生成函数，生成第二随机数，作为种子生成因子，并根据令牌序列号生成算法，产生一个令牌序列号并保存；
步骤d2：所述云认证服务器应用预设推导算法，对所述种子生成因子进行推导，得到服务器种子密钥；
步骤d3：所述云认证服务器获取企业密钥，应用所述企业密钥对所述服务器种子密钥进行加密，得到加密服务器种子密钥并保存。
优选地，所述步骤S8中，所述获取保存的服务器种子密钥，对所述服务器种子密钥进行计算，生成动态口令，具体为：
步骤e1：所述云认证服务器获取对应的所述企业密钥和所述加密服务器种子密钥；
步骤e2：所述云认证服务器根据所述企业密钥，应用预设解密算法对所述加密服务器种子密钥进行解密，得到服务器种子密钥；
步骤e3：所述云认证服务器应用口令生成算法，对所述服务器种子密钥和内置的动态因子进行计算，生成动态口令。
优选地，所述获取对应的所述企业密钥，之前还包括：
步骤f1：密钥运维平台接收密钥持有者的管理员密钥；
步骤f2：所述密钥运维平台对所述管理员密钥进行预设运算，得到主密钥，将所述主密钥保存；
步骤f3：所述云认证服务器定时向所述密钥运维平台获取主密钥，判断获取到的主密钥与保存的主密钥是否相同，如果是，则执行步骤f4，否则用获取到的主密钥更新保存的主密钥，执行步骤f4；
步骤f4：所述云认证服务器获取对应的企业ID，对所述主密钥和所述企业ID进行散列运算，得到企业密钥，将所述企业密钥保存。
优选地，所述步骤S6具体包括：
步骤S6-1：所述移动终端令牌从所述第二激活响应中获取种子生成因子和所述令牌序列号；
步骤S6-2：所述移动终端令牌根据所述种子生成因子生成令牌种子密钥；
步骤S6-3：所述移动终端令牌应用所述令牌序列号对所述令牌种子密钥进行加密，得到加密令牌种子密钥，将所述加密令牌种子密钥和所述令牌序列号保存。
优选地，所述步骤S7中，所述对所述令牌种子密钥进行计算，生成动态口令，具体为：
步骤S7-1：所述移动终端令牌应用所述令牌序列号对所述加密令牌种子密钥进行解密，得到令牌种子密钥；
步骤S7-2：所述移动终端令牌应用口令生成算法，对所述令牌种子密钥和内置的动态因子进行计算，生成动态口令。
优选地，所述步骤S9之后还包括：所述移动终端令牌接收到所述第三激活响应后，判断所述第三激活响应，如果是激活成功响应，则激活成功，结束，如果是激活失败响应，则删除所述令牌种子密钥，激活失败，结束。
根据本发明的另外一个方面，提供了一种在线激活移动终端令牌的系统中云认证服务器的工作方法，包括：
步骤T1：所述云认证服务器接收来自云认证管理平台的第一激活请求，根据所述第一激活请求生成第一激活响应，并将所述第一激活响应传送至移动终端令牌；
步骤T2：所述云认证服务器接收所述移动终端令牌发送的第二激活请求，生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥；
步骤T3：所述云认证服务器根据所述令牌序列号和所述种子生成因子生成第二激活响应，并通过所述网络数据链路返回给所述移动终端令牌；
步骤T4：所述云认证服务器接收移动终端令牌发送的第三激活请求，从所述第三激活请求中获取动态口令，并获取保存的服务器种子密钥，对所述服务器种子密钥进行计算，生成动态口令；
步骤T5：所述云认证服务器判断生成的动态口令与获取到的动态口令是否匹配，如果是，则执行步骤T6，否则向所述移动终端令牌返回激活失败的第三激活响应，结束；
步骤T6：所述云认证服务器生成激活成功的第三激活响应并通过所述网络数据链路返回至所述移动终端令牌，激活成功。
优选地，所述步骤T1中，所述根据所述第一激活请求生成第一激活响应，并将所述第一激活响应传送至移动终端令牌，具体包括：
步骤T1-1：所述云认证服务器从所述第一激活请求中获取用户名；
步骤T1-2：所述云认证服务器根据所述用户名获取对应的预设前缀标识、预设域名和企业标识；
步骤T1-3：所述云认证服务器根据所述用户名、所述预设前缀标识、所述预设域名和所述企业标识生成第一激活响应，并将所述第一激活响应通过云认证管理平台和终端传送至所 述移动终端令牌。
优选地，所述步骤T2之前还包括：所述云认证服务器判断从所述第一激活请求中是否能够获取到重新激活标识，如果是，则记录所述重新激活标识，执行步骤T2，否则直接执行步骤T2；
所述步骤T2具体包括：所述云认证服务器接收所述移动终端令牌发送的第二激活请求，判断是否记录有所述重新激活标识，如果是，则生成种子生成因子，根据所述种子生成因子生成服务器种子密钥并保存，否则生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥。
优选地，所述步骤T2具体为：
步骤T2-1：所述云认证服务器接收到移动终端令牌发送的第二激活请求，调用随机数生成函数，生成第二随机数，作为种子生成因子，并根据令牌序列号生成算法，产生一个令牌序列号并保存；
步骤T2-2：所述云认证服务器应用预设推导算法，对所述种子生成因子进行推导，得到服务器种子密钥；
步骤T2-3：所述云认证服务器获取企业密钥，应用所述企业密钥对所述服务器种子密钥进行加密，得到加密服务器种子密钥并保存。
优选地，所述步骤T4中，所述获取保存的服务器种子密钥，对所述服务器种子密钥进行计算，生成动态口令，具体为：
步骤T4-1：所述云认证服务器获取对应的所述企业密钥和所述加密服务器种子密钥；
步骤T4-2：所述云认证服务器根据所述企业密钥，应用预设解密算法对所述加密服务器种子密钥进行解密，得到服务器种子密钥；
步骤T4-3：所述云认证服务器应用口令生成算法，对所述服务器种子密钥和内置的动态因子进行计算，生成动态口令。
优选地，所述步骤T3中，所述根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体为：所述云认证服务器获取保存的令牌标识码，根据所述令牌标识码对所述种子生成因子进行加密，得到加密种子生成因子，根据所述令牌标识码和所述加密种子生成因子生成第二激活响应。
根据本发明的另外一个方面，提供了一种在线激活移动终端令牌的系统中移动终端令牌的工作方法，包括：
步骤X1：所述移动终端令牌接收来自云认证服务器的第一激活响应，根据所述第一激活响应访问所述云认证服务器，与所述云认证服务器建立网络数据链路，并根据所述第一激活响应生成第二激活请求，通过所述网络数据链路发送至所述云认证服务器；
步骤X2：所述移动终端令牌接收云认证服务器发送的第二激活响应，从所述第二激活响应中获取种子生成因子和令牌序列号，根据所述种子生成因子生成令牌种子密钥，保存所述令牌序列号和所述令牌种子密钥；
步骤X3：所述移动终端令牌对所述令牌种子密钥进行计算，生成动态口令，根据所述动态口令生成第三激活请求，并通过所述网络数据链路发送至所述云认证服务器；
步骤X4：所述移动终端令牌接收所述云认证服务器返回的第三激活响应，判断所述第三激活响应，如果是失败响应，则删除所述令牌种子密钥，激活失败，结束，如果为成功响应，则激活成功，结束。
优选地，所述步骤X1中，所述根据所述第一激活响应访问所述云认证服务器，与所述云认证服务器建立网络数据链路，具体为：所述移动终端令牌从所述第一激活响应中获取预设域名和企业标识，并获取终端端口号，根据所述预设域名、所述企业标识和所述终端端口号得到激活URL，通过所述激活URL访问所述云认证服务器，与所述云认证服务器建立网络数据链路。
优选地，所述步骤X1中，所述移动终端令牌接收来自云认证服务器的第一激活响应， 具体为：所述移动终端接收由第一激活响应生成的二维码图片，解析所述二维码图片，得到所述第一激活响应。
优选地，所述步骤X1中，所述移动终端令牌接收来自云认证服务器的第一激活响应，具体为：所述移动终端令牌开启接收数据机制，当检测接收的数据包含预设前缀标识时，接收所述第一激活响应。
优选地，所述根据所述第一激活响应生成第二激活请求，具体为：所述移动终端令牌获取保存的令牌标识码和令牌版本号，并调用获取系统类型函数，获取移动终端系统类型，根据所述令牌标识码、所述令牌版本号和所述移动终端系统类型生成第二激活请求。
优选地，所述步骤X2具体为：
步骤X2-1：所述移动终端令牌接收云认证服务器发送的第二激活响应，从所述第二激活响应中获取种子生成因子和所述令牌序列号；
步骤X2-2：所述移动终端令牌根据所述种子生成因子生成令牌种子密钥；
步骤X2-3：所述移动终端令牌应用所述令牌序列号对所述令牌种子密钥进行加密，得到加密令牌种子密钥，将所述加密令牌种子密钥和所述令牌序列号保存。
优选地，所述步骤X3中，所述对所述令牌种子密钥进行计算，生成动态口令，具体为：
步骤X3-1：所述移动终端令牌应用所述令牌序列号对所述加密令牌种子密钥进行解密，得到令牌种子密钥；
步骤X3-2：所述移动终端令牌应用口令生成算法，对所述令牌种子密钥和内置的动态因子进行计算，生成动态口令。
根据本发明，能够实现在移动终端令牌激活过程中，通过移动终端令牌与云认证服务器之间的安全交互，实现移动终端令牌的激活，提升激活过程的安全性。
附图说明
图1、图2和图3为根据本发明实施例1的一种在线激活移动终端令牌的系统工作方法流程图；
图4是根据本发明实施例2的一种在线激活移动终端令牌的系统中云认证服务器的工作方法流程图；
图5是根据本发明实施例3的一种在线激活移动终端令牌的系统中移动终端令牌的工作方法流程图。
具体实施方式
下面将结合附图，对本发明进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明应用于包括云认证管理平台、云认证服务器、终端、移动终端令牌组成的系统中，其中，当采用二维码验证方法时，终端具体为pc机、ipad、手机(非装载所述移动终端令牌的终端设备)等能够接收邮件的终端设备，当采用短信验证方式时，终端具体为装载有所述移动终端令牌且能够接收短信的终端设备，如手机等。
本发明中，服务器种子密钥和令牌种子密钥可以为加密存储也可以直接存储，实施例1是以保存加密服务器种子密钥和加密令牌种子密钥的方式实现，实施例2和实施例3是以直接保存服务器种子密钥和令牌种子密钥的方式实现，其中对种子密钥进行加密的方式可以各设备单独使用，即服务器种子密钥直接保存，令牌种子密钥加密保存等。
实施例1
本发明实施例1提供了一种在线激活移动终端令牌的系统工作方法，如图1、图2和图3所示，包括：
步骤101：云认证管理平台接收管理员选择的需要激活的用户记录，根据用户记录，判断是否能够获取对应的移动终端号码、邮箱账号、用户名，如果是，则执行步骤102，否则提示信息不完整，结束；
本实施例1中，还包括：判断是否能够获取到对应的令牌标识码、移动终端系统版本，如果是，则执行步骤103，否则提示信息不完整，结束；
其中，云认证管理平台在用户注册时，要求用户输入令牌标识码和移动终端系统版本；
例如，云认证管理平台接收到管理员选择的用户记录为：
用户名：abc
用户邮箱：123456789@163.com
移动终端号：18912345678
令牌标识码：57987117827971672588
移动终端系统版本：1
进一步地，本实施例中，步骤101之前还包括：
A：云认证管理平台等待接收管理员输入管理员账号和密码；
B：云认证管理平台判断接收到的管理员输入的管理员账号和密码是否正确，如果是，则执行步骤101，否则执行C；
C：云认证管理平台更新验证密码失败次数，判断更新后的验证密码失败次数是否达到预设次数，如果是，则报错，锁定云认证管理平台，否则返回A；
进一步地，管理员认证方式可预先进行配置，即可采用验证账号密码方式，也可配置为双因素认证；
其中，双因素认证过程为：先进行账号密码验证，当账号密码匹配时，显示获取短信口令按钮和短信口令输入框，当管理员点击获取短信口令按钮后，等待管理员输入短信口令，当接收到短信口令后，判断短信口令是否正确，如果是，则登录成功，执行步骤103，否则累计短信口令验证次数，当达到预设次数(优选为10次)时，暂时锁定云认证管理平台，间隔预设时长(优选为30分钟)自动解锁；
步骤102：云认证管理平台根据用户记录中的用户名，生成第一激活请求；
本步骤之前还包括：
步骤102-1：云认证管理平台接收管理员点击的激活按钮；
步骤102-2：云认证管理平台判断是否能够获取到上次激活时间，如果是，则执行步骤102-3，否则执行步骤102；
步骤102-3：云认证管理平台获取当前系统时间，判断当前系统时间和上次激活时间之差是否大于预设时长，如果是，则执行步骤102-4，否则返回不可重复激活响应，结束；
步骤102-4：云认证管理平台根据用户名和重新激活标识生成第一激活请求，执行步骤103；
步骤103：云认证管理平台将第一激活请求发送给云认证服务器；
步骤104：云认证服务器接收到第一激活请求后，从第一激活请求中获取用户名；
步骤105：云认证服务器调用随机数生成函数，生成第一随机数，将第一随机数作为激活请求ID，将激活请求ID与用户名建立关联并保存至服务器存储区中；
本实施例1中，优选地，为了保证安全，要求二维码图片只能在预定时间内有效，因此，云认证服务器生成激活请求ID后，将激活请求ID保存至服务器存储区中，并记录服务器系统时间；
例如，生成的激活请求ID为fasdcvxvdsafdsfzcxcsdfsdafcxz，记录服务器系统时间为1417502570；
步骤106：云认证服务器根据用户名获取对应的企业标识，根据预设前缀标识、预设域名、企业标识和激活请求ID生成第一激活响应；
本实施例1中，预设前缀标识为yunxin://，预设域名为：api-6位企业标识.cloudentify.com；
生成的第一激活响应为：
yunxin://api-6位企业标识.cloudentify.com？reqid＝激活请求ID；
例如，云认证服务器根据预设前缀标识yunxin://、获取到的企业标识dfserv，预设域名api-6位企业标识.cloudentify.com和激活请求IDfasdcvxvdsafdsfzcxcsdfsdafcxz；
生成的第一激活响应为：
yunxin://api-dfserv.cloudentify.com？reqid＝fasdcvxvdsafdsfzcxcsdfsdafcxz；
步骤107：云认证服务器将第一激活响应返回给云认证管理平台；
步骤108：云认证管理平台接收管理员选择的激活方式，如果是邮件激活方式，则执行步骤109，如果是短信激活方式，则执行步骤115：
步骤109：云认证管理平台根据接收到的第一激活响应生成二维码图片；
具体地，云认证管理平台根据第一激活响应调用二维码图片生成函数，生成二维码图片；
步骤110：云认证管理平台从用户记录中获取邮箱账号；
步骤111：云认证管理平台根据邮箱账号将二维码图片通过邮件方式发送至终端；
本步骤中，终端可以为移动设备(如ipad、手机等)或PC机等；
步骤112：终端接收到邮件后，显示邮件中的二维码图片；
步骤113：移动终端令牌等待接收用户扫描二维码图片；
步骤114：当移动终端令牌接收到二维码图片后，根据所述二维码图片得到第一激活响应，执行步骤119；
步骤115：云认证管理平台从用户记录中获取终端号码；
步骤116：云认证管理平台根据终端号码将第一激活响应通过短信方式发送至终端号码对应的终端；
本步骤中，终端指能够接收短信且装置所述移动终端令牌的移动设备，如手机等；
步骤117：终端接收到短信后，显示短信中的第一激活响应；
步骤118：移动终端令牌启动接收数据机制，接收第一激活响应，当检测第一激活请求中包含预设前缀标识时，执行步骤119；
本实施例1中，当移动终端显示短信中的第一激活响应后，移动终端令牌接收用户对第一激活响应的点击触发并启动接收数据机制，若检测到接收的第一激活响应中包含预设前缀标识时，执行步骤119；
步骤119：移动终端令牌从第一激活响应中获取预设域名、企业标识和激活请求ID；
例如，移动终端令牌从第一激活响应中获取到的激活请求ID为fasdcvxvdsafdsfzcxcsdfsdafcxz；
步骤120：移动终端令牌获取终端端口号，根据预设域名、企业标识和终端端口号得到激活URL，通过激活URL访问云认证服务器，与云认证服务器建立网络数据链路，并根据激活请求ID生成第二激活请求；
例如，移动终端令牌获取到的终端端口号为1843，预设域名和企业标识api-dfserv.cloudentify.com；
得到的激活URL为：api-dfserv.cloudentify.com：1843；通过该激活URL访问云认证服务器，与云认证服务器建立网络数据链路，具体为TCP连接，传输数据优选采用JSON数据格式；
本实施例1中，本步骤还包括：移动终端令牌获取预设在线激活请求类型，获取保存的令牌标识码和令牌版本号、调用获取系统类型函数，获取移动终端系统类型，然后对预设在线激活请求类型、激活请求ID、令牌标识码、移动终端系统类型和令牌版本号进行mac校验，得到mac校验码；
例如，获取的终端端口号为1843，获取到的预设在线激活请求类型为6，即"reqtype":"6"；获取到的令牌标识码为57987117827971672588，即"udid":"57987117827971672588"；获取到的令牌版本号为2.5，即app_version":"2.5"；调用获取系统类型函数，获取到的移动终端系统 类型为安卓系统，则将移动终端系统类型置为1(如果为IOS系统，则将移动终端系统类型置为2)，即"os":"1"；计算得到的mac校验码为e5326079df79129b8bd599301a1b9efb360b0cc6；则根据预设域名、企业标识、激活请求ID和终端端口号生成的第二激活请求为：
{"os":"1","reqid":"fasdcvxvdsafdsfzcxcsdfsdafcxz","reqtype":"6","udid":"57987117827971672588",app_version":"2.5","mac":"e5326079df79129b8bd599301a1b9efb360b0cc6"}；
步骤121：移动终端令牌通过网络数据链路将第二激活请求发送给云认证服务器；
步骤122：云认证服务器接收到第二激活请求数据后，从第二激活请求中获取激活请求ID，判断激活请求ID是否正确且有效，如果是，则执行步骤123，否则报错，结束；
本实施例1中，判断激活请求ID是否正确且有效，具体为：判断激活请求ID与服务器存储区中保存的激活请求ID是否相同，如果是，则激活请求ID正确，否则激活请求ID不正确；且判断服务器系统时间与服务器存储区中保存的系统时间的差值是否在预设范围(优选为120s)内，如果是，则激活请求ID有效，否则接收到的激活请求ID无效，删除服务器存储区中的激活请求ID；
本实施例中，还包括：云认证服务器从第二激活请求数据中获取令牌标识码和移动终端系统类型，并根据激活请求ID从服务器存储区中获取保存的终端设备标识码和移动终端系统类型，判断是否匹配，如果是，则执行步骤123，否则报错，结束；
步骤123：云认证服务器根据令牌序列号生成方法，产生一个令牌序列号，将令牌序列号与用户名建立关联并保存至服务器存储区中；
本实施例1中，本步骤之前还包括：云认证服务器判断是否能够从第一激活请求中获取到重新激活标识，如果是，则不需要再重新生成令牌序列号，执行步骤124，否则执行步骤123；
本实施例1中，优选地，OTP云认证中心根据令牌序列号的生成顺序，生成一个长度为10位的令牌序列号，除此之外，还可以为：对用户名进行预设运算，生成令牌序列号；
其中，优选地，所述令牌序列号生成方法，具体为：根据令牌序列号的生成顺序，按照从0000000001开始每次增加1的顺序产生一个令牌序列号；
例如，已激活的令牌序列号为1000000009，则本次生成的令牌序列号为1000000010；
步骤124：云认证服务器调用随机数生成函数，生成第二随机数，将该第二随机数作为种子生成因子；
本实施例1中，优选地，OTP云认证中心调用随机数生成函数，Random.nextInt(10)，生成长度为10位十进制的第二随机数，作为种子生成因子；
例如，云认证服务器生成的第二随机数，即种子生成因子为30750849669824758444；
步骤125：云认证服务器应用预设推导算法，对种子生成因子进行推导，得到服务器种子密钥；
本实施例1中，优选地，云认证服务器应用PBKDF2推导算法，得到20个字节的服务器种子密钥，除此之外，还可以为BF推导算法等；
例如，云认证服务器生成的第二随机数，即种子生成因子为6595781253；
对种子生成因子进行推导，得到的服务器种子密钥为：
FB80ECDA5EDF464CF7715EE66A25ED079122D429；
步骤126：云认证服务器根据用户名获取对应的企业密钥，应用企业密钥对服务器种子密钥进行加密，得到加密服务器种子密钥，将加密服务器种子密钥与用户名建立关联并保存至服务器存储区中；
具体为：云认证服务器根据令牌序列号，使用预设加密算法对服务器种子密钥进行加密，得到二进制的加密服务器种子密钥，然后对二进制的加密服务器种子密钥进行Base64转换，得到字符串，优选地，预设加密算法为3DES算法，除此之外，还可以为SM3、RSA算法等；
例如，云认证服务器获取到的企业密钥为：
1F3D4E3A12459372B837193177913782；
应用企业密钥对服务器种子密钥加密且转换后得到的加密服务器种子密钥为：
PL96EUSWSdPP2gj8fr6m-YXBpLWE0OTJjN2Q3LmR1b3NlY3VyaXR5LmNvbQ；
本实施例1中，云认证服务器中保存的企业密钥的生成过程如下：
步骤1：密钥运维平台接收密钥持有者的管理员密钥；
其中，为保证管理员密钥的安全性，密钥持有者的管理员密钥需要定期更换；
步骤2：密钥运维平台对管理员密钥进行预设运算，得到主密钥，将主密钥保存至存储区中；
步骤3：云认证服务器定时向密钥运维平台获取主密钥，判断获取到的主密钥与服务器存储区中保存的主密钥是否相同，如果是，则执行步骤4，否则更新服务器存储区中的主密钥，执行步骤4；
本实施例1中，由于管理员密钥需要定期更换，因此优选地，云认证服务器每隔2分钟向密钥运维平台发送获取主密钥的请求，接收密钥运维平台返回的当前主密钥；
步骤4：云认证服务器根据用户名获取对应的企业ID，对主密钥和企业ID进行散列运算，得到企业密钥，将企业密钥保存至服务器存储区中；
其中，企业ID是在管理员注册时，云认证管理平台为该企业随机分配的企业ID，并与多个用户名建立关联并保存至服务器存储区中；
本实施例1中，由于服务器种子密钥是使用企业ID进行加密的，因此当某个服务器种子密钥被破解时，其他企业的服务器种子密钥也不能够被同时破解，安全性更佳；
步骤127：云认证服务器根据令牌序列号和种子生成因子，应用预设组成方式，生成第二激活响应；
本实施例1中，优选地，云认证服务器根据令牌标识码对种子生成因子进行加密，得到加密种子生成因子；
本步骤还包括：云认证服务器获取口令生成算法，根据获取到的口令生成算法，设置算法ID，获取当前系统时间；；
例如，云认证服务器得到的加密种子生成因子为30750849669824758444；获取到的口令生成算法为SM3口令生成算法，则将算法ID设置为00(如果获取到的口令生成算法为AUTH口令生成算法，则将算法ID设置为01)；对在线激活请求类型、激活请求ID、算法ID、令牌序列号、加密种子生成因子、用户名、企业标识和服务器系统时间进行mac校验，得到mac校验码；
进一步地，云认证服务器根据在线激活请求类型、激活请求ID、算法ID、令牌序列号、加密种子生成因子、用户名、企业标识、服务器系统时间和mac校验码组成响应数据，应用预设协商密钥对响应数据进行加密，得到第二激活响应；
例如，生成的响应数据为
{"data":"pushtype":"6","reqid":"fasdcvxvdsafdsfzcxcsdfsdafcxz","algid":"00","token":"1000000010","factor":"30750849669824758444","userid":"abc","compname":"dfserv","time":"1417502589"}；
应用预设协商密钥对响应数据加密后得到的第二激活响应为：
{"data":"591f86917938bb30066991c78f1e2b4c63a125ea90d8800418fa3e07dc2d1187f7c64bac023a34d7dc58dcf7c79e99fccc874de6fba79a0eb50614fe73624d69b95fd92d3cf83c1d2894355e790b2ff6dcce8892ed153681eb478521843eaf6f3a5623236754a7bb0b7d709be74d79cd57a20d4a9af495e9c84918920dc0d1f94d032fd8f2baa4e6d8c230b2802e7777a07e47fef374444b77412890c204fb729e6e10fd7fa658db115c32f713b53e1bbbba92d366c0b69e7b70a87eeb564c51","mac":"f09749aa775b9eb84c0931e7250c95ea84ec901a"}；
步骤128：云认证服务器通过网络数据链路将第二激活响应发送给移动终端令牌；
步骤129：移动终端令牌从第二激活响应中获取种子生成因子和令牌序列号；
本步骤具体包括：移动终端令牌应用预设协商密钥对第二激活响应数据进行解密，得到响应数据，从响应数据中获取种子生成因子和令牌序列号；
本实施例1中，还可以为：移动终端令牌从第二激活响应中获取加密种子生成因子，应用令牌标识码对加密种子生成因子进行解密，得到种子生成因子；
本步骤之前还包括：移动终端令牌从第二激活响应中获取激活请求ID，判断激活请求ID与令牌中保存的激活请求ID是否相同，如果是，则执行步骤129，否则报错，结束；
步骤130：移动终端令牌应用预设推导算法对种子生成因子进行推导，得到令牌种子密钥；
例如，手机移动终端令牌对种子生成因子进行推导，得到的令牌种子密钥为FB80ECDA5EDF464CF7715EE66A25ED079122D429；
步骤131：移动终端令牌根据令牌种子密钥生成动态口令，并应用令牌序列号对令牌种子密钥进行加密，得到加密令牌种子密钥，将加密令牌种子密钥和令牌序列号保存至令牌存储区中；
本步骤，还包括：移动终端令牌从第二激活响应中获取算法ID，根据算法ID获取对应的口令生成算法，从第二激活响应中获取服务器系统时间，根据服务器系统时间计算与移动终端时间的漂移值，根据该漂移值应用选择的口令生成算法对令牌种子密钥和内置的动态因子进行计算，生成动态口令；
例如，根据算法ID获取到对应的口令生成算法为OATH时间型算法，除此之外还可以为国密时间型算法SM3算法等，生成的动态口令为179059；
步骤132：移动终端令牌根据动态口令、令牌序列号和激活请求ID生成第三激活请求；
本实施例1中，优选地，移动终端令牌根据预设在线激活请求类型、激活请求ID、激活成功或失败结果、令牌版本号、令牌序列号和动态口令，生成第三激活请求；
例如，生成的第三激活请求为：
{"result":"1","reqtype":"7","otp":"179059","token":"1000000010","reqid":"fasdcvxvdsafdsfzcxcsdfsdafcxz"}；
本实施例1中，由于一个手机可以安装有多个令牌程序，每个令牌程序对应一个令牌序列号，移动终端令牌将令牌序列号发送至云认证服务器后，云认证服务器获取与该令牌序列号对应的所有信息，除此之外，也可以不上送令牌序列号，则云认证服务器根据激活请求ID获取对应的所有信息；
步骤133：移动终端令牌通过网络数据链路将第三激活请求发送给云认证服务器；
步骤134：云认证服务器接收到第三激活请求后，从第三激活请求中获取激活请求ID，判断激活请求ID是否正确，如果是，则执行步骤135，否则报错，结束；
具体为：云认证服务器判断激活请求ID与服务器存储区中保存的激活请求ID是否相同，如果是，则激活请求ID正确，否则激活请求ID不正确；
步骤135：云认证服务器获取加密服务器种子密钥和企业密钥，应用企业密钥对加密服务器种子密钥进行解密，得到服务器种子密钥，根据服务器种子密钥生成动态口令；
例如，云认证服务器根据用户名ft获取到对应的加密种子服务器密钥为：
PL96EUSWSdPP2gj8fr6m-YXBpLWE0OTJjN2Q3LmR1b3NlY3VyaXR5LmNvbQ；
获取到的企业密钥为：
1F3D4E3A12459372B837193177913782；
解密得到服务器种子密钥为：
FB80ECDA5EDF464CF7715EE66A25ED079122D429；
生成的动态口令为179059；
步骤136：云认证服务器判断生成的动态口令和第三激活请求中的动态口令是否匹配，如果是，则执行步骤138，否则执行步骤137；
步骤137：云认证服务器生成激活失败的第三激活响应，执行步骤139；
步骤138：云认证服务器生成激活成功的第三激活响应，执行步骤139；
具体地，云认证服务器获取预设在线激活结果类型、激活时间，根据预设在线激活类型、 激活请求ID、激活成功结果和激活时间生成第三激活响应；
例如，云认证服务器生成激活成功的第三激活响应为：
{"pushtype":"7","reqid":"fasdcvxvdsafdsfzcxcsdfsdafcxz","result":"1","time":"1417502590"}；
进一步地，本步骤还包括：云认证服务器获取当前系统时间，将当前系统时间作为上次激活时间保存；
步骤139：云认证服务器通过网络数据链路将第三激活响应发送至移动终端令牌；
步骤140：移动终端令牌接收到第三激活响应后，判断第三激活响应，如果是激活成功，则激活完成，结束，如果是失败响应，则将加密令牌种子密钥删除，激活失败，结束；
本步骤中，激活失败时还包括：显示激活失败信息；激活完成时还包括：移动终端令牌显示激活成功信息。
实施例2
本发明实施例2提供的一种在线激活移动终端令牌的系统中云认证服务器的工作方法，如图4所示，包括：
步骤201：云认证服务器接收来自云认证管理平台的第一激活请求，根据第一激活请求生成第一激活响应，并将第一激活响应传送至移动终端令牌；
具体地，根据所述第一激活请求生成第一激活响应，并将第一激活响应传送至移动终端令牌，具体包括：
步骤T1-1：云认证服务器从第一激活请求中获取用户名；
步骤T1-2：云认证服务器根据用户名获取对应的预设前缀标识、预设域名和企业标识；
步骤T1-3：云认证服务器根据用户名、预设前缀标识、预设域名和企业标识生成第一激活响应，并将第一激活响应通过云认证管理平台和终端传送至移动终端令牌；
步骤202：云认证服务器接收移动终端令牌发送的第二激活请求，生成令牌序列号和种子生成因子，根据种子生成因子生成服务器种子密钥，保存令牌序列号与服务器种子密钥；
本步骤之前还包括：云认证服务器判断从第一激活请求中是否能够获取到重新激活标识，如果是，则记录重新激活标识，执行步骤202，否则直接执行步骤202；
本步骤具体包括：云认证服务器接收移动终端令牌发送的第一激活请求，判断是否记录有重新激活标识，如果是，则生成种子生成因子，根据种子生成因子生成服务器种子密钥并保存，否则生成令牌序列号和种子生成因子，根据种子生成因子生成服务器种子密钥，保存令牌序列号与服务器种子密钥；
进一步地，本步骤还包括：
步骤T2-1：云认证服务器接收到移动终端令牌发送的第二激活请求，调用随机数生成函数，生成第二随机数，作为种子生成因子，并根据令牌序列号生成算法，产生一个令牌序列号并保存；
步骤T2-2：云认证服务器应用预设推导算法，对种子生成因子进行推导，得到服务器种子密钥；
步骤T2-3：云认证服务器获取企业密钥，应用企业密钥对服务器种子密钥进行加密，得到加密服务器种子密钥并保存；
步骤203：云认证服务器根据令牌序列号和种子生成因子生成第二激活响应，并通过网络数据链路返回给移动终端令牌；
本实施例2中，根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体为：云认证服务器获取保存的令牌标识码，根据令牌标识码对种子生成因子进行加密，得到加密种子生成因子，根据令牌标识码和加密种子生成因子生成第二激活响应；
步骤204：云认证服务器接收移动终端令牌发送的第三激活请求，从第三激活请求中获取动态口令，并获取保存的服务器种子密钥，对服务器种子密钥进行计算，生成动态口令；
本步骤中，对所述服务器种子密钥进行计算，生成动态口令，具体为：
步骤T4-1：云认证服务器获取对应的企业密钥和加密服务器种子密钥；
步骤T4-2：云认证服务器根据所述企业密钥，应用预设解密算法对加密服务器种子密钥进行解密，得到服务器种子密钥；
步骤T4-3：云认证服务器应用口令生成算法，对服务器种子密钥和内置的动态因子进行计算，生成动态口令。
步骤205：云认证服务器判断生成的动态口令与获取到的动态口令是否匹配，如果是，则执行步骤206，否则生成激活失败的第三激活响应，并通过网络数据链路返回至移动终端令牌，结束；
步骤206：云认证服务器生成激活成功的第三激活响应并通过网络数据链路返回至移动终端令牌，激活成功。
实施例3
本发明实施例3提供了一种在线激活移动终端令牌的系统中移动终端令牌的工作方法，如图5所示，包括：
步骤301：移动终端令牌接收来自云认证服务器的第一激活响应，根据第一激活响应访问云认证服务器，与云认证服务器建立网络数据链路，并根据第一激活响应生成第二激活请求，通过网络数据链路发送至云认证服务器；
本实施例3中，根据第一激活响应访问云认证服务器，与云认证服务器建立网络数据链路，具体为：移动终端令牌从第一激活响应中获取预设域名和企业标识，并获取终端端口号，根据预设域名、企业标识和终端端口号得到激活URL，通过激活URL访问云认证服务器，与云认证服务器建立网络数据链路；
移动终端令牌接收来自云认证服务器的第一激活响应，具体包括：接收由第一激活响应生成的二维码图片，解析二维码图片，得到第一激活响应或开启接收数据机制，当检测接收的数据包含预设前缀标识时，接收第一激活响应；
根据第一激活响应生成第二激活请求，具体为：移动终端令牌获取保存的令牌标识码和令牌版本号，并调用获取系统类型函数，获取移动终端系统类型，根据令牌标识码、令牌版本号和移动终端系统类型生成第二激活请求；
步骤302：移动终端令牌接收云认证服务器发送的第二激活响应，从第二激活响应中获取种子生成因子和令牌序列号，根据种子生成因子生成令牌种子密钥，保存令牌序列号和令牌种子密钥；
本步骤，具体为：
步骤X2-1：移动终端令牌接收云认证服务器发送的第二激活响应，从第二激活响应中获取种子生成因子和所述令牌序列号；
步骤X2-2：移动终端令牌根据种子生成因子生成令牌种子密钥；
步骤X2-3：移动终端令牌应用令牌序列号对令牌种子密钥进行加密，得到加密令牌种子密钥，将加密令牌种子密钥和令牌序列号保存；
步骤303：移动终端令牌对所述令牌种子密钥进行计算，生成动态口令，根据动态口令生成第三激活请求，并通过网络数据链路发送至云认证服务器；
本实施例3中，对令牌种子密钥进行计算，生成动态口令，具体为：
步骤X3-1：移动终端令牌应用令牌序列号对加密令牌种子密钥进行解密，得到令牌种子密钥；
步骤X3-2：移动终端令牌应用口令生成算法，对令牌种子密钥和内置的动态因子进行计算，生成动态口令；
步骤304：移动终端令牌接收云认证服务器返回的第三激活响应，判断第三激活响应，如果是失败响应，则删除令牌种子密钥，激活失败，结束，如果为成功响应，则激活成功，结束。
以上所述，仅为本发明较佳的具体实施方式，但本发明的保护范围并不局限于此，本领域的技术人员在本发明公开的技术范围内，可轻易想到的变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应该以所附权利要求书的为准。

Claims (21)

  1. 一种在线激活移动终端令牌的系统工作方法，其特征在于，所述方法包括：
    步骤S1：所述云认证服务器接收来自所述云认证管理平台的第一激活请求，根据所述第一激活请求生成第一激活响应，并将其返回至所述云认证管理平台；
    步骤S2：所述云认证管理平台将所述第一激活响应发送至所述终端；
    步骤S3：当所述移动终端令牌从所述终端中获取到所述第一激活响应后，根据所述第一激活响应访问所述云认证服务器，并根据所述第一激活响应生成第二激活请求，将所述第二激活请求发送至所述云认证服务器；
    步骤S4：所述云认证服务器接收到所述第二激活请求后，生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥；
    步骤S5：所述云认证服务器根据所述令牌序列号和所述种子生成因子生成第二激活响应，并将所述第二激活响应返回给所述移动终端令牌；
    步骤S6：所述移动终端令牌从所述第二激活响应中获取所述种子生成因子和所述令牌序列号，根据所述种子生成因子生成令牌种子密钥，保存所述令牌序列号和所述令牌种子密钥；
    步骤S7：所述移动终端令牌对所述令牌种子密钥和内置的动态因子进行计算，生成动态口令，根据所述动态口令生成第三激活请求，并将所述第三激活请求发送至所述云认证服务器；
    步骤S8：所述云认证服务器从接收到的所述第三激活请求中获取动态口令，并获取保存的服务器种子密钥，对所述服务器种子密钥和内置的动态因子进行计算，生成动态口令，判断生成的动态口令与获取到的动态口令是否匹配，如果是，则执行步骤S10，否则向所述移动终端令牌返回激活失败的第三激活响应，结束；以及
    步骤S9：所述云认证服务器生成激活成功的第三激活响应，并将所述第三激活响应返回至所述移动终端令牌，激活成功。
  2. 根据权利要求1所述的方法，其特征在于，所述云认证管理平台与所述云认证服务器设置在同一设备中，或设置在不同的设备中。
  3. 根据权利要求1所述的方法，其特征在于，
    所述步骤S1中，所述根据所述第一激活请求生成第一激活响应，具体包括：所述云认证服务器调用随机数生成函数，生成第一随机数，将所述第一随机数作为激活请求ID并保存，根据所述激活请求ID生成第一激活响应；
    所述步骤S3中，所述根据所述第一激活响应生成第二激活请求，具体包括：所述移动终端令牌从所述第一激活响应中获取所述激活请求ID并保存，根据所述激活请求ID生成第二激活请求；
    所述步骤S4中，所述接收到所述第二激活请求后还包括：所述云认证服务器从所述第二激活请求中获取所述激活请求ID，判断所述激活请求ID与保存的激活请求ID是否相同，如果是，则继续后续操作，否则报错，结束；
    所述步骤S5中，所述根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体包括：所述云认证服务器根据所述令牌序列号、所述种子生成因子和所述激活请求ID生成第二激活响应；以及
    所述步骤S5与步骤S6之间还包括：所述移动终端令牌从第二激活响应中获取激活请求ID，判断激活请求ID与保存的激活请求ID是否相同，如果是，则执行步骤S6，否则报错，结束。
  4. 根据权利要求1所述的方法，其特征在于，
    所述步骤S3中，所述根据所述第一激活响应生成第二激活请求，具体包括：所述移动终端令牌获取保存的令牌标识码和令牌版本号，并调用获取系统类型函数，获取移动终端系统 类型，根据所述令牌标识码、所述令牌版本号和所述移动终端系统类型生成第二激活请求；
    所述步骤S4接收到所述第二激活请求后，还包括：所述云认证服务器从所述第二激活请求中获取所述令牌标识码、所述令牌版本号和所述移动终端系统类型，并获取保存的令牌标识码、令牌版本号和移动终端系统类型，判断是否匹配，如果是，则继续后续操作，否则报错，结束。
  5. 根据权利要求1所述的方法，其特征在于，所述步骤S1之前还包括：
    步骤b1：所述云认证管理平台等待接收管理员选择的需要激活的用户记录；
    步骤b2：所述云认证管理平台根据所述用户记录中的用户名，生成所述第一激活请求；
    步骤b3：所述云认证管理平台将所述第一激活请求发送给所述云认证服务器。
  6. 根据权利要求1所述的方法，其特征在于，所述步骤S2具体包括：
    步骤S2-1：所述云认证管理平台接收到所述第一激活响应后，根据所述第一激活响应生成二维码图片；
    步骤S2-2：所述云认证管理平台获取对应的邮箱账号，根据所述邮箱账号将所述二维码图片通过邮件方式发送至移动终端；
    步骤S2-3：所述终端显示接收到的所述二维码图片；
    所述步骤S3中，所述移动终端令牌获取到所述第一激活响应，具体为：所述移动终端接收对所述二维码图片的扫描，解析所述二维码图片，得到所述第一激活响应。
  7. 根据权利要求1所述的方法，其特征在于，
    所述步骤S2具体包括：所述云认证管理平台获取终端号码，根据所述终端号码将所述第一激活响应通过短信方式发送至所述终端号码对应的终端；
    所述步骤S3中，所述移动终端令牌获取到所述第一激活响应，具体为：所述移动终端令牌开启接收数据机制，接收所述第一激活响应。
  8. 根据权利要求1所述的方法，其特征在于，所述步骤S4具体包括：
    步骤d1：所述云认证服务器调用随机数生成函数，生成第二随机数，作为种子生成因子，并根据令牌序列号生成算法，产生一个令牌序列号并保存；
    步骤d2：所述云认证服务器应用预设推导算法，对所述种子生成因子进行推导，得到服务器种子密钥；以及
    步骤d3：所述云认证服务器获取企业密钥，应用所述企业密钥对所述服务器种子密钥进行加密，得到加密服务器种子密钥并保存。
  9. 根据权利要求1所述的方法，其特征在于，所述步骤S6具体包括：
    步骤S6-1：所述移动终端令牌从所述第二激活响应中获取种子生成因子和所述令牌序列号；
    步骤S6-2：所述移动终端令牌根据所述种子生成因子生成令牌种子密钥；以及
    步骤S6-3：所述移动终端令牌应用所述令牌序列号对所述令牌种子密钥进行加密，得到加密令牌种子密钥，将所述加密令牌种子密钥和所述令牌序列号保存。
  10. 根据权利要求9所述的方法，其特征在于，所述步骤S7中，所述对所述令牌种子密钥进行计算，生成动态口令，具体为：
    步骤S7-1：所述移动终端令牌应用所述令牌序列号对所述加密令牌种子密钥进行解密，得到令牌种子密钥；
    步骤S7-2：所述移动终端令牌应用口令生成算法，对所述令牌种子密钥和内置的动态因子进行计算，生成动态口令。
  11. 根据权利要求1所述的方法，其特征在于，所述步骤S9之后还包括：所述移动终端令牌接收到所述第三激活响应后，判断所述第三激活响应，如果是激活成功响应，则激活成功，结束，如果是激活失败响应，则删除所述令牌种子密钥，激活失败，结束。
  12. 一种在线激活移动终端令牌的系统中云认证服务器的工作方法，其特征在于，包括：
    步骤T1：所述云认证服务器接收来自云认证管理平台的第一激活请求，根据所述第一激 活请求生成第一激活响应，并将所述第一激活响应传送至移动终端令牌；
    步骤T2：所述云认证服务器接收所述移动终端令牌发送的第二激活请求，生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥；
    步骤T3：所述云认证服务器根据所述令牌序列号和所述种子生成因子生成第二激活响应，并通过所述网络数据链路返回给所述移动终端令牌；
    步骤T4：所述云认证服务器接收移动终端令牌发送的第三激活请求，从所述第三激活请求中获取动态口令，并获取保存的服务器种子密钥，对所述服务器种子密钥进行计算，生成动态口令；
    步骤T5：所述云认证服务器判断生成的动态口令与获取到的动态口令是否匹配，如果是，则执行步骤T6，否则向所述移动终端令牌返回激活失败的第三激活响应，结束；以及
    步骤T6：所述云认证服务器生成激活成功的第三激活响应并通过所述网络数据链路返回至所述移动终端令牌，激活成功。
  13. 根据权利要求12所述的方法，其特征在于，所述步骤T1中，所述根据所述第一激活请求生成第一激活响应，并将所述第一激活响应传送至移动终端令牌，具体包括：
    步骤T1-1：所述云认证服务器从所述第一激活请求中获取用户名；
    步骤T1-2：所述云认证服务器根据所述用户名获取对应的预设前缀标识、预设域名和企业标识；以及
    步骤T1-3：所述云认证服务器根据所述用户名、所述预设前缀标识、所述预设域名和所述企业标识生成第一激活响应，并将所述第一激活响应通过云认证管理平台和终端传送至所述移动终端令牌。
  14. 根据权利要求12所述的方法，其特征在于，
    所述步骤T2之前还包括：所述云认证服务器判断从所述第一激活请求中是否能够获取到重新激活标识，如果是，则记录所述重新激活标识，执行步骤T2，否则直接执行步骤T2；
    所述步骤T2具体包括：所述云认证服务器接收所述移动终端令牌发送的第二激活请求，判断是否记录有所述重新激活标识，如果是，则生成种子生成因子，根据所述种子生成因子生成服务器种子密钥并保存，否则生成令牌序列号和种子生成因子，根据所述种子生成因子生成服务器种子密钥，保存所述令牌序列号与所述服务器种子密钥。
  15. 根据权利要求12所述的方法，其特征在于，所述步骤T2具体为：
    步骤T2-1：所述云认证服务器接收到移动终端令牌发送的第二激活请求，调用随机数生成函数，生成第二随机数，作为种子生成因子，并根据令牌序列号生成算法，产生一个令牌序列号并保存；
    步骤T2-2：所述云认证服务器应用预设推导算法，对所述种子生成因子进行推导，得到服务器种子密钥；以及
    步骤T2-3：所述云认证服务器获取企业密钥，应用所述企业密钥对所述服务器种子密钥进行加密，得到加密服务器种子密钥并保存。
  16. 根据权利要求12所述的方法，其特征在于，
    所述步骤T3中，所述根据所述令牌序列号和所述种子生成因子生成第二激活响应，具体为：所述云认证服务器获取保存的令牌标识码，根据所述令牌标识码对所述种子生成因子进行加密，得到加密种子生成因子，根据所述令牌标识码和所述加密种子生成因子生成第二激活响应。
  17. 一种在线激活移动终端令牌的系统中移动终端令牌的工作方法，其特征在于，包括：
    步骤X1：所述移动终端令牌接收来自云认证服务器的第一激活响应，根据所述第一激活响应访问所述云认证服务器，与所述云认证服务器建立网络数据链路，并根据所述第一激活响应生成第二激活请求，通过所述网络数据链路发送至所述云认证服务器；
    步骤X2：所述移动终端令牌接收云认证服务器发送的第二激活响应，从所述第二激活响 应中获取种子生成因子和令牌序列号，根据所述种子生成因子生成令牌种子密钥，保存所述令牌序列号和所述令牌种子密钥；
    步骤X3：所述移动终端令牌对所述令牌种子密钥进行计算，生成动态口令，根据所述动态口令生成第三激活请求，并通过所述网络数据链路发送至所述云认证服务器；以及
    步骤X4：所述移动终端令牌接收所述云认证服务器返回的第三激活响应，判断所述第三激活响应，如果是失败响应，则删除所述令牌种子密钥，激活失败，结束，如果为成功响应，则激活成功，结束。
  18. 根据权利要求17所述的方法，其特征在于，所述步骤X1中，所述根据所述第一激活响应访问所述云认证服务器，与所述云认证服务器建立网络数据链路，具体为：所述移动终端令牌从所述第一激活响应中获取预设域名和企业标识，并获取终端端口号，根据所述预设域名、所述企业标识和所述终端端口号得到激活URL，通过所述激活URL访问所述云认证服务器，与所述云认证服务器建立网络数据链路。
  19. 根据权利要求17所述的方法，其特征在于，
    所述步骤X1中，所述移动终端令牌接收来自云认证服务器的第一激活响应，具体为：所述移动终端接收由第一激活响应生成的二维码图片，解析所述二维码图片，得到所述第一激活响应；或
    所述移动终端令牌开启接收数据机制，当检测接收的数据包含预设前缀标识时，接收所述第一激活响应。
  20. 根据权利要求17所述的方法，其特征在于，所述根据所述第一激活响应生成第二激活请求，具体为：所述移动终端令牌获取保存的令牌标识码和令牌版本号，并调用获取系统类型函数，获取移动终端系统类型，根据所述令牌标识码、所述令牌版本号和所述移动终端系统类型生成第二激活请求。
  21. 根据权利要求17所述的方法，其特征在于，所述步骤X2具体为：
    步骤X2-1：所述移动终端令牌接收云认证服务器发送的第二激活响应，从所述第二激活响应中获取种子生成因子和所述令牌序列号；
    步骤X2-2：所述移动终端令牌根据所述种子生成因子生成令牌种子密钥；
    步骤X2-3：所述移动终端令牌应用所述令牌序列号对所述令牌种子密钥进行加密，得到加密令牌种子密钥，将所述加密令牌种子密钥和所述令牌序列号保存。
PCT/CN2015/095278 2014-12-29 2015-11-23 一种在线激活移动终端令牌的设备和系统的工作方法 WO2016107333A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/533,713 US10187381B2 (en) 2014-12-29 2015-11-23 Device and system operating method for online activation of mobile terminal token

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410837958.6 2014-12-29
CN201410837958.6A CN104539701B (zh) 2014-12-29 2014-12-29 一种在线激活移动终端令牌的设备和系统的工作方法

Publications (1)

Publication Number Publication Date
WO2016107333A1 true WO2016107333A1 (zh) 2016-07-07

Family

ID=52855168

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095278 WO2016107333A1 (zh) 2014-12-29 2015-11-23 一种在线激活移动终端令牌的设备和系统的工作方法

Country Status (3)

Country Link
US (1) US10187381B2 (zh)
CN (1) CN104539701B (zh)
WO (1) WO2016107333A1 (zh)

Families Citing this family (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3028639B1 (fr) * 2014-11-17 2016-12-23 Oberthur Technologies Procede de securisation d'un jeton de paiement
CN104539701B (zh) * 2014-12-29 2018-04-27 飞天诚信科技股份有限公司 一种在线激活移动终端令牌的设备和系统的工作方法
CN105141628B (zh) * 2015-09-18 2018-06-29 飞天诚信科技股份有限公司 一种实现推送的方法及装置
KR102210897B1 (ko) * 2015-08-24 2021-02-01 후아웨이 테크놀러지 컴퍼니 리미티드 보안 인증 방법, 구성 방법 및 관련 기기
JP6579387B2 (ja) * 2016-11-25 2019-09-25 京セラドキュメントソリューションズ株式会社 電子機器
US10608882B2 (en) * 2017-02-16 2020-03-31 International Business Machines Corporation Token-based lightweight approach to manage the active-passive system topology in a distributed computing environment
CN108540433B (zh) * 2017-03-06 2020-10-27 华为技术有限公司 用户身份校验方法及装置
CN107172008B (zh) * 2017-04-01 2019-10-18 北京芯盾时代科技有限公司 一种在移动设备中进行多系统认证及同步的系统和方法
CN107493264B (zh) * 2017-07-17 2021-01-05 深圳市文鼎创数据科技有限公司 Otp激活方法、移动终端、服务器、存储介质及系统
EP3439258B1 (en) * 2017-07-31 2020-05-27 Harman International Industries, Incorporated Data protection and security for in-vehicle systems
US10708771B2 (en) * 2017-12-21 2020-07-07 Fortinet, Inc. Transfering soft tokens from one mobile device to another
CN108964922A (zh) * 2018-06-19 2018-12-07 深圳市文鼎创数据科技有限公司 移动终端令牌激活方法、终端设备及服务器
CN109146470B (zh) * 2018-08-24 2023-02-28 北京小米移动软件有限公司 生成付款码的方法及装置
CN109150891B (zh) * 2018-09-05 2020-03-17 北京深思数盾科技股份有限公司 一种验证方法、装置和信息安全设备
EP3881258A4 (en) * 2018-11-14 2022-01-12 Visa International Service Association SUPPLY OF TOKENS IN THE CLOUD OF MULTIPLE TOKENS
CN109617678A (zh) * 2018-11-20 2019-04-12 上海庆科信息技术有限公司 智能锁系统及密码保存方法、装置、设备、计算机介质
CN109784167B (zh) * 2018-12-13 2022-08-26 南京邮电大学 一种基于计算机视觉的家庭安全检测系统
CN111355583B (zh) * 2018-12-20 2022-12-27 中移（杭州）信息技术有限公司 一种业务提供系统、方法、装置、电子设备及存储介质
CN109936840B (zh) * 2019-01-02 2023-01-03 百度在线网络技术（北京）有限公司 通信方法、装置及电子设备
CN110572395B (zh) * 2019-09-09 2021-12-07 车智互联（北京）科技有限公司 一种身份验证方法和系统
CN110995416A (zh) * 2019-10-12 2020-04-10 武汉信安珞珈科技有限公司 一种将移动端与客户端关联的方法
CN111273935A (zh) * 2020-03-16 2020-06-12 上海商魁信息科技有限公司 一种终端查询所属云端管理后台的方法及终端
CN111586023B (zh) * 2020-04-30 2022-05-31 广州市百果园信息技术有限公司 一种认证方法、设备和存储介质
CN112104456A (zh) * 2020-08-14 2020-12-18 广州江南科友科技股份有限公司 一种令牌激活方法、装置、存储介质和计算机设备
CN112203357B (zh) * 2020-09-30 2022-01-21 浙江三维利普维网络有限公司 一种随机接入方法、装置、存储介质及电子设备
CN112533206B (zh) * 2020-12-04 2024-03-26 北京金史密斯科技股份有限公司 配网方法、装置、存储介质及电子设备
CN112910657B (zh) * 2021-02-01 2023-09-26 武汉纺织大学 一种云安全令牌预警系统
CN113438246B (zh) * 2021-06-29 2023-05-30 四川巧夺天工信息安全智能设备有限公司 一种针对智能终端的数据安全及权限管控的方法
CN114422251B (zh) * 2022-01-21 2024-02-13 晋商博创（北京）科技有限公司 基于云的多因子口令处理方法、装置及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103684782A (zh) * 2013-11-26 2014-03-26 飞天诚信科技股份有限公司 一种令牌认证系统中令牌设备的激活方法
US20140122873A1 (en) * 2012-10-31 2014-05-01 Steven W. Deutsch Cryptographic enforcement based on mutual attestation for cloud services
CN103780393A (zh) * 2014-01-15 2014-05-07 重庆邮电大学 一种面向多安全等级的虚拟桌面安全认证系统及方法
CN104539701A (zh) * 2014-12-29 2015-04-22 飞天诚信科技股份有限公司 一种在线激活移动终端令牌的设备和系统的工作方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070078723A1 (en) * 2005-09-30 2007-04-05 Downes James J System, method and apparatus for conducting secure online monetary transactions
US20120227098A1 (en) * 2011-03-03 2012-09-06 Microsoft Corporation Sharing user id between operating system and application
US10789373B2 (en) * 2011-10-31 2020-09-29 Reid Consulting Group, Inc. System and method for securely storing and sharing information
US9922322B2 (en) * 2013-12-19 2018-03-20 Visa International Service Association Cloud-based transactions with magnetic secure transmission
CN105830107A (zh) * 2013-12-19 2016-08-03 维萨国际服务协会 基于云的交易方法和系统
ES2607495T3 (es) * 2013-12-20 2017-03-31 Verisec AB Testigo móvil
US9032498B1 (en) * 2014-05-25 2015-05-12 Mourad Ben Ayed Method for changing authentication for a legacy access interface
US9813400B2 (en) * 2014-11-07 2017-11-07 Probaris Technologies, Inc. Computer-implemented systems and methods of device based, internet-centric, authentication

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140122873A1 (en) * 2012-10-31 2014-05-01 Steven W. Deutsch Cryptographic enforcement based on mutual attestation for cloud services
CN103684782A (zh) * 2013-11-26 2014-03-26 飞天诚信科技股份有限公司 一种令牌认证系统中令牌设备的激活方法
CN103780393A (zh) * 2014-01-15 2014-05-07 重庆邮电大学 一种面向多安全等级的虚拟桌面安全认证系统及方法
CN104539701A (zh) * 2014-12-29 2015-04-22 飞天诚信科技股份有限公司 一种在线激活移动终端令牌的设备和系统的工作方法

Also Published As

Publication number Publication date
US10187381B2 (en) 2019-01-22
CN104539701A (zh) 2015-04-22
CN104539701B (zh) 2018-04-27
US20180332472A1 (en) 2018-11-15

Similar Documents

Publication Publication Date Title
WO2016107333A1 (zh) 一种在线激活移动终端令牌的设备和系统的工作方法
CN108781163B (zh) 用于数据通信的方法、系统以及计算机可读介质
KR102364874B1 (ko) 웨어러블 디바이스를 사용하여 전자 지불들을 용이하게 하기 위한 방법 및 장치
US20220191016A1 (en) Methods, apparatuses, and computer program products for frictionless electronic signature management
US10547605B2 (en) Communication device, communication method, communication system, and non-transitory computer readable medium
JP6573627B2 (ja) 補助デバイスを使用したサービス認可
US20220014524A1 (en) Secure Communication Using Device-Identity Information Linked To Cloud-Based Certificates
WO2018099285A1 (zh) 物联网设备的烧录校验方法及装置、身份认证方法及装置
AU2019201720A1 (en) Method of using one device to unlock another device
US10637650B2 (en) Active authentication session transfer
US20160134599A1 (en) Computer-implemented systems and methods of device based, internet-centric, authentication
US9979725B1 (en) Two-way authentication using two-dimensional codes
JP2018503199A (ja) アカウント復元プロトコル
CN105024819A (zh) 一种基于移动终端的多因子认证方法及系统
US20180159842A1 (en) System and method for a single sign on connection in a zero-knowledge vault architecture
WO2020140407A1 (zh) 基于云安全的云桌面登陆方法、装置、设备和存储介质
KR101686167B1 (ko) 사물 인터넷 기기의 인증서 배포 장치 및 방법
US11394543B2 (en) System and method for secure sensitive data storage and recovery
US10439809B2 (en) Method and apparatus for managing application identifier
CN111989672A (zh) 用于多域环境的密码重置
WO2018099407A1 (zh) 账户认证登录方法及装置
CN108881153B (zh) 用于登入的认证方法
CN109460647B (zh) 一种多设备安全登录的方法
US20180123794A1 (en) A first entity, a second entity, an intermediate node, methods for setting up a secure session between a first and second entity, and computer program products
JP6307610B2 (ja) データ改竄検知装置、データ改竄検知方法、及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15875012

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15533713

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15875012

Country of ref document: EP

Kind code of ref document: A1