WO2017202137A1 - 一种nfc动态令牌及其工作方法 - Google Patents

一种nfc动态令牌及其工作方法 Download PDF

Info

Publication number
WO2017202137A1
WO2017202137A1 PCT/CN2017/078543 CN2017078543W WO2017202137A1 WO 2017202137 A1 WO2017202137 A1 WO 2017202137A1 CN 2017078543 W CN2017078543 W CN 2017078543W WO 2017202137 A1 WO2017202137 A1 WO 2017202137A1
Authority
WO
WIPO (PCT)
Prior art keywords
nfc
dynamic token
seed
instruction
mobile device
Prior art date
Application number
PCT/CN2017/078543
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610350254.5A external-priority patent/CN105812395B/zh
Priority claimed from CN201610349991.3A external-priority patent/CN105812127B/zh
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US16/092,529 priority Critical patent/US11381554B2/en
Publication of WO2017202137A1 publication Critical patent/WO2017202137A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/14—Direct-mode setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H04L2209/805—Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor

Definitions

  • the invention relates to a NFC (Near Field Communication) dynamic token and a working method thereof, and belongs to the field of information security.
  • seed data may be a "seed key.”
  • Dynamic Token is a device for generating dynamic passwords. It is widely used in online banking, telecom operators and e-government applications.
  • the dynamic password generated by the dynamic token can be used for identity authentication, which can effectively improve the security of identity authentication.
  • the seed key necessary for generating the dynamic password is written by the manufacturer of the dynamic token into the dynamic token.
  • the seed key in the dynamic token cannot be updated according to the user's needs, and the flexibility and security are poor.
  • the dynamic token needs to be manually input to the webpage or the client by the user, which is error-prone and has poor security.
  • a method of operating a NFC dynamic token comprising the steps of:
  • the NFC dynamic token After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel;
  • the NFC dynamic token acquires a seed key from the second instruction, saves the seed key, and passes the NFC channel Sending a write success message to the mobile device;
  • the NFC dynamic token When the NFC dynamic token receives a third instruction from the mobile device, the NFC dynamic token generates a dynamic password using the seed data saved by itself, and sends the dynamic password to the mobile device through an NFC channel. .
  • an NFC dynamic token including:
  • a detecting module configured to detect whether a preset button is triggered
  • connection module configured to: after the detection module detects that the preset button is triggered, start NFC communication, and establish a connection with the mobile device through the NFC channel;
  • a receiving module configured to receive a second instruction or a third instruction from the mobile device
  • An obtaining module configured to obtain a seed key from the second instruction
  • a storage module configured to save the seed key
  • a generation module for generating a dynamic password using the saved seed data
  • a sending module configured to send a write success message to the mobile device through the NFC channel or send the dynamic password to the mobile device through an NFC channel.
  • the seed key is programmed into the NFC dynamic token through the NFC channel, which improves the security and flexibility of the dynamic token.
  • FIG. 1 is a flowchart of a method for programming a seed key in an NFC dynamic token according to Embodiment 1 of the present invention
  • FIG. 2 is a flowchart of another method for programming a seed key in an NFC dynamic token according to Embodiment 2 of the present invention
  • FIG. 3 is a flowchart of still another method for programming a seed key in an NFC dynamic token according to Embodiment 3 of the present invention.
  • FIG. 4 is a flowchart of still another method for programming a seed key in an NFC dynamic token according to Embodiment 4 of the present invention.
  • FIG. 5 is a flowchart of still another method for programming a seed key in an NFC dynamic token according to Embodiment 5 of the present invention.
  • FIG. 6 is a block diagram showing the structure of a module of an NFC dynamic token according to Embodiment 6 of the present invention.
  • FIG. 10 is a flowchart of another working method of an NFC dynamic token according to Embodiment 10 of the present invention.
  • FIG. 11 is a schematic structural diagram of an NFC dynamic token according to Embodiment 11 of the present invention.
  • Embodiment 1 of the present invention provides a method for programming a seed key in an NFC dynamic token. As shown in FIG. 1, the method includes the following steps:
  • Step 101 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • step 102 the NFC dynamic token waits to receive NFC data from the mobile device.
  • Step 103 After the NFC dynamic token receives the NFC data from the mobile device, the NFC dynamic token verifies the NFC data. If the verification passes, step 105 is performed; otherwise, step 104 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x440E02AFCC4F6EAC971346E6066E4D09”, where the frame header is “0x44”, the length data is “0x0E”, the command data is “0x02AFCC4F6EAC971346E6066E4D”, the check data is “0x09”, and the NFC dynamic token is based on the length data “0x0E”.
  • the command data "0x02AFCC4F6EAC971346E6066E4D" is calculated to determine whether the calculated check value is "0x09", and if so, it is determined that the check passes; otherwise, it is determined that the check fails.
  • Step 104 The NFC dynamic token sends an error code to the mobile device, and returns to step 102.
  • the NFC dynamic token sends the error code "0xBB021E35" to the mobile device.
  • Step 105 The NFC dynamic token judges the NFC data. If it is the first instruction, step 106 is performed; if it is the second instruction, step 107 is performed; if it is the fourth instruction, step 112 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is the second instruction; if the command code is the fifth preset value, determining that the NFC data is the fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x02”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x02", the NFC data is determined to be the second instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 106 The NFC dynamic token sends an encrypted random number to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 102.
  • the encrypted random number may be part of data intercepted from UTC seconds, for example, “0x1326”.
  • the mobile device receives the encrypted random number from the NFC dynamic token, the encrypted random number is saved.
  • Step 107 The NFC dynamic token obtains the seed ciphertext and the check value from the second instruction.
  • the NFC dynamic token obtains the seed ciphertext and the check value from the instruction data of the second instruction.
  • the command data is “0x02AFCC4F6EAC971346E6066E4D”
  • the NFC dynamic token acquires the seed ciphertext “0xAFCC4F6EAC971346E6” and the check value “0x6E4D” from the command data.
  • Step 108 The NFC dynamic token decrypts the seed ciphertext by using the last saved encrypted random number to obtain a seed plaintext, and calculates a check value according to the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and calculates the check value according to the seed plaintext.
  • Step 109 The NFC dynamic token determines whether the calculated check value is the same as the check value obtained from the second instruction. If yes, step 110 is performed; otherwise, step 111 is performed.
  • the NFC dynamic token determines whether the calculated check value is the same as the check value "0x6E4D" obtained from the second instruction.
  • Step 110 The NFC dynamic token saves the seed ciphertext, sends a write success message to the mobile device through the NFC channel, and returns to step 102.
  • the NFC dynamic token saves the seed ciphertext “0xAFCC4F6EAC971346E6” and sends a write success message “0xBB02CCCC” to the mobile device through the NFC channel.
  • Step 111 The NFC dynamic token sends a write failure message to the mobile device through the NFC channel, and returns to step 102.
  • the NFC dynamic token sends a write failure message "0xBB023D5B" to the mobile device.
  • Step 112 The NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 102.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • the method further includes: the mobile device acquiring the seed ciphertext and the check value from the token server, and generating the second instruction according to the seed ciphertext and the check value.
  • the method further includes: the NFC dynamic token decrypts the seed ciphertext by using the last saved encrypted random number, obtains the seed plaintext, and generates the dynamic password by using the seed plaintext.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 102 and subsequent steps are performed.
  • Embodiment 1 of the present invention writes a seed key into an NFC dynamic token through an NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 2 of the present invention provides another working method of an NFC dynamic token, as shown in FIG. 2, including the following steps:
  • Step 201 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • step 202 the NFC dynamic token waits to receive an NFC command from the mobile device.
  • Step 203 After the NFC dynamic token receives the NFC command from the mobile device, the NFC dynamic token checks the NFC command. If the check passes, step 205 is performed; otherwise, step 204 is performed.
  • the NFC instruction includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the instruction data.
  • Calculate obtain the check value, determine whether the check value is the same as the value of the check data. If they are the same, determine that the NFC command check passes; otherwise, determine that the NFC command check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC command is “0x440E028D5828922FEBFC8597063B5315”, where the frame header is “0x44”, the length data is “0x0E”, the command data is “0x028D5828922FEBFC8597063B53”, the check data is “0x15”, and the NFC dynamic token is based on the length data “0x0E”.
  • the command data "0x028D5828922FEBFC8597063B53" is calculated to determine whether the calculated check value is "0x15”, and if so, it is determined that the check passes; otherwise, it is determined that the check fails.
  • Step 204 The NFC dynamic token sends an error code to the mobile device, and returns to step 202.
  • the NFC dynamic token sends the error code "0xBB021E35" to the mobile device.
  • Step 205 The NFC dynamic token obtains the seed plaintext and the check value from the NFC instruction.
  • the NFC dynamic token acquires the seed plaintext and the check value from the instruction data of the NFC instruction.
  • the command data is “0x028D5828922FEBFC8597063B53”
  • the NFC dynamic token acquires the seed ciphertext “0x8D5828922FEBFC8597” and the check value “0x3B53” from the command data.
  • Step 206 The NFC dynamic token calculates a check value according to the seed plaintext.
  • the NFC dynamic token calculates a check value based on the seed plaintext "0x8D5828922FEBFC8597".
  • Step 207 The NFC dynamic token determines whether the calculated check value is the same as the check value obtained from the NFC instruction. If yes, step 208 is performed; otherwise, step 209 is performed.
  • the NFC dynamic token determines whether the calculated check value is the same as the check value "0x3B53" obtained from the NFC instruction.
  • Step 208 The NFC dynamic token saves the seed plaintext, sends a write success message to the mobile device through the NFC channel, and returns to step 202.
  • the NFC dynamic token saves the seed plaintext "0x8D5828922FEBFC8597” and sends a write success message "0xBB02CCCC" to the mobile device through the NFC channel.
  • Step 209 The NFC dynamic token sends a write failure message to the mobile device through the NFC channel, and returns to step 202.
  • the NFC dynamic token sends a write failure message "0xBB023D5B" to the mobile device.
  • the mobile device before the mobile device sends the NFC command to the NFC dynamic token, the mobile device further includes: the mobile device acquires the seed plaintext and the check value from the token server, and generates an NFC command according to the seed plaintext and the check value.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 202 and subsequent steps are performed.
  • Embodiment 2 of the present invention burns the seed key into the NFC dynamic token through the NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 3 of the present invention provides another method for programming a seed key in an NFC dynamic token. As shown in FIG. 3, the method includes the following steps:
  • Step 301 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • Step 302 The NFC dynamic token waits to receive NFC data from the mobile device.
  • Step 303 After the NFC dynamic token receives the NFC data from the mobile device, the NFC dynamic token checks the NFC data. If the verification passes, step 305 is performed; otherwise, step 304 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x440E02AFCC4F6EAC971346E6066E4D09”, where the frame header is “0x44”, the length data is “0x0E”, the command data is “0x02AFCC4F6EAC971346E6066E4D”, the check data is “0x09”, and the NFC dynamic token is based on the length data “0x0E”.
  • the command data "0x02AFCC4F6EAC971346E6066E4D" is calculated to determine whether the calculated check value is "0x09", and if so, it is determined that the check passes; otherwise, it is determined that the check fails.
  • step 304 the NFC dynamic token sends an error code to the mobile device, and returns to step 302.
  • the NFC dynamic token sends the error code "0xBB021E35" to the mobile device.
  • Step 305 The NFC dynamic token judges the NFC data. If it is the first instruction, step 306 is performed; if it is the second instruction, step 307 is performed; if it is the fourth instruction, step 312 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is the second instruction; if the command code is the fifth preset value, determining that the NFC data is the fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x02”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x02", the NFC data is determined to be the second instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 306 The NFC dynamic token encrypts the encrypted random number by using the built-in programming key, obtains the random number ciphertext, sends the random number ciphertext to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 302. .
  • the encrypted random number may be part of the data intercepted from the UTC seconds. For example, “0x1326”, the NFC dynamic token encrypts the encrypted random number by using its built-in programming key to obtain a random number ciphertext, for example, "0x5B79".
  • the mobile device after receiving the random ciphertext from the NFC dynamic token, the mobile device sends the random ciphertext to the token server, and the token server decrypts the random ciphertext by using the saved cipher key. And obtaining the encrypted random number, and encrypting the seed plaintext generated by the encrypted random number to obtain the seed ciphertext, and sending the seed ciphertext to the NFC dynamic token by using the mobile device.
  • Step 307 The NFC dynamic token obtains the seed ciphertext and the check value from the second instruction.
  • the NFC dynamic token obtains the seed ciphertext and the check value from the instruction data of the second instruction.
  • the command data is “0x02AFCC4F6EAC971346E6066E4D”
  • the NFC dynamic token acquires the seed ciphertext “0xAFCC4F6EAC971346E6” and the check value “0x6E4D” from the command data.
  • Step 308 The NFC dynamic token decrypts the seed ciphertext by using the last saved encrypted random number to obtain a seed plaintext, and calculates a check value according to the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and calculates the check value according to the seed plaintext.
  • Step 309 The NFC dynamic token determines whether the calculated check value is the same as the check value obtained from the second instruction. If yes, step 310 is performed; otherwise, step 311 is performed.
  • the NFC dynamic token determines whether the calculated check value is the same as the check value "0x6E4D" obtained from the second instruction.
  • Step 310 The NFC dynamic token saves the seed ciphertext, sends a write success message to the mobile device through the NFC channel, and returns to step 302.
  • the NFC dynamic token saves the seed ciphertext “0xAFCC4F6EAC971346E6” and sends a write success message “0xBB02CCCC” to the mobile device through the NFC channel.
  • Step 311 The NFC dynamic token sends a write failure message to the mobile device through the NFC channel, and returns to step 302.
  • the NFC dynamic token sends a write failure message "0xBB023D5B" to the mobile device.
  • Step 312 the NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 302.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • the method further includes: the mobile device acquiring the seed ciphertext and the check value from the token server, and generating the second instruction according to the seed ciphertext and the check value.
  • the method further includes: the NFC dynamic token decrypts the seed ciphertext by using the last saved encrypted random number, obtains the seed plaintext, and generates the dynamic password by using the seed plaintext.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 302 and subsequent steps are performed.
  • Embodiment 3 of the present invention writes a seed key into an NFC dynamic token through an NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 4 of the present invention provides another method for programming a seed key in an NFC dynamic token. As shown in FIG. 4, the method includes the following steps:
  • Step 401 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • Step 402 the NFC dynamic token waits to receive NFC data from the mobile device.
  • Step 403 After the NFC dynamic token receives the NFC data from the mobile device, the NFC dynamic token checks the NFC data. If the verification passes, step 405 is performed; otherwise, step 404 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x440E02AFCC4F6EAC971346E6066E4D09”, where the frame header is “0x44”, the length data is “0x0E”, the command data is “0x02AFCC4F6EAC971346E6066E4D”, the check data is “0x09”, and the NFC dynamic token is based on the length data “0x0E”.
  • the command data "0x02AFCC4F6EAC971346E6066E4D" is calculated to determine whether the calculated check value is "0x09", and if so, it is determined that the check passes; otherwise, it is determined that the check fails.
  • Step 404 the NFC dynamic token sends an error code to the mobile device, and returns to step 402.
  • the NFC dynamic token sends the error code "0xBB021E35" to the mobile device.
  • Step 405 The NFC dynamic token judges the NFC data. If it is the first instruction, step 406 is performed; if it is the second instruction, step 407 is performed; if it is the fourth instruction, step 412 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is the second instruction; if the command code is the fifth preset value, determining that the NFC data is the fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x02”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x02", the NFC data is determined to be the second instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 406 The NFC dynamic token sends an encrypted random number to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 402.
  • the encrypted random number may be part of data intercepted from UTC seconds, for example, “0x1326”.
  • the mobile device receives the encrypted random number from the NFC dynamic token, the encrypted random number is saved.
  • Step 407 The NFC dynamic token obtains the seed ciphertext and the check value from the second instruction.
  • the NFC dynamic token obtains the seed ciphertext and the check value from the instruction data of the second instruction.
  • the command data is “0x02AFCC4F6EAC971346E6066E4D”
  • the NFC dynamic token acquires the seed ciphertext “0xAFCC4F6EAC971346E6” and the check value “0x6E4D” from the command data.
  • Step 408 The NFC dynamic token decrypts the seed ciphertext by using its built-in programming key and the last saved encrypted random number to obtain a seed plaintext, and calculates a check value according to the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using its built-in programming key and the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and calculates and verifies according to the above-mentioned seed plaintext. value.
  • the token server stores the same programming key as the built-in programming key of the NFC dynamic token; accordingly, the token server uses its own saved burning key and the encrypted random number from the mobile device. Encrypting the seed plaintext generated by itself, obtaining the seed ciphertext, and sending the seed ciphertext to the NFC dynamic token through the mobile device.
  • Step 409 The NFC dynamic token determines whether the calculated check value is the same as the check value obtained from the second instruction. If yes, step 410 is performed; otherwise, step 411 is performed.
  • the NFC dynamic token determines whether the calculated check value is the same as the check value "0x6E4D" obtained from the second instruction.
  • Step 410 The NFC dynamic token saves the seed ciphertext, sends a write success message to the mobile device through the NFC channel, and returns to step 402.
  • the NFC dynamic token saves the seed ciphertext “0xAFCC4F6EAC971346E6” and sends a write success message “0xBB02CCCC” to the mobile device through the NFC channel.
  • Step 411 The NFC dynamic token sends a write failure message to the mobile device through the NFC channel, and returns to step 402.
  • the NFC dynamic token sends a write failure message "0xBB023D5B" to the mobile device.
  • Step 412 The NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 402.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • the method further includes: the mobile device acquiring the seed ciphertext and the check value from the token server, and generating the second instruction according to the seed ciphertext and the check value.
  • the method further includes: the NFC dynamic token decrypts the seed ciphertext by using the built-in burning key and the last saved encrypted random number to obtain the seed plaintext, and uses The seed plaintext generates a dynamic password.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 402 and subsequent steps are performed.
  • Embodiment 4 of the present invention burns the seed key into the NFC dynamic token through the NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 5 of the present invention provides another method for programming a seed key in an NFC dynamic token. As shown in FIG. 5, the method includes the following steps:
  • Step 501 The NFC dynamic token is powered on, the system running clock is set, and the peripheral interrupt is initialized.
  • Step 502 The NFC dynamic token determines whether an event occurs. If yes, step 505 is performed; otherwise, step 503 is performed.
  • the NFC dynamic token determines whether the event flag is set, and if so, it is determined that an event has occurred, otherwise, it is determined that no event has occurred.
  • Step 503 The NFC dynamic token closes the system running clock, enters a sleep state, and wakes up from the sleep state when an event occurs, and performs step 504.
  • Step 504 the NFC dynamic token sets the system running clock, and step 505 is performed.
  • Step 505 The NFC dynamic token determines whether a button event occurs. If yes, step 506 is performed; otherwise, step 509 is performed.
  • the NFC dynamic token determines whether the button interrupt flag is set, and if so, it is determined that a button event occurs, otherwise, it is determined that no button event occurs.
  • the button interrupt flag is also reset.
  • step 506 the NFC dynamic token determines the process identifier. If it is the first preset value, step 507 is performed; if it is the second preset value, step 508 is performed.
  • the first preset value is “01” and the second preset value is “02".
  • Step 507 The NFC dynamic token decrypts the saved seed ciphertext, generates a dynamic password by using the decrypted seed plaintext, displays the dynamic password, starts NFC communication, establishes a connection with the mobile device through the NFC channel, and sets the process identifier to the first Two preset values, and step 509 is performed.
  • the NFC dynamic token uses the encrypted cryptographic random number saved last time, decrypts the seed ciphertext saved by itself, obtains the seed plaintext, and generates a dynamic password by using the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and generates a dynamic password “355569” according to the seed plaintext, and displays the dynamic password “ 355569”, set the process ID to "02".
  • Step 508 the NFC dynamic token clearing screen is displayed, the NFC communication is closed, the process identifier is set to the first preset value, and step 509 is performed.
  • an NFC dynamic token sets the process ID to "01".
  • step 509 the NFC dynamic token determines whether an automatic clearing event has occurred. If yes, step 510 is performed; otherwise, step 511 is performed.
  • the NFC dynamic token determines whether the automatic clear screen flag is set, and if so, it is determined that an automatic clear screen event occurs, otherwise, it is determined that no automatic clear screen event occurs.
  • the automatic clear screen flag is also reset.
  • Step 510 the NFC dynamic token clearing screen is displayed, the NFC communication is turned off, and step 511 is performed.
  • Step 511 the NFC dynamic token determines whether an NFC communication event occurs, and if yes, step 512 is performed; otherwise, returns to step 502.
  • the NFC dynamic token determines whether the NFC communication interruption flag is set, and if so, determines that an NFC communication event has occurred, otherwise, determines that no NFC communication event has occurred.
  • the NFC communication interrupt identifier is also reset.
  • the NFC dynamic token resets the event flag.
  • Step 512 The NFC dynamic token acquires NFC data from the NFC buffer area, and performs verification on the NFC data. If the verification passes, step 514 is performed; otherwise, step 513 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x440E02AFCC4F6EAC971346E6066E4D09”, where the frame header is “0x44”, the length data is “0x0E”, the command data is “0x02AFCC4F6EAC971346E6066E4D”, the check data is “0x09”, and the NFC dynamic token is based on the length data “0x0E”.
  • the command data "0x02AFCC4F6EAC971346E6066E4D" is calculated to determine whether the calculated check value is "0x09", and if so, it is determined that the check passes; otherwise, it is determined that the check fails.
  • step 513 the NFC dynamic token sends an error code to the mobile device, and returns to step 502.
  • the NFC dynamic token sends the error code "0xBB021E35" to the mobile device.
  • step 514 the NFC dynamic token determines the NFC data. If it is the first instruction, step 515 is performed; if it is the second instruction, step 516 is performed; if it is the fourth instruction, step 521 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is the second instruction; if the command code is the fifth preset value, determining that the NFC data is the fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x02”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x02", the NFC data is determined to be the second instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 515 The NFC dynamic token sends an encrypted random number to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 502.
  • the encrypted random number may be part of data intercepted from UTC seconds, for example, “0x1326”.
  • Step 516 The NFC dynamic token obtains the seed ciphertext and the check value from the second instruction.
  • the NFC dynamic token obtains the seed ciphertext and the check value from the instruction data of the second instruction.
  • the command data is “0x02AFCC4F6EAC971346E6066E4D”
  • the NFC dynamic token acquires the seed ciphertext “0xAFCC4F6EAC971346E6” and the check value “0x6E4D” from the command data.
  • Step 517 The NFC dynamic token decrypts the seed ciphertext by using the last saved encrypted random number to obtain a seed plaintext, and calculates a check value according to the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and calculates the check value according to the seed plaintext.
  • Step 518 The NFC dynamic token determines whether the calculated check value is the same as the check value obtained from the second instruction. If yes, step 519 is performed; otherwise, step 520 is performed.
  • the NFC dynamic token determines whether the calculated check value is the same as the check value "0x6E4D" obtained from the second instruction.
  • Step 519 The NFC dynamic token saves the seed ciphertext, sends a write success message to the mobile device through the NFC channel, and returns to step 502.
  • the NFC dynamic token decrypts the seed ciphertext "0xAFCC4F6EAC971346E6" and sends a write success message "0xBB02CCCC" to the mobile device through the NFC channel.
  • Step 520 The NFC dynamic token sends a write failure message to the mobile device through the NFC channel, and returns to step 502.
  • the NFC dynamic token sends a write failure message "0xBB023D5B" to the mobile device.
  • Step 521 The NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 502.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • Embodiment 5 of the present invention further includes the following steps:
  • the NFC dynamic token determines whether an EPD (Electronic Paper Displays) error event has occurred and initializes the electronic paper when an EPD error event occurs. Specifically, the NFC dynamic token determines whether the EPD error flag is set, and if so, determines that an EPD error event has occurred, otherwise, determines that no EPD error event has occurred. After the NFC dynamic token determines that the EPD error flag is set, the EPD error flag is also reset.
  • EPD Electronic Paper Displays
  • the NFC dynamic token resets the event identification when the EPD error flag, the key interrupt flag, the NFC communication interrupt flag, and the automatic clear screen flag are all reset.
  • the master chip in the NFC dynamic token sends a power-on command to the electronic paper, and detects whether the Busy signal is within the first preset time period. Low level switches to high level. If not, the EPD error flag is set.
  • the master chip in the NFC dynamic token sends power to the electronic paper (power- Off) command and detect whether the Busy signal is switched from high level to low level for the second preset time period. If not, the EPD error flag and event flag are set.
  • the key interrupt identifier and the event identifier are set; after the NFC dynamic token detects the NFC communication interruption, the NFC data received through the NFC channel is stored in the NFC buffer area, and the NFC communication is interrupted. The identifier and the event identifier are set; after the RTC interrupt is detected, the NFC dynamic token updates the second count and determines whether the second count reaches the preset number. If yes, the dynamic factor is updated, the automatic clear screen identifier and the event identifier are set, and Initialize the number of RTC interrupts.
  • the RTC interrupt occurs once every second, and the preset number of times is 60 times.
  • the second count is incremented by one; after the second count reaches 60 times, the NFC dynamic token initializes the second count to zero; after the NFC dynamic token obtains the first instruction from the NFC data, the second The count is sent to the mobile device as an encrypted random number.
  • Embodiment 5 of the present invention burns the seed key into the NFC dynamic token through the NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 6 of the present invention further provides an NFC dynamic token, as shown in FIG. 6, including:
  • the detecting module 610 is configured to detect whether the preset button is triggered
  • the connection module 620 is configured to enable NFC communication after the detection module 610 detects that the preset button is triggered, and establish a connection with the mobile device through the NFC channel;
  • the receiving module 630 is configured to receive a second instruction from the mobile device.
  • An obtaining module 640 configured to obtain a seed key from the second instruction
  • the storage module 650 is configured to save the seed key.
  • the sending module 660 is configured to send a write success message to the mobile device by using the NFC channel.
  • the seed key may be a seed plaintext
  • the obtaining module 640 is further configured to obtain a check value from the second instruction
  • the above NFC dynamic token also includes:
  • a calculation module configured to calculate a check value according to the seed plaintext
  • a determining module configured to determine whether the check value calculated by the calculating module is the same as the check value obtained by the obtaining module 640 from the second instruction
  • the storage module 650 is configured to save the seed plaintext when the check value calculated by the calculation module is the same as the check value obtained by the obtaining module 640 from the second instruction.
  • the seed key may also be a seed ciphertext
  • the obtaining module 640 is further configured to obtain a check value from the second instruction
  • the above NFC dynamic token also includes:
  • a decryption module configured to decrypt the seed ciphertext by using the last saved encrypted random number to obtain a seed plaintext
  • a calculation module configured to calculate a check value according to the seed plaintext
  • a determining module configured to determine whether the check value calculated by the calculating module is the same as the check value obtained by the obtaining module 640 from the second instruction
  • the storage module 650 is configured to save the seed plaintext when the check value calculated by the calculation module is the same as the check value obtained by the obtaining module 640 from the second instruction.
  • the receiving module 630 is further configured to receive a first instruction from the mobile device
  • the sending module 660 is further configured to send the encrypted random number to the mobile device by using the NFC channel;
  • the storage module 650 is further configured to save the encrypted random number.
  • the receiving module 630 is further configured to receive a first instruction from the mobile device
  • the storage module 650 is further configured to save the programming key
  • the above NFC dynamic token also includes:
  • An encryption module configured to encrypt the encrypted random number by using a programming key to obtain a random number ciphertext
  • the sending module 660 is further configured to send the random number ciphertext to the mobile device by using the NFC channel;
  • the storage module 650 is further configured to save the encrypted random number.
  • the receiving module 630 is further configured to receive a fourth instruction from the mobile device
  • the sending module 660 is further configured to send the token serial number to the mobile device through the NFC channel.
  • the detecting module 610 is specifically configured to determine that a button event occurs, and if yes, determine that the preset button is triggered; otherwise, determine that the preset button is not triggered;
  • the above NFC dynamic token also includes:
  • a determining module configured to determine, after the detecting module 610 determines that a button event occurs, the process identifier is determined;
  • the connection module 620 is specifically configured to: when the determining module determines that the process identifier is the first preset value, enable NFC communication, and establish a connection with the mobile device through the NFC channel.
  • NFC dynamic token further includes:
  • a setting module configured to set the process identifier to a second preset value after the determining module determines that the process identifier is the first preset value
  • the clearing module is configured to clear the screen display, close the NFC communication, and set the process identifier to the first preset value after the determining module determines that the process identifier is the second preset value.
  • the seed key is a seed ciphertext
  • the obtaining module 640 is further configured to obtain a check value from the second instruction
  • the storage module 650 is further configured to save the programming key
  • NFC dynamic tokens including:
  • a decryption module configured to decrypt the seed ciphertext by using a burn-in key and a recently saved encrypted random number to obtain a seed plaintext
  • a calculation module configured to calculate a check value according to the seed plaintext
  • a determining module configured to determine whether the check value calculated by the calculating module is the same as the check value obtained by the obtaining module 640 from the second instruction
  • the storage module 650 is configured to save the seed ciphertext when the check value calculated by the calculation module is the same as the check value obtained by the obtaining module 640 from the second instruction.
  • the receiving module 630 is further configured to receive a first instruction from the mobile device
  • the sending module 660 is further configured to send the encrypted random number to the mobile device by using the NFC channel;
  • the storage module 650 is further configured to save the encrypted random number.
  • Embodiment 6 of the present invention burns the seed key into the NFC dynamic token through the NFC channel, which improves the security and flexibility of the dynamic token.
  • Embodiment 7 of the present invention further provides a working method of an NFC dynamic token, as shown in FIG. 7, comprising the following steps:
  • Step 701 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • step 702 the NFC dynamic token waits to receive NFC data from the mobile device.
  • Step 703 After the NFC dynamic token receives the NFC data from the mobile device, the NFC dynamic token checks the NFC data. If the verification passes, step 705 is performed; otherwise, step 704 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x44020110”, and includes a frame header “0x44”, a length data “0x02”, an instruction data “0x01”, and a check data “0x10”, and the NFC dynamic token is based on the length data “0x02” and the instruction data “0x01”.
  • the calculation is performed to determine whether the calculated check value is "0x10", and if so, it is determined that the check is passed; otherwise, it is determined that the check fails.
  • Step 704 the NFC dynamic token sends an error code to the mobile terminal, and returns to step 702.
  • the NFC dynamic token sends an error code "0xBB021E35" to the mobile terminal.
  • Step 705 The NFC dynamic token determines the NFC data. If it is the first instruction, step 706 is performed; if it is the third instruction, step 707 is performed; if it is the fourth instruction, step 709 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is a third instruction; if the command code is a fifth preset value, determining that the NFC data is a fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x03”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x03", the NFC data is determined to be the third instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 706 The NFC dynamic token sends the encrypted random number to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 702.
  • the encrypted random number may be part of data intercepted from UTC seconds, for example, “0x1326”.
  • the mobile device After receiving the encrypted random number from the NFC dynamic token, the mobile device saves the encrypted random number.
  • Step 707 The NFC dynamic token decrypts the seed ciphertext saved by using the encrypted cryptographic random number saved last time, obtains the seed plaintext, generates a dynamic password by using the seed plaintext, and displays the dynamic password.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, generates a dynamic password “355569” according to the seed plaintext, and displays the dynamic password “ 355569”.
  • Step 708 the NFC dynamic token sends the dynamic password to the mobile device through the NFC channel, and returns to step 702.
  • the NFC dynamic token sends the dynamic password "355569" to the mobile device over the NFC channel.
  • Step 709 The NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 702.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 702 and subsequent steps are performed.
  • the seventh embodiment of the present invention sends the dynamic password generated by the NFC dynamic token to the mobile device through the NFC channel, which prevents the user from making mistakes and leaks when manually inputting the dynamic password, thereby improving the security of the dynamic token.
  • Embodiment 8 of the present invention further provides another working method of the NFC dynamic token, as shown in FIG. 8, comprising the following steps:
  • Step 801 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • the NFC dynamic token is waiting to receive an NFC command from the mobile device.
  • Step 803 After the NFC dynamic token receives the NFC command from the mobile device, the NFC dynamic token checks the NFC command. If the check passes, step 805 is performed; otherwise, step 804 is performed.
  • the NFC instruction includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the instruction data.
  • Calculate obtain the check value, determine whether the check value is the same as the value of the check data. If they are the same, determine that the NFC command check passes; otherwise, determine that the NFC command check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC instruction is "0x44020110", and includes a frame header "0x44", a length data "0x02", an instruction data "0x01”, and a check data "0x10”, and the NFC dynamic token is based on the length data "0x02" and the instruction data "0x01".
  • the calculation is performed to determine whether the calculated check value is "0x10", and if so, it is determined that the check is passed; otherwise, it is determined that the check fails.
  • Step 804 The NFC dynamic token sends an error code to the mobile terminal, and returns to step 802.
  • the NFC dynamic token sends an error code "0xBB021E35" to the mobile terminal.
  • step 805 the NFC dynamic token generates a dynamic password by using the seed plaintext saved by itself.
  • the NFC dynamic token generates a dynamic password "355569" using its own saved seed plaintext "0x8D5828922FEBFC8597".
  • Step 806 the NFC dynamic token sends the dynamic password to the mobile device through the NFC channel, and returns to step 802.
  • the NFC dynamic token sends the dynamic password "355569" to the mobile device over the NFC channel.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 802 and subsequent steps are performed.
  • the dynamic password generated by the NFC dynamic token is sent to the mobile device through the NFC channel, which prevents the user from making errors and leaks when manually inputting the dynamic password, thereby improving the security of the dynamic token.
  • Embodiment 9 of the present invention further provides a working method of another NFC dynamic token, as shown in FIG. 9, comprising the following steps:
  • Step 901 After detecting that the preset button is triggered, the NFC dynamic token starts NFC communication, and establishes a connection with the mobile device through the NFC channel.
  • Step 902 the NFC dynamic token waits to receive an NFC command from the mobile device.
  • Step 903 After the NFC dynamic token receives the NFC command from the mobile device, the NFC dynamic token decrypts the seed ciphertext saved by using the encrypted cryptographic random number saved last time, obtains the seed plaintext, and generates the plaintext using the seed. Dynamic password.
  • the NFC command is “0x44020110”
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and generates a dynamic password according to the seed plaintext described above. 355569".
  • Step 904 The NFC dynamic token sends the dynamic password to the mobile device through the NFC channel, and returns to step 902.
  • the NFC dynamic token sends the dynamic password "355569" to the mobile device over the NFC channel.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, clears the screen display, and turns off the NFC communication.
  • the method further includes: after the NFC dynamic token detects that the preset button is triggered, the NFC communication is started, and step 902 and subsequent steps are performed.
  • the embodiment 9 of the present invention sends the dynamic password generated by the NFC dynamic token to the mobile device through the NFC channel, thereby preventing the user from making mistakes and leaking when manually inputting the dynamic password, thereby improving the security of the dynamic token.
  • Embodiment 10 of the present invention further provides a working method of another NFC dynamic token, as shown in FIG. 10, including the following steps:
  • step 1001 the NFC dynamic token is powered on, the system running clock is set, and the peripheral interrupt is initialized.
  • step 1002 the NFC dynamic token determines whether an event has occurred. If yes, step 1005 is performed; otherwise, step 1003 is performed.
  • the NFC dynamic token determines whether the event flag is set, and if so, it is determined that an event has occurred, otherwise, it is determined that no event has occurred.
  • Step 1003 The NFC dynamic token turns off the system running clock, enters a sleep state, and wakes up from the sleep state when an event occurs, and performs step 1004.
  • Step 1004 the NFC dynamic token sets the system running clock, and step 1005 is performed.
  • step 1005 the NFC dynamic token determines whether a button event has occurred. If yes, step 1006 is performed; otherwise, step 1009 is performed.
  • the NFC dynamic token determines whether the button interrupt flag is set, and if so, it is determined that a button event occurs, otherwise, it is determined that no button event occurs.
  • the button interrupt flag is also reset.
  • step 1006 the NFC dynamic token determines the process identifier. If it is the first preset value, step 1007 is performed; if it is the second preset value, step 1008 is performed.
  • the first preset value is “01” and the second preset value is “02".
  • Step 1007 The NFC dynamic token decrypts the saved seed ciphertext, generates a dynamic password by using the decrypted seed plaintext, displays the dynamic password, starts NFC communication, establishes a connection with the mobile device through the NFC channel, and sets the process identifier to the first Two preset values, and step 1009 is performed.
  • the NFC dynamic token uses the encrypted cryptographic random number saved last time, decrypts the seed ciphertext saved by itself, obtains the seed plaintext, and generates a dynamic password by using the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and generates a dynamic password “355569” according to the seed plaintext, and displays the dynamic password “ 355569”, set the process ID to "02".
  • Step 1008 The NFC dynamic token clearing screen is displayed, the NFC communication is closed, the process identifier is set to the first preset value, and step 1009 is performed.
  • an NFC dynamic token sets the process ID to "01".
  • step 1009 the NFC dynamic token determines whether an automatic clearing event has occurred. If yes, step 1010 is performed; otherwise, step 1011 is performed.
  • the NFC dynamic token determines whether the automatic clear screen flag is set, and if so, it is determined that an automatic clear screen event occurs, otherwise, it is determined that no automatic clear screen event occurs.
  • the automatic clear screen flag is also reset.
  • step 1010 the NFC dynamic token clear screen is displayed, the NFC communication is closed, and step 1011 is performed.
  • Step 1011 The NFC dynamic token determines whether an NFC communication event occurs. If yes, step 1012 is performed; otherwise, step 1002 is returned.
  • the NFC dynamic token determines whether the NFC communication interruption flag is set, and if so, determines that an NFC communication event has occurred, otherwise, determines that no NFC communication event has occurred.
  • the NFC communication interrupt identifier is also reset.
  • the NFC dynamic token resets the event flag.
  • Step 1012 The NFC dynamic token acquires NFC data from the NFC buffer area, and performs verification on the NFC data. If the verification passes, step 1014 is performed; otherwise, step 1013 is performed.
  • the NFC data includes a frame header, a length data, an instruction data, and a check data
  • the length data is a sum of the lengths of the instruction data and the check data; accordingly, the NFC dynamic token can be performed according to the length data and the command data.
  • Calculate obtain a check value, determine whether the check value is the same as the value of the check data, if the same, determine that the NFC data check passes; otherwise, determine that the NFC data check fails.
  • the length of the frame header is 1 byte
  • the length of the length data is 1 byte
  • the length of the check data is 1 byte.
  • the NFC data is “0x44020110”, and includes a frame header “0x44”, a length data “0x02”, an instruction data “0x01”, and a check data “0x10”, and the NFC dynamic token is based on the length data “0x02” and the instruction data “0x01”.
  • the calculation is performed to determine whether the calculated check value is "0x10", and if so, it is determined that the check is passed; otherwise, it is determined that the check fails.
  • step 1013 the NFC dynamic token sends an error code to the mobile terminal, and returns to step 1002.
  • the NFC dynamic token sends an error code "0xBB021E35" to the mobile terminal.
  • step 1014 the NFC dynamic token determines the NFC data. If it is the first instruction, step 1015 is performed; if it is the third instruction, step 1016 is performed; if it is the fourth instruction, step 1018 is performed.
  • the NFC dynamic token acquires the command code in the instruction data, and determines the command code. If the command code is the third preset value, determining that the NFC data is the first instruction; if the command code is the fourth The preset value determines that the NFC data is a third instruction; if the command code is a fifth preset value, determining that the NFC data is a fourth instruction.
  • the third preset value is “0x01”
  • the fourth preset value is “0x03”
  • the fifth preset value is “0x04”
  • the NFC dynamic token judges the command code in the instruction data, if the command code If it is "0x01”, it is determined that the NFC data is the first instruction; if the command code is "0x03", the NFC data is determined to be the third instruction; if the command code is "0x04", the NFC data is determined to be the first Four instructions.
  • Step 1015 The NFC dynamic token sends an encrypted random number to the mobile device through the NFC channel, saves the encrypted random number, and returns to step 402.
  • the encrypted random number may be part of data intercepted from UTC seconds, for example, “0x1326”.
  • Step 1016 The NFC dynamic token decrypts the seed ciphertext saved by using the cryptographic random number saved last time, obtains the seed plaintext, and generates a dynamic password by using the seed plaintext.
  • the NFC dynamic token decrypts the seed ciphertext “0xAFCC4F6EAC971346E6” using the last saved encrypted random number “0x1326” to obtain the seed plaintext “0x8D5828922FEBFC8597”, and generates a dynamic password “355569” according to the seed plaintext.
  • step 1017 the NFC dynamic token sends the dynamic password to the mobile device through the NFC channel, and returns to step 1002.
  • the NFC dynamic token sends the dynamic password "355569" to the mobile device over the NFC channel.
  • Step 1018 The NFC dynamic token sends the token serial number to the mobile device through the NFC channel, and returns to step 1002.
  • the NFC dynamic token sends its own saved token serial number "15357" to the mobile device through the NFC channel.
  • Embodiment 10 of the present invention further includes the following steps:
  • the NFC dynamic token determines whether an EPD (Electronic Paper Displays) error event has occurred and initializes the electronic paper when an EPD error event occurs. Specifically, the NFC dynamic token determines whether the EPD error flag is set, and if so, determines that an EPD error event has occurred, otherwise, determines that no EPD error event has occurred. After the NFC dynamic token determines that the EPD error flag is set, the EPD error flag is also reset.
  • EPD Electronic Paper Displays
  • the NFC dynamic token resets the event identification when the EPD error flag, the key interrupt flag, the NFC communication interrupt flag, and the automatic clear screen flag are all reset.
  • the master chip in the NFC dynamic token sends a power-on command to the electronic paper, and detects whether the Busy signal is within the first preset time period. Low level switches to high level. If not, the EPD error flag is set.
  • the master chip in the NFC dynamic token sends power to the electronic paper (power- Off) command and detect whether the Busy signal is switched from high level to low level for the second preset time period. If not, the EPD error flag and event flag are set.
  • the key interrupt identifier and the event identifier are set; after the NFC dynamic token detects the NFC communication interruption, the NFC data received through the NFC channel is stored in the NFC buffer area, and the NFC communication is interrupted. The identifier and the event identifier are set; after the RTC interrupt is detected, the NFC dynamic token updates the second count and determines whether the second count reaches the preset number. If yes, the dynamic factor is updated, the automatic clear screen identifier and the event identifier are set, and Initialize the number of RTC interrupts.
  • the RTC interrupt occurs once every second, and the preset number of times is 60 times.
  • the second count is incremented by one; after the second count reaches 60 times, the NFC dynamic token initializes the second count to zero; after the NFC dynamic token obtains the first instruction from the NFC data, the NFC dynamic token can be The second count is sent to the mobile device as an encrypted random number.
  • the dynamic password generated by the NFC dynamic token is sent to the mobile device through the NFC channel, which prevents the user from making mistakes and leaks when manually inputting the dynamic password, thereby improving the security of the dynamic token.
  • the embodiment 11 of the present invention further provides an NFC dynamic token, as shown in FIG. include:
  • the detecting module 1110 is configured to detect whether the preset button is triggered.
  • the connection module 1120 is configured to enable NFC communication after the detection module 1110 detects that the preset button is triggered, and establish a connection with the mobile device through the NFC channel;
  • the receiving module 1130 is configured to receive a third instruction from the mobile device.
  • the generating module 1140 generates a dynamic password by using the seed data saved by itself;
  • the sending module 1150 is configured to send the dynamic password to the mobile device through the NFC channel.
  • NFC dynamic token further includes:
  • Display module for displaying dynamic passwords.
  • the seed data saved by the NFC dynamic token may be a seed ciphertext
  • the generating module 1140 is specifically configured to decrypt the seed ciphertext saved by using the cryptographic random number saved last time, obtain the seed plaintext, and generate the dynamic password by using the seed plaintext.
  • the receiving module 1130 is further configured to receive a first instruction from the mobile device.
  • the sending module 1150 is further configured to send an encrypted random number to the mobile device by using an NFC channel, and save the encrypted random number.
  • the receiving module 1130 is further configured to receive a fourth instruction from the mobile device
  • the sending module 1150 is further configured to send a token serial number to the mobile device by using an NFC channel.
  • the detecting module 1110 is specifically configured to determine whether a button event occurs, and if yes, determine that the preset button is triggered; otherwise, determine that the preset button is not triggered;
  • NFC dynamic token further includes:
  • a determining module configured to determine, after the detecting module 1110 determines that a button event occurs, the process identifier is determined;
  • the connection module 1120 is specifically configured to: when the determining module determines that the process identifier is the first preset value, enable NFC communication, and establish a connection with the mobile device through the NFC channel.
  • NFC dynamic token further includes:
  • a setting module configured to set the process identifier to a second preset value after the determining module determines that the process identifier is the first preset value
  • the clearing module is configured to clear the screen display, close the NFC communication, and set the process identifier to the first preset value after the determining module determines that the process identifier is the second preset value.
  • the dynamic password generated by the NFC dynamic token is sent to the mobile device through the NFC channel, which prevents the user from making mistakes and leaks when manually inputting the dynamic password, thereby improving the security of the dynamic token.
  • the steps in the method described in connection with the various embodiments disclosed in the present invention can be implemented directly in hardware, a software module executed by a processor, or a combination of both.
  • the software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种NFC动态令牌的工作方法，包括以下步骤：所述NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；当所述NFC动态令牌接收来自所述移动设备的第二指令时，所述NFC动态令牌从所述第二指令中获取种子密钥，对所述种子密钥进行保存，并通过NFC通道向所述移动设备发送写入成功消息；当所述NFC动态令牌接收来自所述移动设备的第三指令时，所述NFC动态令牌使用自身保存的种子数据生成动态口令，并通过NFC通道将所述动态口令发送给所述移动设备。本发明通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。

Description

一种NFC动态令牌及其工作方法 技术领域
本发明涉及一种NFC(Near Field Communication，近场通信)动态令牌及其工作方法，属于信息安全领域。术语“种子数据”可以是“种子密钥”。
背景技术
动态令牌是一种用于生成动态口令的设备，广泛应用于网银、电信运营商和电子政务等应用领域。动态令牌所生成的动态口令可用于身份认证，能够有效提高身份认证的安全性。现有技术中，动态令牌出厂前，其生成动态口令所必需的种子密钥是由动态令牌的生产厂商烧写到动态令牌中的。在动态令牌的使用过程中，无法根据用户的需求更新动态令牌中的种子密钥，灵活性和安全性较差。现有技术中，动态令牌生成动态口令后，需要由用户将动态口令手动输入到网页或者客户端，容易出错，且安全性较差。
发明内容
本发明的目的是提供一种NFC动态令牌以及工作方法，其通过NFC通道将种子密钥烧写到NFC动态令牌中，以提高动态令牌的安全性和灵活性。
为此，根据本发明的一个方面，提供了一种在NFC动态令牌的工作方法，其包括以下步骤：
NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
当所述NFC动态令牌接收来自所述移动设备的第二指令时，所述NFC动态令牌从所述第二指令中获取种子密钥，对所述种子密钥进行保存，并通过NFC通道向所述移动设备发送写入成功消息；
当所述NFC动态令牌接收来自所述移动设备的第三指令时，所述NFC动态令牌使用自身保存的种子数据生成动态口令，并通过NFC通道将所述动态口令发送给所述移动设备。
根据本发明的另外一个方面，还提供了一种NFC动态令牌，包括：
检测模块，用于检测预设按键是否被触发；
连接模块，用于在所述检测模块检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
接收模块，用于接收来自所述移动设备的第二指令或第三指令；
获取模块，用于从所述第二指令中获取种子密钥；
存储模块，用于对所述种子密钥进行保存；
生成模块，用于使用保存的种子数据生成动态口令；以及
发送模块，用于通过NFC通道向所述移动设备发送写入成功消息或者通过NFC通道将所述动态口令发送給所述移动设备。
根据本发明，通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
附图说明
图1为根据本发明实施例1的一种在NFC动态令牌中烧写种子密钥的方法流程图；
图2为根据本发明实施例2的另一种在NFC动态令牌中烧写种子密钥的方法流程图；
图3为根据本发明实施例3的又一种在NFC动态令牌中烧写种子密钥的方法流程图；
图4为根据本发明实施例4的又一种在NFC动态令牌中烧写种子密钥的方法流程图；
图5为根据本发明实施例5的又一种在NFC动态令牌中烧写种子密钥的方法流程图；
图6为根据本发明实施例6的一种NFC动态令牌的模块组成框图；
图7为根据本发明实施例7的一种NFC动态令牌的工作方法流程图；
图8为根据本发明实施例8的另一种NFC动态令牌的工作方法流程图；
图9为根据本发明实施例9的又一种NFC动态令牌的工作方法流程图；
图10为根据本发明实施例10的再一种NFC动态令牌的工作方法流程图；
图11为根据本发明实施例11的一种NFC动态令牌的结构示意图。
具体实施方式
下面将结合附图，对本发明的技术方案进行清楚、完整地描述，显然，所描述的各实施例仅仅是本发明的一部分实施例，而不是全部的实施例。基于本发明的实施例，本领域的技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明的实施例1提供了一种在NFC动态令牌中烧写种子密钥的方法，如图1所示，包括以下步骤：
步骤101，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤102，NFC动态令牌等待接收来自移动设备的NFC数据。
步骤103，当NFC动态令牌接收到来自移动设备的NFC数据后，NFC动态令牌对NFC数据进行校验，如果校验通过，则执行步骤105；否则，执行步骤104。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例1中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x440E02AFCC4F6EAC971346E6066E4D09”，其中，帧头为“0x44”、长度数据为“0x0E”、指令数据为“0x02AFCC4F6EAC971346E6066E4D”、校验数据为“0x09”，NFC动态令牌根据长度数据“0x0E”和指令数据“0x02AFCC4F6EAC971346E6066E4D”进行计算，判断计算得到的校验值是否为“0x09”，如果是，则确定校验通过；否则，确定校验未通过。
步骤104，NFC动态令牌向移动设备发送错误码，并返回步骤102。
例如，NFC动态令牌向移动设备发送错误码“0xBB021E35”。
步骤105，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤106；如果是第二指令，则执行步骤107；如果是第四指令，则执行步骤112。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第二指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x02”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x02”，则确定该NFC数据为第二指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤106，NFC动态令牌通过NFC通道向移动设备发送加密随机数，保存该加密随机数，并返回步骤102。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”。
需要说明的是，移动设备接收到来自NFC动态令牌的加密随机数之后，对该加密随机数进行保存。
步骤107，NFC动态令牌从第二指令中获取种子密文和校验值。
具体地，NFC动态令牌从第二指令的指令数据中获取种子密文和校验值。
例如，指令数据为“0x02AFCC4F6EAC971346E6066E4D”，NFC动态令牌从指令数据中获取种子密文“0xAFCC4F6EAC971346E6”和校验值“0x6E4D”。
步骤108，NFC动态令牌使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并根据该种子明文计算校验值。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文计算校验值。
步骤109，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值相同，如果是，则执行步骤110；否则，执行步骤111。
例如，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值“0x6E4D”相同。
步骤110，NFC动态令牌对种子密文进行保存，通过NFC通道向移动设备发送写入成功消息，并返回步骤102。
例如，NFC动态令牌对种子密文“0xAFCC4F6EAC971346E6”进行保存，通过NFC通道向移动设备发送写入成功消息“0xBB02CCCC”。
步骤111，NFC动态令牌通过NFC通道向移动设备发送写入失败消息，并返回步骤102。
例如，NFC动态令牌向移动设备发送写入失败消息“0xBB023D5B”。
步骤112，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤102。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，移动设备向NFC动态令牌发送第二指令之前，还包括：移动设备获取来自令牌服务器的种子密文和校验值，根据种子密文和校验值生成第二指令。
另外，NFC动态令牌对种子密文进行保存之后，还包括：NFC动态令牌使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并使用种子明文生成动态口令。
此外，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤102及后续步骤。
本发明的实施例1通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
本发明的实施例2提供了另一种NFC动态令牌的工作方法，如图2所示，包括以下步骤：
步骤201，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤202，NFC动态令牌等待接收来自移动设备的NFC指令。
步骤203，当NFC动态令牌接收到来自移动设备的NFC指令后，NFC动态令牌对NFC指令进行校验，如果校验通过，则执行步骤205；否则，执行步骤204。
其中，NFC指令包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC指令校验通过；否则，确定NFC指令校验未通过。
本实施例2中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC指令为“0x440E028D5828922FEBFC8597063B5315”，其中，帧头为“0x44”、长度数据为“0x0E”、指令数据为“0x028D5828922FEBFC8597063B53”、校验数据为“0x15”，NFC动态令牌根据长度数据“0x0E”和指令数据“0x028D5828922FEBFC8597063B53”进行计算，判断计算得到的校验值是否为“0x15”，如果是，则确定校验通过；否则，确定校验未通过。
步骤204，NFC动态令牌向移动设备发送错误码，并返回步骤202。
例如，NFC动态令牌向移动设备发送错误码“0xBB021E35”。
步骤205，NFC动态令牌从NFC指令中获取种子明文和校验值。
具体地，NFC动态令牌从NFC指令的指令数据中获取种子明文和校验值。
例如，指令数据为“0x028D5828922FEBFC8597063B53”，NFC动态令牌从指令数据中获取种子密文“0x8D5828922FEBFC8597”和校验值“0x3B53”。
步骤206，NFC动态令牌根据种子明文计算校验值。
例如，NFC动态令牌根据种子明文“0x8D5828922FEBFC8597”计算校验值。
步骤207，NFC动态令牌判断计算得到的校验值是否与从NFC指令中获取的校验值相同，如果是，则执行步骤208；否则，执行步骤209。
例如，NFC动态令牌判断计算得到的校验值是否与从NFC指令中获取的校验值“0x3B53”相同。
步骤208，NFC动态令牌对种子明文进行保存，通过NFC通道向移动设备发送写入成功消息，并返回步骤202。
例如，NFC动态令牌对种子明文“0x8D5828922FEBFC8597”进行保存，通过NFC通道向移动设备发送写入成功消息“0xBB02CCCC”。
步骤209，NFC动态令牌通过NFC通道向移动设备发送写入失败消息，并返回步骤202。
例如，NFC动态令牌向移动设备发送写入失败消息“0xBB023D5B”。
需要说明的是，移动设备向NFC动态令牌发送NFC指令之前，还包括：移动设备获取来自令牌服务器的种子明文和校验值，根据种子明文和校验值生成NFC指令。
此外，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤202及后续步骤。
本发明的实施例2通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
本发明的实施例3提供了又一种在NFC动态令牌中烧写种子密钥的方法，如图3所示，包括以下步骤：
步骤301，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤302，NFC动态令牌等待接收来自移动设备的NFC数据。
步骤303，当NFC动态令牌接收到来自移动设备的NFC数据后，NFC动态令牌对NFC数据进行校验，如果校验通过，则执行步骤305；否则，执行步骤304。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例3中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x440E02AFCC4F6EAC971346E6066E4D09”，其中，帧头为“0x44”、长度数据为“0x0E”、指令数据为“0x02AFCC4F6EAC971346E6066E4D”，校验数据为“0x09”，NFC动态令牌根据长度数据“0x0E”和指令数据“0x02AFCC4F6EAC971346E6066E4D”进行计算，判断计算得到的校验值是否为“0x09”，如果是，则确定校验通过；否则，确定校验未通过。
步骤304，NFC动态令牌向移动设备发送错误码，并返回步骤302。
例如，NFC动态令牌向移动设备发送错误码“0xBB021E35”。
步骤305，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤306；如果是第二指令，则执行步骤307；如果是第四指令，则执行步骤312。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第二指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x02”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x02”，则确定该NFC数据为第二指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤306，NFC动态令牌使用自身内置的烧写密钥对加密随机数进行加密，得到随机数密文，通过NFC通道向移动设备发送随机数密文，保存该加密随机数，并返回步骤302。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”，NFC动态令牌使用自身内置的烧写密钥对加密随机数进行加密，得到随机数密文，例如，“0x5B79”。
需要说明的是，移动设备接收到来自NFC动态令牌的随机数密文之后，将随机数密文发送给令牌服务器，令牌服务器使用自身保存的烧写密钥对随机数密文进行解密，得到加密随机数，并使用该加密随机数对自身生成的种子明文进行加密，得到种子密文，通过移动设备将种子密文发送给NFC动态令牌。
步骤307，NFC动态令牌从第二指令中获取种子密文和校验值。
具体地，NFC动态令牌从第二指令的指令数据中获取种子密文和校验值。
例如，指令数据为“0x02AFCC4F6EAC971346E6066E4D”，NFC动态令牌从指令数据中获取种子密文“0xAFCC4F6EAC971346E6”和校验值“0x6E4D”。
步骤308，NFC动态令牌使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并根据该种子明文计算校验值。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文计算校验值。
步骤309，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值相同，如果是，则执行步骤310；否则，执行步骤311。
例如，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值“0x6E4D”相同。
步骤310，NFC动态令牌对种子密文进行保存，通过NFC通道向移动设备发送写入成功消息，并返回步骤302。
例如，NFC动态令牌对种子密文“0xAFCC4F6EAC971346E6”进行保存，通过NFC通道向移动设备发送写入成功消息“0xBB02CCCC”。
步骤311，NFC动态令牌通过NFC通道向移动设备发送写入失败消息，并返回步骤302。
例如，NFC动态令牌向移动设备发送写入失败消息“0xBB023D5B”。
步骤312，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤302。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，移动设备向NFC动态令牌发送第二指令之前，还包括：移动设备获取来自令牌服务器的种子密文和校验值，根据种子密文和校验值生成第二指令。
另外，NFC动态令牌对种子密文进行保存之后，还包括：NFC动态令牌使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并使用种子明文生成动态口令。
此外，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤302及后续步骤。
本发明的实施例3通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
本发明的实施例4提供了又一种在NFC动态令牌中烧写种子密钥的方法，如图4所示，包括以下步骤：
步骤401，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤402，NFC动态令牌等待接收来自移动设备的NFC数据。
步骤403，当NFC动态令牌接收到来自移动设备的NFC数据后，NFC动态令牌对NFC数据进行校验，如果校验通过，则执行步骤405；否则，执行步骤404。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例4中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x440E02AFCC4F6EAC971346E6066E4D09”，其中，帧头为“0x44”、长度数据为“0x0E”、指令数据为“0x02AFCC4F6EAC971346E6066E4D”、校验数据为“0x09”，NFC动态令牌根据长度数据“0x0E”和指令数据“0x02AFCC4F6EAC971346E6066E4D”进行计算，判断计算得到的校验值是否为“0x09”，如果是，则确定校验通过；否则，确定校验未通过。
步骤404，NFC动态令牌向移动设备发送错误码，并返回步骤402。
例如，NFC动态令牌向移动设备发送错误码“0xBB021E35”。
步骤405，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤406；如果是第二指令，则执行步骤407；如果是第四指令，则执行步骤412。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第二指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x02”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x02”，则确定该NFC数据为第二指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤406，NFC动态令牌通过NFC通道向移动设备发送加密随机数，保存该加密随机数，并返回步骤402。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”。
需要说明的是，移动设备接收到来自NFC动态令牌的加密随机数之后，对该加密随机数进行保存。
步骤407，NFC动态令牌从第二指令中获取种子密文和校验值。
具体地，NFC动态令牌从第二指令的指令数据中获取种子密文和校验值。
例如，指令数据为“0x02AFCC4F6EAC971346E6066E4D”，NFC动态令牌从指令数据中获取种子密文“0xAFCC4F6EAC971346E6”和校验值“0x6E4D”。
步骤408，NFC动态令牌使用自身内置的烧写密钥和最近一次保存的加密随机数，对种子密文进行解密，得到种子明文，并根据该种子明文计算校验值。
例如，NFC动态令牌使用自身内置的烧写密钥和最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文计算校验值。
需要说明的是，令牌服务器保存有与NFC动态令牌内置的烧写密钥相同的烧写密钥；相应地，令牌服务器使用自身保存的烧写密钥以及来自移动设备的加密随机数，对自身生成的种子明文进行加密，得到种子密文，并通过移动设备将种子密文发送给NFC动态令牌。
步骤409，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值相同，如果是，则执行步骤410；否则，执行步骤411。
例如，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值“0x6E4D”相同。
步骤410，NFC动态令牌对种子密文进行保存，通过NFC通道向移动设备发送写入成功消息，并返回步骤402。
例如，NFC动态令牌对种子密文“0xAFCC4F6EAC971346E6”进行保存，通过NFC通道向移动设备发送写入成功消息“0xBB02CCCC”。
步骤411，NFC动态令牌通过NFC通道向移动设备发送写入失败消息，并返回步骤402。
例如，NFC动态令牌向移动设备发送写入失败消息“0xBB023D5B”。
步骤412，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤402。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，移动设备向NFC动态令牌发送第二指令之前，还包括：移动设备获取来自令牌服务器的种子密文和校验值，根据种子密文和校验值生成第二指令。
另外，NFC动态令牌对种子密文进行保存之后，还包括：NFC动态令牌使用自身内置的烧写密钥和最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并使用种子明文生成动态口令。
此外，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤402及后续步骤。
本发明的实施例4通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
本发明的实施例5提供了又一种在NFC动态令牌中烧写种子密钥的方法，如图5所示，包括以下步骤：
步骤501，NFC动态令牌上电，设置系统运行时钟，初始化外设中断。
步骤502，NFC动态令牌判断是否有事件发生，如果有，则执行步骤505；否则，执行步骤503。
具体地，NFC动态令牌判断事件标识是否置位，如果是，则确定有事件发生，否则，确定没有事件发生。
步骤503，NFC动态令牌关闭系统运行时钟，进入休眠状态，并在有事件发生时，从休眠状态中唤醒，执行步骤504。
步骤504，NFC动态令牌设置系统运行时钟，并执行步骤505。
步骤505，NFC动态令牌判断是否有按键事件发生，如果是，则执行步骤506；否则，执行步骤509。
具体地，NFC动态令牌判断按键中断标识是否置位，如果是，则确定有按键事件发生，否则，确定没有按键事件发生。
需要说明的是，NFC动态令牌判断按键中断标识置位之后，还会对按键中断标识复位。
步骤506，NFC动态令牌对流程标识进行判断，如果是第一预设值，则执行步骤507；如果是第二预设值，则执行步骤508。
例如，第一预设值为“01”，第二预设值为“02”。
步骤507，NFC动态令牌对保存的种子密文进行解密，使用解密得到的种子明文生成动态口令，显示该动态口令，开启NFC通信，通过NFC通道与移动设备建立连接，将流程标识设置为第二预设值，并执行步骤509。
具体地，NFC动态令牌使用最近一次保存的加密随机数，对自身保存的种子密文进行解密，得到种子明文，并用该种子明文生成动态口令。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文生成动态口令“355569”，显示动态口令“355569”，将流程标识设置为“02”。
步骤508，NFC动态令牌清除屏幕显示，关闭NFC通信，将流程标识设置为第一预设值，并执行步骤509。
例如，NFC动态令牌将流程标识设置为“01”。
步骤509，NFC动态令牌判断是否有自动清屏事件发生，如果是，则执行步骤510；否则，执行步骤511。
具体地，NFC动态令牌判断自动清屏标识是否置位，如果是，则确定有自动清屏事件发生，否则，确定没有自动清屏事件发生。
需要说明的是，NFC动态令牌判断自动清屏标识置位之后，还会对自动清屏标识复位。
步骤510，NFC动态令牌清除屏幕显示，关闭NFC通信，并执行步骤511。
步骤511，NFC动态令牌判断是否有NFC通信事件发生，如果是，则执行步骤512；否则，返回步骤502。
具体地，NFC动态令牌判断NFC通信中断标识是否置位，如果是，则确定有NFC通信事件发生，否则，确定没有NFC通信事件发生。
需要说明的是，NFC动态令牌判断NFC通信中断标识置位之后，还会对NFC通信中断标识复位。
此外，当按键中断标识、NFC通信中断标识和自动清屏标识均被复位后，NFC动态令牌将事件标识复位。
步骤512，NFC动态令牌从NFC缓存区中获取NFC数据，对NFC数据进行校验，如果校验通过，则执行步骤514；否则，执行步骤513。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例5中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x440E02AFCC4F6EAC971346E6066E4D09”，其中，帧头为“0x44”、长度数据为“0x0E”、指令数据为“0x02AFCC4F6EAC971346E6066E4D”、校验数据为“0x09”，NFC动态令牌根据长度数据“0x0E”和指令数据“0x02AFCC4F6EAC971346E6066E4D”进行计算，判断计算得到的校验值是否为“0x09”，如果是，则确定校验通过；否则，确定校验未通过。
步骤513，NFC动态令牌向移动设备发送错误码，并返回步骤502。
例如，NFC动态令牌向移动设备发送错误码“0xBB021E35”。
步骤514，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤515；如果是第二指令，则执行步骤516；如果是第四指令，则执行步骤521。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第二指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x02”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x02”，则确定该NFC数据为第二指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤515，NFC动态令牌通过NFC通道向移动设备发送加密随机数，保存该加密随机数，并返回步骤502。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”。
步骤516，NFC动态令牌从第二指令中获取种子密文和校验值。
具体地，NFC动态令牌从第二指令的指令数据中获取种子密文和校验值。
例如，指令数据为“0x02AFCC4F6EAC971346E6066E4D”，NFC动态令牌从指令数据中获取种子密文“0xAFCC4F6EAC971346E6”和校验值“0x6E4D”。
步骤517，NFC动态令牌使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文，并根据该种子明文计算校验值。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文计算校验值。
步骤518，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值相同，如果是，则执行步骤519；否则，执行步骤520。
例如，NFC动态令牌判断计算得到的校验值是否与从第二指令中获取的校验值“0x6E4D”相同。
步骤519，NFC动态令牌对种子密文进行保存，通过NFC通道向移动设备发送写入成功消息，并返回步骤502。
例如，NFC动态令牌对种子密文“0xAFCC4F6EAC971346E6”进行解密，通过NFC通道向移动设备发送写入成功消息“0xBB02CCCC”。
步骤520，NFC动态令牌通过NFC通道向移动设备发送写入失败消息，并返回步骤502。
例如，NFC动态令牌向移动设备发送写入失败消息“0xBB023D5B”。
步骤521，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤502。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，本发明的实施例5还包括以下步骤：
NFC动态令牌判断是否有EPD(Electronic Paper Displays，电子纸显示)错误事件发生，并在有EPD错误事件发生时，对电子纸进行初始化。具体地，NFC动态令牌判断EPD错误标识是否置位，如果是，则确定有EPD错误事件发生，否则，确定没有EPD错误事件发生。NFC动态令牌判断EPD错误标识置位之后，还会对EPD错误标识复位。
相应地，当EPD错误标识、按键中断标识、NFC通信中断标识和自动清屏标识均被复位后，NFC动态令牌将事件标识复位。
此外，NFC动态令牌在显示信息或清除屏幕显示之前，NFC动态令牌中的主控芯片向电子纸发送上电(power-on)指令，并检测Busy信号是否在第一预设时长内由低电平切换到高电平，如果没有，则置位EPD错误标识；NFC动态令牌在显示信息或清除屏幕显示之后，NFC动态令牌中的主控芯片向电子纸发送下电(power-off)指令，并检测Busy信号是否在第二预设时长内由高电平切换到低电平，如果没有，则置位EPD错误标识和事件标识。
NFC动态令牌检测到按键中断后，将按键中断标识和事件标识置位；NFC动态令牌检测到NFC通信中断后，将通过NFC通道接收到的NFC数据存储到NFC缓存区，将NFC通信中断标识和事件标识置位；NFC动态令牌检测到RTC中断后，更新秒计数，并判断秒计数是否达到预设次数，如果是，则更新动态因子，置位自动清屏标识和事件标识，并对RTC中断次数进行初始化。
本实施例5中，RTC中断每秒钟发生一次，预设次数为60次。NFC动态令牌检测到RTC中断后，将秒计数加1；秒计数达到60次后，NFC动态令牌将秒计数初始化为零；NFC动态令牌从NFC数据中获取第一指令后，将秒计数作为加密随机数发送给移动设备。
本发明的实施例5通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
基于上述方法，本发明的实施例6还提供了一种NFC动态令牌，如图6所示，包括：
检测模块610，用于检测预设按键是否被触发；
连接模块620，用于在检测模块610检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
接收模块630，用于接收来自移动设备的第二指令；
获取模块640，用于从第二指令中获取种子密钥；
存储模块650，用于对种子密钥进行保存；
发送模块660，用于通过NFC通道向移动设备发送写入成功消息。
其中，上述种子密钥可以为种子明文；
相应地，获取模块640，还用于从第二指令中获取校验值；
上述NFC动态令牌，还包括：
计算模块，用于根据种子明文计算校验值；
判断模块，用于判断计算模块计算得到的校验值是否与获取模块640从第二指令中获取的校验值相同；
存储模块650，具体用于在计算模块计算得到的校验值与获取模块640从第二指令中获取的校验值相同时，对种子明文进行保存。
上述种子密钥也可以为种子密文；
相应地，获取模块640，还用于从第二指令中获取校验值；
上述NFC动态令牌，还包括：
解密模块，用于使用最近一次保存的加密随机数对种子密文进行解密，得到种子明文；
计算模块，用于根据种子明文计算校验值；
判断模块，用于判断计算模块计算得到的校验值是否与获取模块640从第二指令中获取的校验值相同；
存储模块650，具体用于在计算模块计算得到的校验值与获取模块640从第二指令中获取的校验值相同时，对种子明文进行保存。
进一步地，在本发明的一种实施方式中，接收模块630，还用于接收来自移动设备的第一指令；
发送模块660，还用于通过NFC通道向移动设备发送加密随机数；
存储模块650，还用于保存加密随机数。
在本发明的另一种实施方式中，接收模块630，还用于接收来自所述移动设备的第一指令；
存储模块650，还用于保存烧写密钥；
上述NFC动态令牌，还包括：
加密模块，用于使用烧写密钥对加密随机数进行加密，得到随机数密文；
发送模块660，还用于通过NFC通道向移动设备发送随机数密文；
存储模块650，还用于保存加密随机数。
进一步地，接收模块630，还用于接收来自移动设备的第四指令；
发送模块660，还用于通过NFC通道向移动设备发送令牌序列号。
进一步地，检测模块610，具体用于判断出有按键事件发生，如果是，则确定预设按键被触发；否则，确定预设按键没有被触发；
上述NFC动态令牌，还包括：
判断模块，用于在检测模块610判断出有按键事件发生之后，对流程标识进行判断；
连接模块620，具体用于在判断模块判断出流程标识为第一预设值时，开启NFC通信，通过NFC通道与移动设备建立连接。
进一步地，上述NFC动态令牌，还包括：
设置模块，用于在判断模块判断出流程标识为第一预设值之后，将流程标识设置为第二预设值；
清除模块，用于在判断模块判断出流程标识为第二预设值之后，清除屏幕显示，关闭NFC通信，将流程标识设置为第一预设值。
在本发明的又一种实施方式中，种子密钥为种子密文；
获取模块640，还用于从所述第二指令中获取校验值；
存储模块650，还用于保存烧写密钥；
NFC动态令牌，还包括：
解密模块，用于使用烧写密钥和最近一次保存的加密随机数，对种子密文进行解密，得到种子明文；
计算模块，用于根据种子明文计算校验值；
判断模块，用于判断计算模块计算得到的校验值是否与获取模块640从第二指令中获取的校验值相同；
存储模块650，具体用于在计算模块计算得到的校验值与获取模块640从第二指令中获取的校验值相同时，对种子密文进行保存。
进一步地，接收模块630，还用于接收来自移动设备的第一指令；
发送模块660，还用于通过NFC通道向移动设备发送加密随机数；
存储模块650，还用于保存加密随机数。
本发明的实施例6通过NFC通道将种子密钥烧写到NFC动态令牌中，提高了动态令牌的安全性和灵活性。
本发明的实施例7还提供了一种NFC动态令牌的工作方法，如图7所示，包括以下步骤：
步骤701，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤702，NFC动态令牌等待接收来自移动设备的NFC数据。
步骤703，当NFC动态令牌接收到来自移动设备的NFC数据后，NFC动态令牌对NFC数据进行校验，如果校验通过，则执行步骤705；否则，执行步骤704。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例7中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x44020110”，包含帧头“0x44”、长度数据“0x02”、指令数据“0x01”和校验数据“0x10”，NFC动态令牌根据长度数据“0x02”和指令数据“0x01”进行计算，判断计算得到的校验值是否为“0x10”，如果是，则确定校验通过；否则，确定校验未通过。
步骤704，NFC动态令牌向移动终端发送错误码，并返回步骤702。
例如，NFC动态令牌向移动终端发送错误码“0xBB021E35”。
步骤705，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤706；如果是第三指令，则执行步骤707；如果是第四指令，则执行步骤709。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第三指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x03”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x03”，则确定该NFC数据为第三指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤706，NFC动态令牌通过NFC通道向移动设备发送加密随机数，保存该加密随机数，并返回步骤702。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”。
需要说明的是，移动设备接收到来自NFC动态令牌的加密随机数后，对该加密随机数进行保存。
步骤707，NFC动态令牌使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，使用该种子明文生成动态口令，并对该动态口令进行显示。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，根据上述种子明文生成动态口令“355569”，并显示动态口令“355569”。
步骤708，NFC动态令牌通过NFC通道将动态口令发送给移动设备，并返回步骤702。
例如，NFC动态令牌通过NFC通道将动态口令“355569”发送给移动设备。
步骤709，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤702。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤702及后续步骤。
本发明的实施例7通过NFC通道将NFC动态令牌生成的动态口令发送给移动设备，避免用户在手动输入动态口令时出错和泄密，提高了动态令牌的安全性。
本发明的实施例8还提供了另一种NFC动态令牌的工作方法，如图8所示，包括以下步骤：
步骤801，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤802，NFC动态令牌等待接收来自移动设备的NFC指令。
步骤803，当NFC动态令牌接收到来自移动设备的NFC指令后，NFC动态令牌对NFC指令进行校验，如果校验通过，则执行步骤805；否则，执行步骤804。
其中，NFC指令包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC指令校验通过；否则，确定NFC指令校验未通过。
本实施例8中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC指令为“0x44020110”，包含帧头“0x44”、长度数据“0x02”、指令数据“0x01”和校验数据“0x10”，NFC动态令牌根据长度数据“0x02”和指令数据“0x01”进行计算，判断计算得到的校验值是否为“0x10”，如果是，则确定校验通过；否则，确定校验未通过。
步骤804，NFC动态令牌向移动终端发送错误码，并返回步骤802。
例如，NFC动态令牌向移动终端发送错误码“0xBB021E35”。
步骤805，NFC动态令牌使用自身保存的种子明文生成动态口令。
例如，NFC动态令牌使用自身保存的种子明文“0x8D5828922FEBFC8597”生成动态口令“355569”。
步骤806，NFC动态令牌通过NFC通道将动态口令发送给移动设备，并返回步骤802。
例如，NFC动态令牌通过NFC通道将动态口令“355569”发送给移动设备。
需要说明的是，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤802及后续步骤。
本发明的实施例8通过NFC通道将NFC动态令牌生成的动态口令发送给移动设备，避免用户在手动输入动态口令时出错和泄密，提高了动态令牌的安全性。
本发明的实施例9还提供了又一种NFC动态令牌的工作方法，如图9所示，包括以下步骤：
步骤901，NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接。
步骤902，NFC动态令牌等待接收来自移动设备的NFC指令。
步骤903，当NFC动态令牌接收到来自移动设备的NFC指令后，NFC动态令牌使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，并使用该种子明文生成动态口令。
例如，NFC指令为“0x44020110”，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文生成动态口令“355569”。
步骤904，NFC动态令牌通过NFC通道将动态口令发送给移动设备，并返回步骤902。
例如，NFC动态令牌通过NFC通道将动态口令“355569”发送给移动设备。
需要说明的是，NFC动态令牌开启NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，清除屏幕显示，并关闭NFC通信。
相应地，NFC动态令牌清除屏幕显示，并关闭NFC通信之后，还包括：NFC动态令牌检测到预设按键被触发后，开启NFC通信，并执行步骤902及后续步骤。
本发明的实施例9通过NFC通道将NFC动态令牌生成的动态口令发送给移动设备，避免用户在手动输入动态口令时出错和泄密，提高了动态令牌的安全性。
本发明的实施例10还提供了再一种NFC动态令牌的工作方法，如图10所示，包括以下步骤：
步骤1001，NFC动态令牌上电，设置系统运行时钟，初始化外设中断。
步骤1002，NFC动态令牌判断是否有事件发生，如果是，则执行步骤1005；否则，执行步骤1003。
具体地，NFC动态令牌判断事件标识是否置位，如果是，则确定有事件发生，否则，确定没有事件发生。
步骤1003，NFC动态令牌关闭系统运行时钟，进入休眠状态，并在有事件发生时，从休眠状态中唤醒，执行步骤1004。
步骤1004，NFC动态令牌设置系统运行时钟，并执行步骤1005。
步骤1005，NFC动态令牌判断是否有按键事件发生，如果是，则执行步骤1006；否则，执行步骤1009。
具体地，NFC动态令牌判断按键中断标识是否置位，如果是，则确定有按键事件发生，否则，确定没有按键事件发生。
需要说明的是，NFC动态令牌判断按键中断标识置位之后，还会对按键中断标识复位。
步骤1006，NFC动态令牌对流程标识进行判断，如果是第一预设值，则执行步骤1007；如果是第二预设值，则执行步骤1008。
例如，第一预设值为“01”，第二预设值为“02”。
步骤1007，NFC动态令牌对保存的种子密文进行解密，使用解密得到的种子明文生成动态口令，显示该动态口令，开启NFC通信，通过NFC通道与移动设备建立连接，将流程标识设置为第二预设值，并执行步骤1009。
具体地，NFC动态令牌使用最近一次保存的加密随机数，对自身保存的种子密文进行解密，得到种子明文，并用该种子明文生成动态口令。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文生成动态口令“355569”，显示动态口令“355569”，将流程标识设置为“02”。
步骤1008，NFC动态令牌清除屏幕显示，关闭NFC通信，将流程标识设置为第一预设值，并执行步骤1009。
例如，NFC动态令牌将流程标识设置为“01”。
步骤1009，NFC动态令牌判断是否有自动清屏事件发生，如果是，则执行步骤1010；否则，执行步骤1011。
具体地，NFC动态令牌判断自动清屏标识是否置位，如果是，则确定有自动清屏事件发生，否则，确定没有自动清屏事件发生。
需要说明的是，NFC动态令牌判断自动清屏标识置位之后，还会对自动清屏标识复位。
步骤1010，NFC动态令牌清除屏幕显示，关闭NFC通信，并执行步骤1011。
步骤1011，NFC动态令牌判断是否有NFC通信事件发生，如果是，则执行步骤1012；否则，返回步骤1002。
具体地，NFC动态令牌判断NFC通信中断标识是否置位，如果是，则确定有NFC通信事件发生，否则，确定没有NFC通信事件发生。
需要说明的是，NFC动态令牌判断NFC通信中断标识置位之后，还会对NFC通信中断标识复位。
此外，当按键中断标识、NFC通信中断标识和自动清屏标识均被复位后，NFC动态令牌将事件标识复位。
步骤1012，NFC动态令牌从NFC缓存区中获取NFC数据，对NFC数据进行校验，如果校验通过，则执行步骤1014；否则，执行步骤1013。
其中，NFC数据包括帧头、长度数据、指令数据和校验数据，长度数据的取值为指令数据和校验数据的长度之和；相应地，NFC动态令牌可以根据长度数据和指令数据进行计算，得到校验值，判断该校验值是否与校验数据的取值相同，如果相同，则确定NFC数据校验通过；否则，确定NFC数据校验未通过。
本实施例10中，帧头的长度为1字节，长度数据的长度为1字节，校验数据的长度为1字节。
例如，NFC数据为“0x44020110”，包含帧头“0x44”、长度数据“0x02”、指令数据“0x01”和校验数据“0x10”，NFC动态令牌根据长度数据“0x02”和指令数据“0x01”进行计算，判断计算得到的校验值是否为“0x10”，如果是，则确定校验通过；否则，确定校验未通过。
步骤1013，NFC动态令牌向移动终端发送错误码，并返回步骤1002。
例如，NFC动态令牌向移动终端发送错误码“0xBB021E35”。
步骤1014，NFC动态令牌对NFC数据进行判断，如果是第一指令，则执行步骤1015；如果是第三指令，则执行步骤1016；如果是第四指令，则执行步骤1018。
具体地，NFC动态令牌获取指令数据中的命令代码，对该命令代码进行判断，如果该命令代码为第三预设值，则确定该NFC数据为第一指令；如果该命令代码为第四预设值，则确定该NFC数据为第三指令；如果该命令代码为第五预设值，则确定该NFC数据为第四指令。
例如，第三预设值为“0x01”，第四预设值为“0x03”，第五预设值为“0x04”，NFC动态令牌对指令数据中的命令代码进行判断，如果该命令代码为“0x01”，则确定该NFC数据为第一指令；如果该命令代码为“0x03”，则确定该NFC数据为第三指令；如果该命令代码为“0x04”，则确定该NFC数据为第四指令。
步骤1015，NFC动态令牌通过NFC通道向移动设备发送加密随机数，保存该加密随机数，并返回步骤402。
其中，加密随机数可以是从UTC秒数中截取的部分数据，例如，“0x1326”。
步骤1016，NFC动态令牌使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，并使用该种子明文生成动态口令。
例如，NFC动态令牌使用最近一次保存的加密随机数“0x1326”对种子密文“0xAFCC4F6EAC971346E6”进行解密，得到种子明文“0x8D5828922FEBFC8597”，并根据上述种子明文生成动态口令“355569”。
步骤1017，NFC动态令牌通过NFC通道将动态口令发送给移动设备，并返回步骤1002。
例如，NFC动态令牌通过NFC通道将动态口令“355569”发送给移动设备。
步骤1018，NFC动态令牌通过NFC通道向移动设备发送令牌序列号，并返回步骤1002。
例如，NFC动态令牌通过NFC通道将自身保存的令牌序列号“15357”发送给移动设备。
需要说明的是，本发明的实施例10还包括以下步骤：
NFC动态令牌判断是否有EPD(Electronic Paper Displays，电子纸显示)错误事件发生，并在有EPD错误事件发生时，对电子纸进行初始化。具体地，NFC动态令牌判断EPD错误标识是否置位，如果是，则确定有EPD错误事件发生，否则，确定没有EPD错误事件发生。NFC动态令牌判断EPD错误标识置位之后，还会对EPD错误标识复位。
相应地，当EPD错误标识、按键中断标识、NFC通信中断标识和自动清屏标识均被复位后，NFC动态令牌将事件标识复位。
此外，NFC动态令牌在显示信息或清除屏幕显示之前，NFC动态令牌中的主控芯片向电子纸发送上电(power-on)指令，并检测Busy信号是否在第一预设时长内由低电平切换到高电平，如果没有，则置位EPD错误标识；NFC动态令牌在显示信息或清除屏幕显示之后，NFC动态令牌中的主控芯片向电子纸发送下电(power-off)指令，并检测Busy信号是否在第二预设时长内由高电平切换到低电平，如果没有，则置位EPD错误标识和事件标识。
NFC动态令牌检测到按键中断后，将按键中断标识和事件标识置位；NFC动态令牌检测到NFC通信中断后，将通过NFC通道接收到的NFC数据存储到NFC缓存区，将NFC通信中断标识和事件标识置位；NFC动态令牌检测到RTC中断后，更新秒计数，并判断秒计数是否达到预设次数，如果是，则更新动态因子，置位自动清屏标识和事件标识，并对RTC中断次数进行初始化。
本实施例10中，RTC中断每秒钟发生一次，预设次数为60次。NFC动态令牌检测到RTC中断后，将秒计数加1；秒计数达到60次后，NFC动态令牌将秒计数初始化为零；NFC动态令牌从NFC数据中获取第一指令后，可以将秒计数作为加密随机数发送给移动设备。
本发明的实施例10通过NFC通道将NFC动态令牌生成的动态口令发送给移动设备，避免用户在手动输入动态口令时出错和泄密，提高了动态令牌的安全性。
基于上述NFC动态令牌的工作方法，本发明的实施例11还提供了一种NFC动态令牌，如图11所示，包 括：
检测模块1110，用于检测预设按键是否被触发；
连接模块1120，用于在检测模块1110检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
接收模块1130，用于接收来自移动设备的第三指令；
生成模块1140，使用自身保存的种子数据生成动态口令；
发送模块1150，用于通过NFC通道将动态口令发送给移动设备。
进一步地，上述NFC动态令牌，还包括：
显示模块，用于显示动态口令。
其中，NFC动态令牌保存的种子数据可以为种子密文；
相应地，上述生成模块1140，具体用于使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，并使用种子明文生成动态口令。
上述接收模块1130，还用于接收来自移动设备的第一指令；
上述发送模块1150，还用于通过NFC通道向移动设备发送加密随机数，保存所述加密随机数。
进一步地，上述接收模块1130，还用于接收来自移动设备的第四指令；
上述发送模块1150，还用于通过NFC通道向移动设备发送令牌序列号。
进一步地，上述检测模块1110，具体用于判断是否有按键事件发生，如果是，则确定预设按键被触发；否则，确定预设按键没有被触发；
进一步地，上述NFC动态令牌，还包括：
判断模块，用于在检测模块1110判断出有按键事件发生之后，对流程标识进行判断；
连接模块1120，具体用于在判断模块判断出所述流程标识为第一预设值时，开启NFC通信，通过NFC通道与移动设备建立连接。
进一步地，上述NFC动态令牌，还包括：
设置模块，用于在判断模块判断出所述流程标识为第一预设值之后，将流程标识设置为第二预设值；
清除模块，用于在判断模块判断出流程标识为第二预设值之后，清除屏幕显示，关闭NFC通信，将流程标识设置为第一预设值。
本发明的实施例11通过NFC通道将NFC动态令牌生成的动态口令发送给移动设备，避免用户在手动输入动态口令时出错和泄密，提高了动态令牌的安全性。
结合本发明中所公开的各实施例描述的方法中的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，本领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。

Claims (19)

  1. 一种在NFC动态令牌的工作方法，其特征在于，包括以下步骤：
    NFC动态令牌检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
    当所述NFC动态令牌接收来自所述移动设备的第二指令时，所述NFC动态令牌从所述第二指令中获取种子密钥，对所述种子密钥进行保存，并通过NFC通道向所述移动设备发送写入成功消息；
    当所述NFC动态令牌接收来自所述移动设备的第三指令时，所述NFC动态令牌使用自身保存的种子数据生成动态口令，并通过NFC通道将所述动态口令发送给所述移动设备。
  2. 如权利要求1所述的方法，其特征在于，所述种子密钥为种子明文；
    所述NFC动态令牌接收来自所述移动设备的第二指令之后，还包括：
    所述NFC动态令牌从所述第二指令中获取校验值；
    所述NFC动态令牌从所述第二指令中获取种子明文之后，还包括：
    所述NFC动态令牌根据所述种子明文计算校验值，判断计算得到的校验值是否与从所述第二指令中获取的校验值相同；
    所述NFC动态令牌对所述种子明文进行保存，具体为：当计算得到的校验值与从所述第二指令中获取的校验值相同时，所述NFC动态令牌对所述种子明文进行保存。
  3. 如权利要求1所述的方法，其特征在于，所述种子密钥为种子密文；
    所述NFC动态令牌接收来自所述移动设备的第二指令之后，还包括：
    所述NFC动态令牌从所述第二指令中获取校验值；
    所述NFC动态令牌从所述第二指令中获取种子密文之后，还包括：
    所述NFC动态令牌使用最近一次保存的加密随机数对所述种子密文进行解密，得到种子明文；
    所述NFC动态令牌根据所述种子明文计算校验值，判断计算得到的校验值是否与从所述第二指令中获取的校验值相同；
    所述NFC动态令牌对所述种子密文进行保存，具体为：当计算得到的校验值与从所述第二指令中获取的校验值相同时，所述NFC动态令牌对所述种子密文进行保存。
  4. 如权利要求3所述的方法，其特征在于，所述NFC动态令牌使用最近一次保存的加密随机数对所述种子密文进行解密之前，还包括：所述NFC动态令牌接收来自所述移动设备的第一指令，通过NFC通道向所述移动设备发送加密随机数，保存所述加密随机数。
  5. 如权利要求3所述的方法，其特征在于，所述NFC动态令牌使用最近一次保存的加密随机数对所述种子密文进行解密之前，还包括：
    所述NFC动态令牌接收来自所述移动设备的第一指令，使用自身内置的烧写密钥对加密随机数进行加密，得到随机数密文，通过NFC通道向所述移动设备发送所述随机数密文，保存所述加密随机数。
  6. 如权利要求1所述的方法，其特征在于，还包括：所述NFC动态令牌接收来自所述移动设备的第四指令，通过NFC通道向所述移动设备发送令牌序列号。
  7. 如权利要求1所述的方法，其特征在于，所述种子密钥为种子密文；
    所述NFC动态令牌接收来自所述移动设备的第二指令之后，还包括：
    所述NFC动态令牌从所述第二指令中获取校验值；
    所述NFC动态令牌从所述第二指令中获取种子密文之后，还包括：
    所述NFC动态令牌使用自身内置的烧写密钥和最近一次保存的加密随机数，对所述种子密文进行解密，得到种子明文；
    所述NFC动态令牌根据所述种子明文计算校验值，判断计算得到的校验值是否与从所述第二指令中获取的校验值相同；
    所述NFC动态令牌对所述种子密文进行保存，具体为：当计算得到的校验值与从所述第二指令中获取的校验值相同时，所述NFC动态令牌对所述种子密文进行保存。
  8. 如权利要求1所述的方法，其特征在于，所述NFC动态令牌使用自身保存的种子数据生成动态口令之后，还包括：所述NFC动态令牌显示所述动态口令。
  9. 如权利要求1所述的方法，其特征在于，所述NFC动态令牌保存的种子数据为种子密文；
    所述NFC动态令牌使用自身保存的种子数据生成动态口令，具体为：所述NFC动态令牌使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，并使用所述种子明文生成动态口令。
  10. 如权利要求9所述的方法，其特征在于，所述NFC动态令牌使用最近一次保存的加密随机数对自身保存的种子密文进行解密之前，还包括：
    所述NFC动态令牌接收来自所述移动设备的第一指令，通过NFC通道向所述移动设备发送加密随机数， 保存所述加密随机数。
  11. 一种NFC动态令牌，其特征在于，包括：
    检测模块，用于检测预设按键是否被触发；
    连接模块，用于在所述检测模块检测到预设按键被触发后，开启NFC通信，通过NFC通道与移动设备建立连接；
    接收模块，用于接收来自所述移动设备的第二指令或第三指令；
    获取模块，用于从所述第二指令中获取种子密钥；
    存储模块，用于对所述种子密钥进行保存；
    生成模块，用于使用保存的种子数据生成动态口令；
    发送模块，用于通过NFC通道向所述移动设备发送写入成功消息或者通过NFC通道将所述动态口令发送給所述移动设备。
  12. 如权利要求11所述的NFC动态令牌，其特征在于，所述种子密钥为种子明文；
    所述获取模块，还用于从所述第二指令中获取校验值；
    所述NFC动态令牌，还包括：
    计算模块，用于根据所述种子明文计算校验值；
    判断模块，用于判断所述计算模块计算得到的校验值是否与所述获取模块从所述第二指令中获取的校验值相同；
    所述存储模块，具体用于在所述计算模块计算得到的校验值与所述获取模块从所述第二指令中获取的校验值相同时，对所述种子明文进行保存。
  13. 如权利要求13所述的NFC动态令牌，其特征在于，所述种子密钥为种子密文；
    所述获取模块，还用于从所述第二指令中获取校验值；
    所述NFC动态令牌，还包括：
    解密模块，用于使用最近一次保存的加密随机数对所述种子密文进行解密，得到种子明文；
    计算模块，用于根据所述种子明文计算校验值；
    判断模块，用于判断所述计算模块计算得到的校验值是否与所述获取模块从所述第二指令中获取的校验值相同；
    所述存储模块，具体用于在所述计算模块计算得到的校验值与所述获取模块从所述第二指令中获取的校验值相同时，对所述种子明文进行保存。
  14. 如权利要求13所述的NFC动态令牌，其特征在于，
    所述接收模块，还用于接收来自所述移动设备的第一指令；
    所述发送模块，还用于通过NFC通道向所述移动设备发送加密随机数；
    所述存储模块，还用于保存所述加密随机数。
  15. 如权利要求13所述的NFC动态令牌，其特征在于，
    所述接收模块，还用于接收来自所述移动设备的第一指令；
    所述存储模块，还用于保存烧写密钥；
    所述NFC动态令牌，还包括：
    加密模块，用于使用所述烧写密钥对加密随机数进行加密，得到随机数密文；
    所述发送模块，还用于通过NFC通道向所述移动设备发送所述随机数密文；
    所述存储模块，还用于保存所述加密随机数。
  16. 如权利要求11所述的NFC动态令牌，其特征在于，
    所述接收模块，还用于接收来自所述移动设备的第四指令；
    所述发送模块，还用于通过NFC通道向所述移动设备发送令牌序列号。
  17. 如权利要求12所述的NFC动态令牌，其特征在于，还包括：
    显示模块，用于显示所述动态口令。
  18. 如权利要求12所述的NFC动态令牌，其特征在于，所述NFC动态令牌保存的种子数据为种子密文；
    所述生成模块，具体用于使用最近一次保存的加密随机数对自身保存的种子密文进行解密，得到种子明文，并使用所述种子明文生成动态口令。
  19. 如权利要求18所述的NFC动态令牌，其特征在于，
    所述接收模块，还用于接收来自所述移动设备的第一指令；
    所述发送模块，还用于通过NFC通道向所述移动设备发送加密随机数，保存所述加密随机数。
PCT/CN2017/078543 2016-05-24 2017-03-29 一种nfc动态令牌及其工作方法 WO2017202137A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/092,529 US11381554B2 (en) 2016-05-24 2017-03-29 NFC dynamic token with a seed key in said token

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201610349991.3 2016-05-24
CN201610350254.5A CN105812395B (zh) 2016-05-24 2016-05-24 一种nfc动态令牌以及在nfc动态令牌中烧写种子密钥的方法
CN201610349991.3A CN105812127B (zh) 2016-05-24 2016-05-24 一种nfc动态令牌及其工作方法
CN201610350254.5 2016-05-24

Publications (1)

Publication Number Publication Date
WO2017202137A1 true WO2017202137A1 (zh) 2017-11-30

Family

ID=60412119

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/078543 WO2017202137A1 (zh) 2016-05-24 2017-03-29 一种nfc动态令牌及其工作方法

Country Status (2)

Country Link
US (1) US11381554B2 (zh)
WO (1) WO2017202137A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11064358B2 (en) * 2016-05-24 2021-07-13 Feitian Technologies Co., Ltd. One-time-password authentication method and device
KR102652811B1 (ko) * 2018-09-04 2024-04-01 삼성전자주식회사 디스플레이 장치의 제어 방법 및 그에 따른 디스플레이 장치
CN111127710B (zh) * 2019-12-19 2021-11-23 深圳市凯迪仕智能科技有限公司 一种智能锁安全离线开锁密码生成方法
CN114244887B (zh) * 2021-12-16 2023-05-12 中国联合网络通信集团有限公司 通道管理方法、装置和电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102882678A (zh) * 2012-07-02 2013-01-16 飞天诚信科技股份有限公司 一种非接触式烧写种子的方法及系统
US20140298027A1 (en) * 2013-04-02 2014-10-02 Mastercard International Incorporated Integrated contactless mpos implementation
US20150169860A1 (en) * 2013-12-13 2015-06-18 SaferZone Security key using multi-otp, security service apparatus, security system
CN105812127A (zh) * 2016-05-24 2016-07-27 飞天诚信科技股份有限公司 一种nfc动态令牌及其工作方法
CN105812395A (zh) * 2016-05-24 2016-07-27 飞天诚信科技股份有限公司 一种nfc动态令牌以及在nfc动态令牌中烧写种子密钥的方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1435558A1 (en) * 2003-01-02 2004-07-07 Texas Instruments Incorporated On-device random number generator
US8198988B2 (en) * 2007-11-16 2012-06-12 Sony Corporation Secure link between controller and device
JP4613969B2 (ja) * 2008-03-03 2011-01-19 ソニー株式会社 通信装置、及び通信方法
WO2010128442A2 (en) * 2009-05-03 2010-11-11 Logomotion, S.R.O. A payment terminal using a mobile communication device, such as a mobile phone; a method of direct debit payment transaction
JP5849484B2 (ja) * 2010-09-16 2016-01-27 株式会社リコー 伝送端末、表示データ送信方法、プログラム、情報提供装置及び伝送システム
US8639619B1 (en) * 2012-07-13 2014-01-28 Scvngr, Inc. Secure payment method and system
KR102143434B1 (ko) * 2013-11-12 2020-08-11 삼성전자주식회사 근거리 무선 통신 칩의 펌웨어 업데이트 방법 및 이를 구현하는 전자 시스템
EP3089091B1 (en) * 2014-05-02 2020-03-11 Barclays Execution Services Limited Transaction authentication

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102882678A (zh) * 2012-07-02 2013-01-16 飞天诚信科技股份有限公司 一种非接触式烧写种子的方法及系统
US20140298027A1 (en) * 2013-04-02 2014-10-02 Mastercard International Incorporated Integrated contactless mpos implementation
US20150169860A1 (en) * 2013-12-13 2015-06-18 SaferZone Security key using multi-otp, security service apparatus, security system
CN105812127A (zh) * 2016-05-24 2016-07-27 飞天诚信科技股份有限公司 一种nfc动态令牌及其工作方法
CN105812395A (zh) * 2016-05-24 2016-07-27 飞天诚信科技股份有限公司 一种nfc动态令牌以及在nfc动态令牌中烧写种子密钥的方法

Also Published As

Publication number Publication date
US20190132305A1 (en) 2019-05-02
US11381554B2 (en) 2022-07-05

Similar Documents

Publication Publication Date Title
WO2018133686A1 (zh) 一种密码保护方法、装置及存储介质
US9918226B2 (en) Spoofing protection for secure-element identifiers
ES2687191T3 (es) Método de autentificación de red para transacciones electrónicas seguras
US9762590B2 (en) System and method for an integrity focused authentication service
US9509502B2 (en) Symmetric keying and chain of trust
KR102485830B1 (ko) 보안 정보의 처리
US11544365B2 (en) Authentication system using a visual representation of an authentication challenge
WO2017041599A1 (zh) 业务处理方法及电子设备
US9021568B2 (en) Verification method for verifying validity of program, and verification system
WO2017202137A1 (zh) 一种nfc动态令牌及其工作方法
JP6814147B2 (ja) 端末、方法、不揮発性記憶媒体
US11212084B2 (en) System and a method for signing transactions using air-gapped private keys
US20180219688A1 (en) Information Transmission Method and Mobile Device
CN108763917B (zh) 一种数据加解密方法及装置
US11809540B2 (en) System and method for facilitating authentication via a short-range wireless token
JP5225412B2 (ja) 通信装置および通信方法
WO2018166163A1 (zh) Pos终端控制方法、pos终端、服务器及存储介质
CN105812395B (zh) 一种nfc动态令牌以及在nfc动态令牌中烧写种子密钥的方法
TW201325189A (zh) 具有保密功能的手機及其保密方法
CN109451504B (zh) 物联网模组鉴权方法及系统
CN112668032B (zh) 加解密计算机的方法及系统、计算机、服务器和移动设备
TW201035799A (en) A method of protecting a secure USB key
WO2017202136A1 (zh) 一种认证动态口令的方法和设备
US11469893B2 (en) Systems and methods for establishing secured connections for IoT devices
WO2016184087A1 (zh) 设备间的信息传输方法、系统和源终端、存储介质

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17801984

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17801984

Country of ref document: EP

Kind code of ref document: A1