WO2016161889A1

WO2016161889A1 - Dynamic password authentication method, system, client terminal and server

Info

Publication number: WO2016161889A1
Application number: PCT/CN2016/076880
Authority: WO
Inventors: 肖维杰; 吴月刚
Original assignee: 阿里巴巴集团控股有限公司; 肖维杰; 吴月刚
Priority date: 2015-04-07
Filing date: 2016-03-21
Publication date: 2016-10-13
Also published as: CN106161367A

Abstract

Disclosed in embodiments of the present application are a dynamic password authentication method, system, client terminal and server. The method comprises: requesting, by a client terminal, a current server time from an authentication server; receiving, by the client terminal, the current server time returned by the authentication server; calculating to generate, by the client terminal, according to the current server time, a dynamic password and uploading the dynamic password to the authentication server; calculating to generate, by the authentication server, according to the current server time, an authentication password; determining whether the dynamic password matches the authentication password, if so, the authentication is successful. The embodiments of the present application realize synchronization of a time factor used by the client terminal when generating the dynamic password and a time factor used by the authentication server when generating the authentication password, thereby improving the matching degree between the dynamic password and the authentication password.

Description

Dynamic password verification method and system, client and server

Technical field

The present application relates to the field of Internet information security technologies, and in particular, to a dynamic password verification method and system, a client, and a server.

Background technique

A dynamic password is a password that is generated over time or an event. The password is valid and unpredictable in a certain time interval. It is usually displayed by a carrier generated by a dynamic password, such as a mobile phone token or a scratch card. Dynamic password verification technology can implement user security authentication function. With the development of mobile Internet, dynamic password verification technology has been widely used in enterprises, finance, online banking, e-government and other fields. For example, when the user logs in to the online banking transaction system, the system will ask the user to input a dynamic password. After the user completes the input, the dynamic password is transmitted to the verification server for verification. Since each generated dynamic password is random and can only be used once, it can prevent attacks such as dynamic password eavesdropping, replay, impersonation, and guessing.

In the prior art, a dynamic password verification method based on time synchronization is commonly used to implement verification of a user identity. In the verification method, an algorithm for generating a dynamic password by a client includes a time factor parameter. The verification server generates a verification password for verifying the dynamic password, and the algorithm for generating the verification password also requires a time factor parameter.

In the process of implementing the present application, the inventor has found that at least the following problems exist in the prior art: the time factor in the client-generated dynamic password algorithm is derived from the client device, and the time factor in the verification server generating the verification password algorithm is derived from the verification server. Normally, the client device clock and the authentication server clock are almost impossible to match completely. When the time factor does not match, the generated dynamic password and the authentication password will also not match, which will cause the user authentication to fail.

Summary of the invention

The purpose of the embodiment of the present application is to provide a dynamic password verification method and system, a client and a server, to implement a time factor in generating a dynamic password algorithm and a time factor exact match in generating a verification password algorithm.

To solve the above technical problem, the embodiment of the present application provides a dynamic password verification method and system, and the client and the server are implemented as follows:

A dynamic password verification method, comprising:

The client requests the current time of the server from the authentication server;

The client receives the current time of the server returned by the verification server;

The client calculates a dynamic password according to the current time of the server, and uploads the dynamic password to the test. Certificate server

The verification server calculates and generates a verification password according to the current time of the server;

The verification server determines whether the dynamic password and the verification password match, and if it matches, passes the verification.

A dynamic password verification method, comprising:

Request the server current time from the authentication server;

Receiving a current time of the server returned by the verification server;

And generating a dynamic password according to the current time of the server, and uploading the dynamic password to the verification server.

A dynamic password verification method, comprising:

Receiving the current time request of the server sent by the client;

Returns the current time of the server to the client;

Receive the dynamic password returned by the client;

Calculating and generating a verification password according to the current time value of the server;

Determining whether the dynamic password and the verification password match, and if they match, pass the verification.

Before the requesting the server to request the current time of the server, the method further includes:

The client checks if it is connected to the network;

When judging the connection to the network, the client requests the server for the current time from the authentication server.

And generating, according to the current time of the server, generating a dynamic password, including:

The current time and seed key of the server are used as input parameters of the dynamic password algorithm, and the dynamic password is calculated by using a dynamic password algorithm.

The seed key includes a seed key generated by the client upon initialization and sent to the authentication server.

The seed key includes a seed key that is generated when the client initializes and is sent to the verification server when calculating a dynamic password.

The dynamic password algorithm includes a one-way hash function.

A dynamic password verification method, comprising:

The client reads the pre-stored server synchronization time;

The client determines the current time of the server according to the server synchronization time;

The client calculates and generates a dynamic password according to the current time of the server, and uploads the dynamic password to the verification server;

The verification server receives the dynamic password, and generates a verification password according to the current time value of the server;

The verification server determines whether the dynamic password and the verification password match, and if they match, passes the verification.

A dynamic password verification method, comprising:

Read the pre-stored server synchronization time;

Determining a current time of the server according to the server synchronization time;

A dynamic password verification method, comprising:

Receive the dynamic password returned by the client;

Calculate and generate a verification password according to the current time value of the server;

The dynamic password algorithm includes a one-way hash function.

Determining, according to the server synchronization time, a current time of the server, including:

Obtaining the first time of the client when storing the server synchronization time;

Calculating a difference between a current time of the client and the first time;

And calculating a sum of the difference and the server synchronization time, the sum value being determined as the current time of the server.

A dynamic password verification system comprising:

a client, configured to request a current time of the server from the verification server; receive a current time of the server returned by the verification server; calculate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server;

An authentication server, configured to receive a current time request of the server sent by the client; return a current time of the server to the client; calculate a generated verification password according to the current time value of the server; and determine whether the dynamic password and the verification password match, If it matches, it passes the verification.

A client that includes:

a requesting unit, configured to request a server current time from the verification server;

a receiving unit, configured to receive a current time of the server returned by the verification server;

The dynamic password generating unit is configured to calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.

A server that includes:

a first receiving unit, configured to receive a server current time request sent by the client;

Return unit, used to return the current time of the server to the client;

a second receiving unit, configured to receive a dynamic password returned by the client;

a verification password generating unit, configured to calculate and generate a verification password according to the current time value of the server;

The verification unit is configured to determine whether the dynamic password and the verification password match, and if they match, pass the verification.

A dynamic password verification system comprising:

a client, configured to read a pre-stored server synchronization time; determine a current server time according to the server synchronization time; calculate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server;

The verification server is configured to receive a dynamic password returned by the client; calculate a generated verification password according to the current time value of the server; determine whether the dynamic password and the verification password match, and if they match, pass the verification.

A client that includes:

a reading unit for reading a pre-stored server synchronization time;

a time determining unit, configured to determine a current time of the server according to the server synchronization time;

A server that includes:

a receiving unit, configured to receive a dynamic password returned by the client;

a verification password generating unit, configured to calculate and generate a verification password according to a current time of the server;

The time determining unit includes:

An obtaining unit, configured to acquire a first time of the client when the server synchronization time is stored;

a first calculating unit, configured to calculate a difference between acquiring a current time of the client and the first time;

And a second calculating unit, configured to calculate a sum of the difference value and the server synchronization time, where the sum value is determined to be the current time of the server.

It can be seen from the technical solution provided by the foregoing application embodiment that in the dynamic password verification method based on time synchronization, the client generates a communication with the server before acquiring the dynamic password, acquires the current time of the server, and implements the client. The generation of the dynamic password synchronizes with the time factor used by the verification server to generate the verification password, thereby improving the matching degree between the dynamic password and the verification password.

DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only It is a few embodiments described in the present application, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic flow chart of a first method embodiment of a dynamic password verification method according to the present application;

2 is a schematic diagram of an application scenario of a first embodiment of a dynamic password verification method according to the present application;

3 is a schematic flowchart of a second method embodiment of a dynamic password verification method according to the present application;

4 is a schematic structural diagram of a first embodiment of a dynamic password verification client according to the present application;

5 is a schematic flowchart of a third method embodiment of a dynamic password verification method according to the present application;

6 is a schematic diagram of the composition of a first embodiment of a dynamic password verification server of the present application;

7 is a schematic flowchart of a fourth method embodiment of a dynamic password verification method according to the present application;

8 is a schematic flowchart of a fifth method embodiment of a dynamic password verification method according to the present application;

9 is a schematic structural diagram of a second embodiment of a dynamic password verification client according to the present application;

10 is a schematic diagram of a composition of a time determining unit in a second embodiment of the dynamic password verification client of the present application;

11 is a schematic flowchart of a sixth method embodiment of a dynamic password verification method according to the present application;

FIG. 12 is a schematic diagram showing the composition of a second embodiment of the dynamic password verification server of the present application.

detailed description

The embodiment of the present application provides a dynamic password verification method and system, a client, and a server.

The technical solutions in the embodiments of the present application are clearly and completely described in the following, in which the technical solutions in the embodiments of the present application are clearly and completely described. The embodiments are only a part of the embodiments of the present application, and not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope shall fall within the scope of the application.

The dynamic password generation algorithm and the verification password generation algorithm are the same. When the time factor in the client dynamic password generation algorithm is the same as the time factor in the verification server verification password generation algorithm, the dynamic password and the verification password match, and the user passes the authentication. . The client may also obtain the current time of the verification server according to the last synchronized authentication server time saved in the local file.

The implementation of the first embodiment of the present application is described below.

In order to realize that the time factor in the client dynamic password generation algorithm is the same as the time factor in the verification server verification password generation algorithm, the client can communicate with the verification server once before generating the dynamic password to obtain the verification service. The current time of the server. Specifically, it can be implemented by the method of S101 to S105 shown in FIG.

The client can be set to be able to initiate a specific function, such as touching a preset virtual button or pressing a physical button to activate that particular function. The specific function can be re-opened to perform the work of obtaining the current time of the verification server, for example, the work of S101 to S103 below.

Step S101: The client requests the server current time from the verification server.

As described above, after the client starts a specific function, it can perform the work of obtaining the current time of the verification server. First, the client requests the server for the current time from the authentication server. In the embodiment of the present invention, the client may send an http request to the time synchronization interface of the verification service, requesting the verification server to return the current time. The specific Java implementation code is as follows:

Date date=obtainServerDate(); //The client initiates a request to the authentication server.

Public Date obtainServerDate()

{SimpleDateFormat df=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");

/ / Verify the server to set the current time

Return df.format(new Date());} //Verify the server returns the current time to the client

The client can also check if the network is connected before requesting the current time of the authentication server. When the client connects to the network, the client can communicate with the authentication server. Generally, the client device includes a computer, a PAD, or a mobile phone. For example, a mobile phone client is installed with an Android system, and the user can invoke Android after clicking the “Get Dynamic Password” button in the current login page of the client. The Network Connection Manager in the system checks if the mobile client is connected to the network. Specifically, the mobile client can call the isAvailable() function of the ConnectivityManager class in the Android system, and the implementation code is as follows:

ConnectivityManager cwjManager=(ConnectivityManager)getSystemService(Context.CON-NECTIVITY_SERVICE);

cwjManager.getActiveNetworkInfo().isAvailable();//Returning True can determine that the current Android mobile client is connected to the network.

Similar to the above method, in other client devices, the client also checks whether the client is connected to the network by calling the network connection manager in the corresponding installation system. For example, the computer that installs the Win7 system checks whether the computer client is connected to the network by calling the network connection manager of the Win7 system. The iPhone or Ipad of the iOS system is installed to check whether the iPhone or the Ipad client is connected to the network by calling the network connection manager of the iOS system. .

Step S102: The client receives the current time of the server returned by the verification server.

The verification server receives the client's request and returns the current time of the server. The specific Java implementation code is as shown above, and the client receives the current time returned by the verification server.

Step S103: The client calculates a dynamic password according to the current time of the server, and sends the dynamic password to the verification server.

After receiving the current time of the server, the client calculates and generates a dynamic password according to the current time of the server. Algorithms for generating dynamic passwords include one-way hash functions such as HMAC-SHA1, MD5, SHA-1, and SHA-256. For example, the embodiment of the present application uses the HMAC-SHA1 algorithm to calculate and generate a dynamic password. The specific steps are as follows:

SS1: Initialize the seed key and time factor.

When the user registers the account, the client automatically generates a seed key, and the seed key may be a random code generated by the client. When the client includes a mobile phone client, the seed key may include a combination of one or several of an IMEI, a mobile phone manufacturer identification code, a mobile phone screen resolution, and a mobile phone operating system version number. After the client generates the seed key, the seed key can be immediately sent to the verification server. After the verification server receives the seed key, the seed key and the corresponding user ID may be saved in a database of the verification server. The client may also send the seed key to the authentication server when computing to generate a dynamic password. Assuming that the seed key is a key, the time factor is T, and the initialized (seed key key, time factor T) is an encrypted initial value key2, and the encrypted initial value key2 can be generated as follows:

Key2=copy(key,1,L/2)+FormatDateTime(‘yyyymmdd’,nowTime)+

Copy(key,L/2,L)+FormatDateTime(‘hhmmss’, nowTime)

Where L is the length of the seed key, copy (key, 1, L/2) is the front part of the seed key, and copy (key, L/2, L) is the latter part. The server current time nowTime can be accurate to the second. FormatDateTime('yyyymmdd', nowTime) can format the year, month and day value of the current time of the server according to the format of 'yyyymmdd'. For example, the current date of the server is January 22, 2015. , then formatted as "20150122". FormatDateTime('hhmmss', nowTime) can format the time, minute and second of the current time of the server according to the format of 'hhmmss'. If the current time of the server is 2:44:32, the format is " 144403". For example, the seed key value is "999888", and the current time of the server received by the client is 2:44:32 on January 22, 2015, then the encryption initial value key2 can be expressed as "99920150122999144403".

SS2: Generate an HMAC-SHA-1 value according to the encryption initial value calculation.

The HMAC-SHA-1 value is generated according to the initial value of the encryption, and the specific expression is:

Hs=HMAC-SHA-1 (encrypted initial value)

Among them, Hs is a 160-bit binary string. HMAC-SHA-1 outputs a 160-bit HMAC-SHA-1 value after two hash operations using the SHA-1 algorithm. The SHA-1 is a standard hash operation of the prior art and will not be described here.

SS3: Generate a 31-bit binary string based on the HMAC-SHA-1 value.

A dynamic offset truncation function is used to extract a 31-bit dynamic binary string from the 160-bit HMAC-SHA-1 value. The specific expression is P=DT(Hs), where DT is a truncation function. The specific implementation process of P=DT(Hs) is as follows:

Hs=Hs[0]Hs[1]...Hs[19]; // where Hs[i] is the ith byte of the binary string Hs;

OffsetBits=Hs[19]&0xf; //OffsetBits in the formula is the offset digit, taking the last 4 digits of Hs[19];

Offset=StToNum(OffsetBits);

/ / Convert OffsetBits to a decimal number, and the value is between 0-15;

P=(Hs[Offset]&0x7f)<<24|(Hs[Offset+1]&0xff)<<16|(Hs[Offset+2]&0xff)<<8|(Hs[Offset+3]&0xff); / In the equation, the last 31 bits are taken from Hs[Offset] to Hs[Offset+3] consecutively 4 bytes.

SS4: Obtain a dynamic password according to the 31-bit binary string.

The dynamic password is determined according to the 31-bit binary string, and the binary string can be converted into a 6-8 bit decimal number by using a StToNum function, and the specific implementation manner is as follows:

StToNum(P)=P[0]·2^(30)+P[1]·2^(29)+...+P[29]·2^(1)+P[30]·2^(0) .

The client can send the dynamic password to the verification server by SMS. The short message gateway converts the short message sent by the client to the verification server.

Step S104: The verification server calculates a generated verification password according to the current time value of the server.

Generally, after determining the validity of the user ID, the verification server may invoke a seed key corresponding to the user ID from the verification server database, and may also receive a seed key sent by the client in real time. The verification server calculates a generated verification password according to the seed key and the current time value of the server sent to the client. When the verification server calculates the generated verification password, the same algorithm as the client can be adopted. In this case, the verification server is preconfigured with the same dynamic password algorithm as the client. Of course, the verification server can also adopt a different algorithm from the client, and only the calculated dynamic password and the verification password are matched after a certain algorithm conversion. Similarly, the dynamic password algorithm includes HMAC-SHA1, MD5, SHA-1, and SHA-256.

Step S106: The verification server determines whether the dynamic password and the verification password match, and if they match, passes the verification.

The verification server compares the dynamic password and the verification password, and if so, sends a confirmation message of verification to the client. Subsequently, if the dynamic password and the verification password do not match, the verification server may send a reply message that fails verification to the client.

The implementation process of the foregoing embodiment of the present application is described below in conjunction with a specific scenario:

The interface when user A logs in to a website through the mobile client is shown in Figure 2. After user A enters the user ID and password, dynamic password authentication is required. On the interface shown in Figure 2, the user clicks "Get Dynamic Password". Button, the button triggers the function of the mobile client to obtain a dynamic password. First, the client checks if the mobile device is connected to the network. If the mobile device is equipped with an Android system, the client can call the isAvailable() function to check if the phone is connected to the network. After checking, if it is determined that the mobile client device is connected to the network, the client requests the current time of the server from the authentication server. Specifically, the client may send an Http request to the time synchronization interface of the verification server to request the current time of the server, and the current time may be 2:44:32 on the afternoon of January 22, 2015. After receiving the current time of the server of the verification server, the mobile client reads the local seed key, which may be a 15-digit IMEI code of the mobile device, such as “834299070186334”. In this embodiment, the client can calculate and generate a dynamic password by using the HMAC-SHA-1 algorithm. Specifically, the seed key and the current time of the server are initialized, the initial value of the encryption is obtained, and the HMAC-SHA-1 value of the initial value of the encryption is calculated, and after truncation, the dynamic password is converted into 6-8 bits, such as “ 453476". The client sends the dynamic password to the authentication server. After the verification server receives the dynamic password, it is determined whether the ID of the user is legal. After determining the legality of the ID, the verification server invokes a seed key corresponding to the ID in the server database according to the ID. After the seed key is obtained, the verification server generates a verification password by using an HMAC-SHA-1 algorithm according to the seed key and the current time of the server, where the HMAC-SHA-1 algorithm is pre-configured in the verification server. . After the verification password is generated, the verification server compares the dynamic password with the verification password. If the two match, the verification is passed, otherwise, the verification is not passed.

With the first embodiment of the method of the present application, in the dynamic password verification method based on time synchronization, the client generates a communication with the server before acquiring the dynamic password, acquires the current time of the server, and implements the client to generate the dynamic password and the verification server. The synchronization of the time factor used to verify the password is generated, thereby improving the matching degree between the dynamic password and the verification password.

The following describes a first embodiment of a system for dynamic password verification corresponding to the embodiment of the method, where the system includes

An authentication server, configured to receive a current time request of the server sent by the client; return a current time of the server to the client; calculate a generated verification password according to the current time value of the server; and determine whether the dynamic password and the verification password match, If it matches, it passes the verification, otherwise it fails the verification.

The foregoing first method embodiment, considering a client-based step, may be evolved into a second method embodiment, as shown in FIG. 3, including:

Step S301: request the current time of the server from the verification server;

Step S302: Receive a current time of the server returned by the verification server.

Step S303: Calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.

In the foregoing second method embodiment, the corresponding client first embodiment 400, as shown in FIG. 4, includes:

a requesting unit 401, configured to request a server current time from the verification server;

The receiving unit 402 is configured to receive a current time of the server returned by the verification server;

The dynamic password generating unit 403 is configured to calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.

In the foregoing first method embodiment, considering a server-based step, the third method embodiment may be evolved. As shown in FIG. 5, the method includes:

Step S501: Receive a server current time request sent by the client;

Step S502: Returning the current time of the server to the client;

Step S503: Receive a dynamic password returned by the client.

Step S504: Calculate and generate a verification password according to the current time value of the server;

Step S505: Determine whether the dynamic password and the verification password match, and if they match, pass the verification.

The foregoing third method embodiment, the corresponding server first embodiment 600, as shown in FIG. 6, includes:

The first receiving unit 601 is configured to receive a server current time request sent by the client.

Returning to the unit 602, used to return the current time of the server to the client;

a second receiving unit 603, configured to receive a dynamic password returned by the client;

The verification password generating unit 604 is configured to calculate and generate a verification password according to the current time value of the server;

The verification unit 605 is configured to determine whether the dynamic password and the verification password match, and if they match, pass the verification.

The foregoing first method embodiment can be evolved into a fourth method embodiment in consideration of the fact that the client is not connected to the network.

If the client is not connected to the network, in order to implement the calculation of the dynamic password and the time factor for verifying the password is synchronized, the server synchronization time saved locally by the client may be read, and the current server time is calculated according to the server synchronization time. The specific implementation steps are shown in Figure 7, including:

Step S701: The client reads the server synchronization time pre-stored by the client.

Generally, when the client device is connected to the network, the client can periodically synchronize the server time and save the acquired server synchronization time in the form of a log in the client file system. When the client device is not connected to the network, the client can read the last saved server synchronization time from the client file system, thereby calculating the current server time.

Step S702: The client determines the current time of the server according to the server synchronization time.

The client can determine the current time of the server according to the server synchronization time. Specifically, the current time of the client minus the time when the client saves the server synchronization time, plus the server synchronization time, can determine the current time of the server. The above method includes steps S1 to S3:

S1: Acquire a first time of the client when storing the synchronization time of the server;

S2: calculating a difference between the current time of the client and the first time;

S3: Calculate a sum of the difference value and the server synchronization time, and the sum value is determined as the current time of the server.

For example, the current time of the client device is 21:50:37 on January 26, 2015. The client device synchronizes the server time and saves it at 12:28:03 on January 20, 2015. The server synchronization time is At 12:27:50 on January 20, 2015, according to the above calculation method of determining the current time of the server, then the current time of the server is 21:50:24 on January 26, 2015.

Step S703: The client calculates a dynamic password according to the current time of the server, and uploads the dynamic password to the verification server.

After receiving the current time of the server, the client calculates and generates a dynamic password according to the current time of the server. Dynamic password algorithms include one-way hash functions such as HMAC-SHA1, MD5, SHA-1, and SHA-256. For example, the embodiment of the present application uses the HMAC-SHA1 algorithm to calculate and generate a dynamic password. The specific steps refer to SS1 to SS4 in the first method embodiment, and details are not described herein again.

Step S704: The verification server receives the dynamic password, and calculates and generates a verification password according to the current time value of the server.

After determining the validity of the user ID, the verification server may invoke a seed key corresponding to the user ID from the verification server database, and may also receive a seed key sent by the client in real time. The verification server calculates and generates a verification password according to the seed key and the current time value of the server sent to the client. When the verification server calculates the generated verification password, the same dynamic password algorithm as the client can be adopted. In this case, the verification server is pre-configured with the same dynamic password algorithm as the client. Similarly, the dynamic password algorithm includes HMAC-SHA1, MD5, SHA-1, and SHA-256.

Step S705: The verification server determines whether the dynamic password and the verification password match, and if they match, passes the verification.

Similarly, the interface when user A logs in to a website through the mobile client is as shown in FIG. 2 . The user clicks the "Get Dynamic Password" button, which triggers the function of the mobile client to obtain a dynamic password. First, the client checks if the mobile device is connected to the network. If the mobile device is equipped with an Android system, the client can call the isAvailable() function to check if the phone is connected to the network. After checking, if it is determined that the mobile client device is not connected to the network, the client reads the server synchronization time last saved in the client device file system. The current time of the server is generated according to the server synchronization time calculation, and the specific calculation method refers to step S702. After determining the current time of the server, the mobile client reads the local seed key, which can be a 15-digit IMEI code of the mobile device, such as "834299070186334". In this embodiment, the client can calculate and generate a dynamic password by using the HMAC-SHA-1 algorithm. Specifically, the seed key and the current time of the server are initialized, the initial value of the encryption is obtained, and the HMAC-SHA-1 value of the initial value of the encryption is calculated, and after truncation, the dynamic password is converted into 6-8 bits, such as “ 453476". The client sends the dynamic password to the authentication server. After the verification server receives the dynamic password, it is determined whether the ID of the user is legal. After determining the legality of the ID, the verification server invokes the seed key corresponding to the ID in the server database according to the ID. After the seed key is obtained, the verification server generates a verification password by using an HMAC-SHA-1 algorithm according to the seed key and the current time of the server, where the HMAC-SHA-1 algorithm is pre-configured in the verification server. . After the verification password is generated, the verification server compares the dynamic password with the verification password. If the two are the same, the verification is successful. Otherwise, the verification is unsuccessful.

With the fourth embodiment of the method of the present application, in the dynamic password verification method based on time synchronization, if the client is not connected to the network, the current time of the server is determined according to the server synchronization time stored in the client file system, thereby The synchronization between the dynamic password of the client and the time factor used by the verification server to calculate the verification password is improved, and the matching degree between the dynamic password and the verification password is improved.

The following describes a second embodiment of the system for dynamic password verification corresponding to the embodiment of the method, where the system includes

The fourth method embodiment, considering the client-based step, can be evolved into the fifth method embodiment, as shown in FIG. 8, including:

Step S801: Read the pre-stored server synchronization time;

Step S802: Determine a current time of the server according to the server synchronization time;

Step S803: Calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.

The fifth embodiment of the foregoing method, the corresponding client second embodiment 900, as shown in FIG. 9, includes:

The reading unit 901 is configured to read the pre-stored server synchronization time;

The time determining unit 902 is configured to determine a current time of the server according to the server synchronization time;

The dynamic password generating unit 903 is configured to calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.

As shown in FIG. 10, the time determining unit 902 includes:

The obtaining unit 1001 is configured to acquire a first time of the client when the server synchronization time is stored;

a first calculating unit 1002, configured to calculate a difference between acquiring a current time of the client and the first time;

The second calculating unit 1003 is configured to calculate a sum of the difference value and the server synchronization time, where the sum value is determined to be the current time of the server.

The fourth method embodiment, considering a server-based step, may be evolved into a sixth method embodiment, as shown in FIG. 11, including:

Step S1101: Receive a dynamic password returned by the client.

Step S1102: Calculate and generate a verification password according to the current time value of the server;

Step S1103: Determine whether the dynamic password and the verification password match, and if they match, pass the verification.

The foregoing sixth method embodiment, the corresponding server second embodiment 1200, as shown in FIG. 12, includes:

The receiving unit 1201 is configured to receive a dynamic password returned by the client;

The verification password generating unit 1202 is configured to calculate and generate a verification password according to the current time of the server;

The verification unit 1203 is configured to determine whether the dynamic password and the verification password match, and if they match, pass the verification.

In the 1990s, improvements to a technology could clearly distinguish between hardware improvements (eg, improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (for process flow improvements). However, as technology advances, many of today's method flow improvements can be seen as direct improvements in hardware circuit architecture. Designers almost always get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented by hardware entity modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is an integrated circuit whose logic function is determined by the user programming the device. Designed by the designer to "integrate" a digital system on a PLD without the need for a chip manufacturer to design and manufacture A dedicated integrated circuit chip 2 is used. Moreover, today, instead of manually making integrated circuit chips, this programming is mostly implemented using "logic compiler" software, which is similar to the software compiler used in programming development, but before compiling The original code has to be written in a specific programming language. This is called the Hardware Description Language (HDL). HDL is not the only one, but there are many kinds, such as ABEL (Advanced Boolean Expression Language). AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., are currently the most commonly used VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog2. It should also be apparent to those skilled in the art that the hardware flow for implementing the logic method flow can be easily obtained by simply programming the method flow into the integrated circuit with a few hardware description languages.

The controller can be implemented in any suitable manner, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (eg, software or firmware) executable by the (micro)processor. In the form of logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers, examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, The Microchip PIC18F26K20 and the Silicone Labs C8051F320, the memory controller can also be implemented as part of the memory's control logic.

Those skilled in the art will also appreciate that in addition to implementing the controller in purely computer readable program code, the controller can be logically programmed by means of logic gates, switches, ASICs, programmable logic controllers, and embedding. The form of a microcontroller or the like to achieve the same function. Such a controller can therefore be considered a hardware component, and the means for implementing various functions included therein can also be considered as a structure within the hardware component. Or even a device for implementing various functions can be considered as a software module that can be both a method of implementation and a structure within a hardware component.

The system, device, module or unit illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product having a certain function.

For the convenience of description, the above devices are described separately by function into various units. Of course, the functions of each unit may be implemented in the same software or software and/or hardware when implementing the present application.

It will be apparent to those skilled in the art from the above description of the embodiments that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such understanding, portions of the technical solution of the present application that contribute substantially or to the prior art may be embodied in the form of a software product. In a typical configuration, the computing device includes one or more processors (CPU ), input / output interface, network interface and memory. The computer software product can A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application or portions of the embodiments. The computer software product can be stored in a memory, which may include non-persistent memory, random access memory (RAM), and/or nonvolatile memory in a computer readable medium, such as read only memory (ROM) or Flash memory. Memory is an example of a computer readable medium. Computer readable media includes both permanent and non-persistent, removable and non-removable media. Information storage can be implemented by any method or technology. The information can be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, Magnetic tape cartridges, magnetic tape storage or other magnetic storage devices or any other non-transportable media can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include transitory computer readable media, such as modulated data signals and carrier waves.

The various embodiments in the specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

This application can be used in a variety of general purpose or special purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor based systems, set-top boxes, programmable consumer electronics devices, network PCs, small computers, mainframe computers, including A distributed computing environment of any of the above systems or devices, and the like.

The application can be described in the general context of computer-executable instructions executed by a computer, such as a program module. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types. The present application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

While the present invention has been described by the embodiments of the present invention, it will be understood by those skilled in the art

Claims

A dynamic password verification method, comprising:

The client requests the current time of the server from the authentication server;

The client receives the current time of the server returned by the verification server;

The client calculates a dynamic password according to the current time of the server, and uploads the dynamic password to the verification server;

The verification server calculates and generates a verification password according to the current time of the server;

The verification server determines whether the dynamic password and the verification password match, and if it matches, passes the verification.
A dynamic password verification method, comprising:

Request the server current time from the authentication server;

Receiving a current time of the server returned by the verification server;

And generating a dynamic password according to the current time of the server, and uploading the dynamic password to the verification server.
A dynamic password verification method, comprising:

Receiving the current time request of the server sent by the client;

Returns the current time of the server to the client;

Receive the dynamic password returned by the client;

Calculating and generating a verification password according to the current time value of the server;

Determining whether the dynamic password and the verification password match, and if they match, pass the verification.
The dynamic password verification method according to claim 1 or 2, further comprising: before the requesting the server for the current time to the verification server, further comprising:

The client checks if it is connected to the network;

When judging the connection to the network, the client requests the server for the current time from the authentication server.
The dynamic password verification method according to claim 1 or 2, wherein the calculating the dynamic password according to the current time of the server comprises:

The current time and seed key of the server are used as input parameters of the dynamic password algorithm, and the dynamic password is calculated by using a dynamic password algorithm.
The dynamic password verification method according to claim 5, wherein the seed key comprises a seed key generated by the client upon initialization and sent to the verification server.
The dynamic password verification method according to claim 5, wherein said seed key comprises said guest A seed key that is generated when the client is initialized and sent to the authentication server when calculating a dynamic password.
The dynamic password verification method according to claim 5, wherein the dynamic password algorithm comprises a one-way hash function.
A dynamic password verification method, comprising:

The client reads the pre-stored server synchronization time;

The client determines the current time of the server according to the server synchronization time;

The client calculates and generates a dynamic password according to the current time of the server, and uploads the dynamic password to the verification server;

The verification server receives the dynamic password, and generates a verification password according to the current time value of the server;

The verification server determines whether the dynamic password and the verification password match, and if they match, passes the verification.
A dynamic password verification method, comprising:

Read the pre-stored server synchronization time;

Determining a current time of the server according to the server synchronization time;

And generating a dynamic password according to the current time of the server, and uploading the dynamic password to the verification server.
A dynamic password verification method, comprising:

Receive the dynamic password returned by the client;

Calculate and generate a verification password according to the current time value of the server;

Determining whether the dynamic password and the verification password match, and if they match, pass the verification.
The dynamic password verification method according to claim 9 or 10, wherein the calculating the dynamic password according to the current time of the server comprises:

The current time and seed key of the server are used as input parameters of the dynamic password algorithm, and the dynamic password is calculated by using a dynamic password algorithm.
The dynamic password verification method according to claim 12, wherein the seed key comprises a seed key generated by the client upon initialization and sent to the verification server.
The dynamic password verification method according to claim 12, wherein the seed key comprises a seed key that is generated when the client initializes and is sent to the verification server when calculating a dynamic password.
The dynamic password verification method according to claim 12, wherein the dynamic password algorithm comprises a one-way hash function.
The dynamic password verification method according to claim 9 or 10, wherein the determining the current time of the server according to the server synchronization time comprises:

Obtaining the first time of the client when storing the server synchronization time;

Calculating a difference between a current time of the client and the first time;

And calculating a sum of the difference and the server synchronization time, the sum value being determined as the current time of the server.
A dynamic password verification system, comprising:

a client, configured to request a current time of the server from the verification server; receive a current time of the server returned by the verification server; calculate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server;

An authentication server, configured to receive a current time request of the server sent by the client; return a current time of the server to the client; calculate a generated verification password according to the current time value of the server; and determine whether the dynamic password and the verification password match, If it matches, it passes the verification.
A client, comprising:

a requesting unit, configured to request a server current time from the verification server;

a receiving unit, configured to receive a current time of the server returned by the verification server;

The dynamic password generating unit is configured to calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.
A server, comprising:

a first receiving unit, configured to receive a server current time request sent by the client;

Return unit, used to return the current time of the server to the client;

a second receiving unit, configured to receive a dynamic password returned by the client;

a verification password generating unit, configured to calculate and generate a verification password according to the current time value of the server;

The verification unit is configured to determine whether the dynamic password and the verification password match, and if they match, pass the verification.
A dynamic password verification system, comprising:

a client, configured to read a pre-stored server synchronization time; determine a current server time according to the server synchronization time; calculate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server;

The verification server is configured to receive a dynamic password returned by the client; calculate a generated verification password according to the current time value of the server; determine whether the dynamic password and the verification password match, and if they match, pass the verification.
A client, comprising:

a reading unit for reading a pre-stored server synchronization time;

a time determining unit, configured to determine a current time of the server according to the server synchronization time;

The dynamic password generating unit is configured to calculate and generate a dynamic password according to the current time of the server, and upload the dynamic password to the verification server.
A server, comprising:

a receiving unit, configured to receive a dynamic password returned by the client;

a verification password generating unit, configured to calculate and generate a verification password according to a current time of the server;

The verification unit is configured to determine whether the dynamic password and the verification password match, and if they match, pass the verification.
The client according to claim 21, wherein the time determining unit comprises:

An obtaining unit, configured to acquire a first time of the client when the server synchronization time is stored;

a first calculating unit, configured to calculate a difference between acquiring a current time of the client and the first time;

And a second calculating unit, configured to calculate a sum of the difference value and the server synchronization time, where the sum value is determined to be the current time of the server.