WO2018045918A1 - 一种授权方法及系统 - Google Patents

一种授权方法及系统 Download PDF

Info

Publication number
WO2018045918A1
WO2018045918A1 PCT/CN2017/100210 CN2017100210W WO2018045918A1 WO 2018045918 A1 WO2018045918 A1 WO 2018045918A1 CN 2017100210 W CN2017100210 W CN 2017100210W WO 2018045918 A1 WO2018045918 A1 WO 2018045918A1
Authority
WO
WIPO (PCT)
Prior art keywords
card
calculation factor
card reader
authorization
authentication
Prior art date
Application number
PCT/CN2017/100210
Other languages
English (en)
French (fr)
Inventor
李东声
Original Assignee
天地融科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 天地融科技股份有限公司 filed Critical 天地融科技股份有限公司
Publication of WO2018045918A1 publication Critical patent/WO2018045918A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards

Definitions

  • the present invention relates to the field of electronic technologies, and in particular, to an authorization method and system.
  • each reader is independent of each other and has no association with other readers. Therefore, the criminals only need to break through a card reader to obtain the authorization that the card reader can implement.
  • the time required for criminals to break through each card reader is similar, that is, the higher-level authorized card readers in the prior art do not achieve a higher security guarantee.
  • the present invention is directed to solving the above problems/one of them.
  • the main object of the present invention is to provide an authorization method
  • Another object of the present invention is to provide an authorization system.
  • An aspect of the present invention provides an authorization method, including: a card receiving an authentication command sent by a first card reader, wherein the authentication command carries a first calculation factor and first authentication information; The card authenticates the first authentication information, and if the authentication passes, obtains a second calculation factor according to at least a third calculation factor stored by the card, where the third calculation factor includes: the card is successfully obtained.
  • the card generates second authentication information according to the second calculation factor, and sends the second authentication information to the first card reader; the first reading The card device receives the second authentication information, and sends the second authentication information to the background; the background acquires a fourth calculation factor corresponding to the first card reader, wherein the fourth calculation factor is based on The first card reader gives the precondition of the authorization, and the precondition for the first card reader to grant the authorization includes: whether the second card reader is required to authorize the same card And / or a second set of the same card reader has been authorized; authenticating the background of at least the second authentication information acquired according to the fourth factor is calculated, and the authentication result based on at least If it is determined whether the card is authorized.
  • an authorization system comprising: a card, a first card reader and a background; the card, configured to: receive an authentication command sent by the first card reader, wherein The first execution factor and the first authentication information are carried in the authentication command; the first authentication information is authenticated, and in the case that the authentication is passed, the second calculation factor is obtained according to at least the third calculation factor stored in the card.
  • the third calculation factor includes: a calculation factor obtained when the card successfully obtains the authorization of the card reader; generating at least the second authentication information according to the second calculation factor, and sending the second authentication information to
  • the first card reader is configured to: receive the second authentication information, and send the second authentication information to the background; the background is used to: acquire a fourth calculation factor corresponding to the first card reader, wherein the fourth calculation factor is obtained according to a precondition for the authorization given by the first card reader, and the first card reader gives an authorization
  • the method includes: whether a second card reader is required to authorize the same card, and/or a group of the second card readers has authorized the same card; at least according to the acquired fourth calculation factor
  • the authentication information is authenticated, and at least the authorization is determined according to the authentication result.
  • the present invention provides an authorization method.
  • the card responds to the authentication command sent by the first card reader, the card generates a second authentication message according to the stored third calculation factor.
  • a card reader is sent to the background authentication by the first card reader, and after receiving the second authentication information sent by the card in the background, the background obtains the fourth corresponding to the first card reader according to the precondition of the authorization given by the first card reader.
  • Calculating a factor, at least using the fourth calculating factor to authenticate the second authentication information sent by the card if the card does not obtain the authorization of the card reader in the precondition of the authorization given by the first card reader, the card is not stored and the fourth The calculation factor corresponds to the calculation factor, and the authentication of the second authentication information is not passed in the background, so that the card cannot be authorized. Therefore, for the card reader with higher security level, the corresponding control authority can be set, for example, a card has been required. Obtain authorization from one or more other readers. If an illegal user wants to break a card reader and obtain authorization from the card reader, First authorized reader of one or more other, only the authorization may be acquired by the reader, to achieve the effect of linkage of a plurality of the authorization given to the card reader.
  • FIG. 2 is a schematic structural diagram of an authorization system according to Embodiment 2 of the present invention.
  • FIG. 3 is a schematic structural diagram of another authorization system according to Embodiment 2 of the present invention.
  • This embodiment provides an authorization method. As shown in FIG. 1, the method includes the following steps (S101-S106):
  • the card receives the authentication command sent by the first card reader, where the authentication command carries the first calculation factor and the first authentication information.
  • the card authenticates the first authentication information, and if the authentication passes, obtains a second calculation factor according to at least the stored third calculation factor, where the third calculation factor includes: the card successfully obtains the authorization of the card reader. The calculation factor is obtained.
  • the card generates second authentication information according to at least a second calculation factor, and sends the second authentication information to the first card reader.
  • the first card reader receives the second authentication information, and sends the second authentication information to the background.
  • S105 The fourth calculation factor corresponding to the first card reader is obtained in the background, wherein the fourth calculation factor is obtained according to a precondition for granting the authorization by the first card reader, wherein the precondition for the first card reader to grant the authorization includes: : Whether a second card reader is required to authorize the same card, and/or a group of second card readers has authorized the same card.
  • S106 The background authentication is performed on the second authentication information according to at least the obtained fourth calculation factor, and at least determining whether to authorize the card according to the authentication result.
  • the second authentication information is generated according to the stored third calculation factor and sent to the first card reader, and sent by the first card reader.
  • the background acquires the fourth calculation factor corresponding to the first card reader according to the precondition of the authorization given by the first card reader, and sends the fourth calculation factor to the card by using the fourth calculation factor.
  • the authentication information is authenticated. If the card does not obtain the authorization of the card reader in the precondition of the authorization given by the first card reader, the card does not store the calculation factor corresponding to the fourth calculation factor, and the background corresponds to the second authentication information. The authentication fails, so the card cannot be authorized.
  • the corresponding control authority can be set. For example, if one card has been authorized by one or more other readers, If an illegal user wants to break a card reader and obtain authorization from the card reader, he must first obtain authorization from one or more other card readers. Authorization may be acquired by the reader, to achieve the interlocking effect of the authorization given to the plurality of readers.
  • the card may be a magnetic stripe card, an integrated circuit card (IC card), a smart card, or the like, which is not limited in this embodiment, as long as it can be read by the first card reader.
  • the cards taken are all within the protection scope of this embodiment.
  • the first card reader is a card reader currently interacting with the card, and the type of the first card reader corresponds to the type of the card, for example, when the card is a magnetic stripe card, the first card reader is a magnetic card reader; When the card is an IC card, the first card reader is an IC card reader.
  • the type of the first card reader is not specifically limited in this embodiment.
  • the card may be of a contact type or a non-contact type. If the card is non-contact type, when the card is within the working distance of the first card reader, the card and the first card reader can communicate, so that communication can be performed without a card. When the card is in contact type, the card can communicate with the first card reader only when the card contact is properly connected to the interface of the first card reader.
  • the first card reader when the card is non-contact type, can periodically broadcast a card search instruction, and if the card is located in the card reading range of the first card reader, the card can respond to the first card reader.
  • the card-finding instruction sends a card-seeking response to the first card reader, and after receiving the card-seeking response, the first card reader can determine the currently read card, and then send an authentication command to the card.
  • the first calculation factor may be a random number generated by the first card reader, or may be the number of times the first card reader gives the authorization, or may be the total number of times the card requests authorization, specifically the embodiment.
  • the first card reader uses the authentication key to calculate the first calculation factor according to a preset verification algorithm, and obtains a check value, which is carried as the first authentication information in the authentication command and sent to the authentication command.
  • the preset check algorithm may be a MAC algorithm, or may be another check algorithm, for example, a signature algorithm, which is not limited in this embodiment.
  • the card When the card authenticates the first authentication information, the card first obtains the authentication key of the first card reader, and then uses the same verification algorithm as the first card reader to calculate the first calculation factor to generate a check value. The comparison between the calculated check value and the check value in the received authentication command is the same. If they are the same, the first authentication information is authenticated. If not, the first authentication information fails to pass. If the first authentication information is authenticated, it indicates that the first authentication information has not been tampered with and the identity of the first card reader is legal. If the authentication fails, the first authentication information is tampered with and/or the identity of the first card reader. illegal.
  • the identifier may also carry a unique identifier corresponding to the first card reader.
  • the identifier information may be the serial number of the first card reader, or may be the authentication key corresponding to the first card reader.
  • Identification information ie, an authentication key used to authenticate the first authentication information.
  • the card can determine the authentication key of the first card reader according to the identification information.
  • the card sends the second authentication information to the first card reader in the case that the first authentication information is authenticated, wherein the second authentication information may be that the card uses the authentication key to follow the second calculation factor.
  • the check algorithm is set to calculate the generated check value.
  • the card uses the authentication key of the card to calculate the second calculation factor according to a preset verification algorithm to obtain a check value, and the check value is carried in the second authentication information and sent to the first card reader.
  • the preset check algorithm may be a MAC algorithm, or may be another check algorithm, for example, a signature algorithm, which is not limited in this embodiment.
  • the first card reader after receiving the second authentication information, jointly determines with the background whether it is a card authorization. After receiving the second authentication information, the first card reader sends the second authentication information to the background, and the background authentication is performed on at least the second authentication information, and the authentication result is returned to the first card reader, and then the first card reader is at least according to the The result of the authentication determines whether it is a card authorization.
  • the second authentication information is authenticated in the background, the authentication key of the card and the fourth calculation factor corresponding to the first card reader are first obtained, and then the same verification algorithm as the card is used to calculate and generate at least the fourth calculation factor. The verification value is compared between the calculated verification value and the received verification value in the second authentication information.
  • the second authentication information is authenticated. If not, the second authentication information is not authenticated. If the second authentication information is authenticated, it indicates that the calculation factor corresponding to the fourth calculation factor is stored in the card, and the second authentication information is not falsified and the identity of the card is legal. If the authentication fails, the card is not stored. The calculation factor corresponding to the fourth calculation factor, or the second authentication information is tampered with and/or the identity of the card is illegal.
  • the first card reader can determine whether it is a card authorization according to the second authentication information, and can determine whether the card is authorized according to other information. Therefore, as an optional implementation manner of the embodiment of the present invention, In the case that the second authentication information is authenticated, the background obtains the permission list authorized by the first card reader, determines whether the card is authorized according to the permission list, and sends the determination result to the first card reader, wherein the first reading The list of rights authorized by the card reader records at least the identification information of the card that allows the first card reader to authorize. Whether the card is an authorized user of the first card reader is determined whether the card is authorized by the card according to whether the card is in the authorization permission list of the first card reader.
  • the authorization list of the first card reader may be stored in the background, or may be stored locally in the first card reader, and if it is stored locally in the first card reader, it is judged by the first card reader. If it is stored in the background, it is judged by the background, and finally, it is combined with the authentication result of authenticating the second authentication information to determine whether it is a card authorization. For example, if the authorization permission list is stored in the background, after the background authenticates the second authentication information, it is further determined whether the card is in the authorization permission list of the first card reader, and if yes, the first card reader is authenticated and passed.
  • the first card reader determines to authorize the card according to the authentication result; if the authorization permission list is stored in the first card reader, after the background authenticates the second authentication information, the first card is read Returning an authentication result indicating whether the second authentication information is authenticated, and if the authentication result indicates that the second authentication information is authenticated, the first card reader further determines whether the card is in the authorization permission list of the first card reader, if , then determine the authorization of the card, otherwise it is determined that the card is not authorized.
  • the stored third calculation factor may be obtained when the card is authorized by a certain card reader.
  • the third calculation factor may be that the card obtained the latest time.
  • the calculation factor that the card reader sends to the card when the card reader is authorized (for example, may be sent along with the first authentication information described above), or the card is calculated according to the locally stored calculation factor when the authorization of a card reader is obtained last time.
  • the calculation may be performed, or it may be a calculation factor sent by the card reader to the card when the card is authorized by each card reader, which may be set according to a specific application.
  • the card uses the calculation factor obtained when the previous card reader is authorized to be used as a parameter for calculating the second authentication information, so that the background can determine whether the card has obtained a certain reading according to the second authentication information.
  • the card can implement the linkage authorization between the card readers in the following two ways:
  • Manner 1 The third calculation factor is the calculation factor obtained when the card is successfully authorized by the card reader last time.
  • the third calculation factor may be a calculation factor that the card reader sends to the card through the authentication command when the card is successfully authorized by the card reader last time, that is, after the card receives the authentication command sent by the card reader, the authentication command is After the authentication information is passed, the card can be considered to have successfully obtained the authorization of the card reader, and the calculation factor in the authentication instruction is stored as the third calculation factor; or the third calculation factor may be that the card was successfully read last time.
  • the card reader calculates the calculation factor sent to the card by the authentication command, that is, after the card receives the authentication command sent by the card reader, after the authentication information in the authentication command is authenticated,
  • the card may be deemed to have successfully obtained the authorization of the card reader, and then the calculation factor in the authentication instruction is calculated according to a predetermined algorithm, and the calculation result is stored as a third calculation factor; or the third calculation factor may be the last success of the card.
  • the third calculation factor stored locally is calculated. After the card receives the authentication command sent by the card reader, after the authentication information in the authentication command is authenticated, the card can be considered to have successfully obtained the authorization of the card reader, and then locally stored according to a predetermined algorithm.
  • the third calculation factor is calculated, and the stored third calculation factor is updated using the calculation result; or the third calculation factor may be the third calculation factor and the card reader stored locally when the card successfully obtains the authorization of the card reader last time.
  • the authentication factor sent by the authentication command to the card is calculated, after the card receives the authentication command sent by the card reader, after the authentication information in the authentication command is authenticated, the card can be considered to have successfully obtained the card reader.
  • Authorization, the third calculation factor stored locally and the calculation factor in the authentication instruction are calculated according to a predetermined algorithm, and the stored third calculation factor is updated by using the calculation result. In this way, the background can be made according to the second authentication.
  • the calculation parameter of the information traces the card to obtain the authorized trajectory, which can be judged The first prerequisite of the authorization given to whether the card reader satisfied.
  • the card after the card transmits the second authentication information to the first card reader, the card updates the stored third calculation factor according to the first calculation factor and/or the third calculation factor.
  • the card transmits the second authentication message to the first reading.
  • the stored third calculation factor is updated using the first calculation factor; and when the third calculation factor is the card's last successful acquisition of the card reader's authorization, the calculation factor sent by the card reader to the card by the authentication command is calculated.
  • the card after transmitting the second authentication information to the first card reader, the card calculates the first calculation factor, and updates the stored third calculation factor using the operation result; the third calculation factor is the card's last success.
  • the card When obtaining the authorization of the card reader, if the third calculation factor stored locally is calculated, the card calculates the third calculation factor stored locally after transmitting the second authentication information to the first card reader. Updating the stored third calculation factor using the operation result; the third calculation factor is When the card is successfully authorized by the card reader last time, the third calculation factor stored locally is calculated by the calculation factor sent by the card reader to the card through the authentication command, and the card is sent to the second authentication information. After a card reader, the locally calculated third calculation factor and the first calculation factor are operated, and the stored third calculation factor is updated by using the operation result. For example, the card may splicing the stored third calculation factor and the first calculation factor.
  • a self-operation for example, a self-addition operation, a self-subtraction operation, etc.
  • MAC operation for example, a self-addition operation, a self-subtraction operation, etc.
  • the background may obtain a fourth calculation factor corresponding to the first card reader by: obtaining, by the background, the second card reader to authorize the card or with the first card reader The fourth calculation factor obtained when the third card reader with the same precondition is given the authorization to authorize the card.
  • the background can maintain a table for each card, recording the fourth calculation factor obtained by the card each time it is authorized, to reflect which card readers have been authorized by the same card.
  • the fourth calculation factor may be a calculation factor that the card reader sends to the card through the authentication command when the card reader authorizes the card, or may be the card reader when the card is authorized to read the card.
  • the calculation result obtained by the calculation instruction sent to the card by the authentication instruction may be obtained by calculating the fourth calculation factor obtained when the previous card reader authorizes the card, or may be the previous reading.
  • the fourth calculation factor obtained when the card device authorizes the card is calculated by calculating the calculation factor sent by the card reader to the card through the authentication command.
  • the card since only one third calculation factor is stored on the card side, in practical applications, after obtaining the authorization of the second card reader, the card may obtain authorization of other card readers, thereby making The third calculation factor stored in the card may not be the fourth calculation factor corresponding to the second card reader in the precondition for the authorization given by the first card reader. Therefore, in an optional implementation manner of this embodiment, when the second authentication factor obtained by authorizing the card by the second card reader fails to pass the verification when the second authentication information is verified by the second card reader, the background may be used again. The fourth calculation factor obtained when the third card reader authorized the first card reader gives the authorization is verified by the fourth calculation factor obtained when the card is authorized last time to reduce the false positive.
  • the authentication information is authenticated. For example, if the first card reader gives the authorization condition that only the card has obtained the authorization of the second card reader, the third card reader with the same precondition as the first card reader is given the last card pair.
  • the fourth calculation factor obtained when the authorization is performed authenticates the second authentication information; if the first card reader gives the authorization, the card must be authorized by the second card reader, and then the first card reader can Authorization, that is, between the authorization of the card requesting the second card reader and the first card reader, the authorization of the other card reader is not obtained, and the background cannot use the same third condition as the first card reader gives the authorization.
  • the fourth calculation factor obtained by the reader when authorizing the card last time Second the authentication information is authenticated.
  • the background cannot be acquired in the card.
  • the stored third calculation factor corresponds to the fourth calculation factor, so the second authentication information cannot be authenticated, and the second authentication information is not authenticated; the card has successfully obtained the authorization of the second card reader or the first card reader
  • the background can acquire the fourth calculation factor corresponding to the third calculation factor stored in the card, and at this time, the fourth calculation factor and the third calculation factor The same, therefore, the second authentication information is authenticated. Therefore, it can be ensured that the card can obtain the authorization of the first card reader only after satisfying the precondition of the authorization given by the first card reader, and realize the linkage authorization between the plurality of card readers.
  • the first card in order to enable the card reader to authorize the card to be authorized by the first card reader to authorize the card, the first card can be obtained.
  • the fifth calculation factor obtained when the card authorizes the card, after the second authentication information is authenticated in the background, or after determining that the first card reader can authorize the card, the background may be based on the first calculation factor and / or a fourth calculation factor, the fifth calculation factor is obtained and stored.
  • the fifth calculation factor is obtained according to the first calculation factor, the fourth calculation factor, or a combination of the first calculation factor and the fourth calculation factor, and may be determined in a manner corresponding to the third calculation factor.
  • the stored third calculation factor is the card's last successful authorization to obtain the card reader
  • the first calculation factor is stored as a fifth calculation factor
  • the third calculation factor is the card's last successful authorization to obtain the card reader.
  • the card reader calculates the calculation factor sent to the card by the authentication command
  • the background calculates the first calculation factor, and stores the operation result as the fifth calculation factor
  • the third calculation factor is the card nearest
  • the authorization of the card reader is successfully obtained, if the third calculation factor stored locally is calculated, the fourth calculation factor is calculated in the background, and the operation result is stored as the third calculation factor
  • the third calculation factor of the local storage is calculated by calculating the calculation factor sent by the card reader to the card through the authentication instruction, and the background is calculated by the fourth calculation factor and the first The calculation factor is calculated, and the operation result is stored as the fifth calculation factor.
  • the background can be used with the card.
  • the algorithm calculates the fourth calculation factor and the first calculation factor, for example, splicing the fourth calculation factor and the first calculation factor to obtain a splicing value, and performing self-operation on the obtained spliced value (for example, self-addition operation, The subtraction operation or the like, or the MAC operation, stores the operation result as the fifth calculation factor.
  • the precondition for the authorization of the first card reader can be that the same card does not need to obtain the authorization of any card reader.
  • the precondition for the authorization of the second card reader can be that the same card has successfully obtained the authorization of the first card reader.
  • the premise that the card reader gives the authorization may be that the same card has successfully obtained the authorization of the first card reader and the second card reader, and the predetermined algorithm for generating the third calculation factor and the fifth calculation factor is represented by M.
  • the value of the second calculation factor in the card is null (NULL), and the background recording of the card is not obtained. Have the authorization of any card reader.
  • Step 1 the card requests authorization of the first card reader, the process is as follows: the card receives the authentication command sent by the card reader No. 1, the authentication command carries the first calculation factor r1 and the first authentication information D1; The authentication information D1 is authenticated. When the authentication is passed, a second calculation factor that is empty is obtained. The card generates the second authentication information D2 according to at least the first calculation factor r1 and the second calculation factor, and sends the second authentication information D2. For the first card reader, the card operates on the first calculation factor r1 according to a predetermined algorithm to obtain a third calculation factor M(r1), and replaces the second calculation factor with a third calculation factor, the second calculation in the card.
  • the factor is updated to M(r1); the first card reader receives the second authentication information D2, and sends the first calculation factor r1 and the second authentication information D2 to the background; the background is obtained according to the precondition of the authorization given by the first card reader.
  • the fourth calculation factor corresponding to the empty one of the first card reader, the background authenticates the second authentication information D2 according to the first calculation factor r1 and the obtained fourth calculation factor, the authentication is passed, and the first card is read.
  • a first calculation calculates r1 factor
  • factor M is calculated to obtain a fifth (r1) obtained when the card reader One authorization.
  • Step 2 the card requests to obtain the authorization of the second card reader, the process is as follows: the card receives the authentication command sent by the second card reader, and the authentication command carries the first calculation factor r2 and the first authentication information D3; The first authentication information D3 is authenticated. If the authentication is passed, the second calculation factor M(r1) is obtained, and the card generates the second authentication information D4 according to at least the first calculation factor r2 and the second calculation factor M(r1). The second authentication information D4 is sent to the second card reader, and the card calculates the first calculation factor r2 and the second calculation factor M(r1) according to a predetermined algorithm to obtain a third calculation factor M(r2+M(r1)).
  • the second calculation factor in the card is updated to M(r2+M(r1)); the second card reader receives the first Second, the authentication information D4 is sent to the background by the first calculation factor r2 and the second authentication information D4; and the fourth calculation factor M obtained when the first card reader is authorized according to the precondition of the authorization given by the second card reader (r1), the background is based on the first calculation factor r2 and the fourth calculation factor M(r1) for the second authentication
  • the information D4 is authenticated, the authentication is passed, the second card reader authorizes the card, and the background calculates the first calculation factor r2 and the fourth calculation factor M(r1), and generates the second card reader to authorize the card.
  • Step 3 the card continues to request authorization of the third card reader, the process is as follows: the card receives the authentication command sent by the third card reader, the authentication command carries the first calculation factor r3 and the first authentication information D5; the card pair The first authentication information D5 performs authentication, and if the authentication passes, the second calculation factor M(r2+M(r1)) is obtained, and the card is based at least on the first calculation factor r3 and the second calculation factor M(r2+M(r1) )) generating the second authentication information D6, and transmitting the second authentication information D6 to the third card reader, the card calculating the first calculation factor r3 and the second calculation factor M(r2+M(r1) according to a predetermined algorithm, Obtaining a third calculation factor M(r3+M(r2+M(r1))), replacing the second calculation factor M(r2+M() with a third calculation factor M(r3+M(r2+M(r1))) R1)), the second calculation factor in the card is updated to M(r
  • the third calculation factor includes a calculation factor obtained by the card from the card reader when the authorization of the card reader is successfully obtained, wherein the third calculation factor may be one or more.
  • the second calculation factor when the card obtains the second calculation factor according to the third calculation factor stored in the card, the second calculation factor may be acquired according to one or more third calculation factors stored in the card, wherein the third calculation factor includes the card.
  • the card may select one or more of the one or more calculation factors as the second calculation factor.
  • the third calculation factor may be the first calculation factor carried by the fourth card reader in the authentication instruction when the card requests the authorization of the fourth card reader.
  • the background may obtain the fourth calculation factor corresponding to the first card reader by: obtaining a second calculation factor list in the background, wherein the second calculation factor list includes at least each of the cards when each card reader is successfully authorized. a sixth calculation factor sent by the card reader to the card; the background determines, according to the second calculation factor list, whether the card has successfully obtained the authorization of all the second card readers in the precondition, and if so, obtains from the second calculation factor list A fourth calculation factor corresponding to each of the second card readers in the precondition. In this embodiment, if the sixth calculation factor is included in the second calculation factor list, it indicates that the card has successfully obtained the authorization of the card reader corresponding to the sixth calculation factor.
  • the background is The second calculation factor list is updated, and the first calculation factor is recorded into the second calculation factor list.
  • the first calculation factor when the card acquires the authorization of the first card reader is recorded in the second calculation factor list, and therefore, by determining whether the second calculation factor list has the first The calculation factor can determine whether the card has successfully obtained the authorization of the first card reader. If the first calculation factor is recorded in the second calculation factor list, it indicates that the card has successfully obtained the authorization of the first card reader; if the first calculation factor is not recorded in the second calculation factor list, it indicates that the card has not obtained the first reading. Card authorization.
  • the card when the card acquires the second calculation factor according to one or more third calculation factors stored in the card, the card may be determined according to a precondition of the card authorization given by the first card reader.
  • the authentication command may further carry the identifier information, and the card determines, according to the identifier information, a precondition for the first card reader to grant the authorization; the card may determine, according to the stored third calculation factor, whether the card has successfully obtained the precondition Authorization of all second readers in the box, if yes, from the stored one or more third calculation factors, each second read from the preconditions And acquiring, by the card reader, a second calculation factor, and returning the second authentication information to the first card reader according to the acquired second calculation factor.
  • the card may refuse to respond to the authentication command sent by the first card reader and delete all third calculation factors stored locally.
  • the card responds to the authentication command of the first card reader only after determining that the first card reader is authorized to be authorized, and sends the authentication information to the first card reader, in order to obtain the first Authorization of a card reader, therefore, for a card reader with a higher security level, a corresponding authorization precondition can be set, for example, a card has been authorized by one or more other card readers, if an illegal user wants To break a card reader and obtain authorization from the card reader, it must first obtain authorization from one or more other card readers in order to respond to the card reader's authentication command, and then it is possible to obtain authorization for the card reader. .
  • the identifier information carried in the authentication command sent by the first card reader may be a unique identifier corresponding to the first card reader, for example, the identifier information may be the serial number of the first card reader, It may be identification information of an authentication key corresponding to the first card reader (ie, an authentication key used to authenticate the first authentication information).
  • the card determines, by the identification information, a precondition for the authorization given by the first card reader, thereby determining whether the card satisfies the precondition of the authorization given by the first card reader.
  • the card can determine whether the card has successfully obtained all the second card readers in the precondition by determining whether the card stores the third calculation factor acquired by the card when the authorization of each second card reader in the precondition is successfully obtained. Authorization. If the third calculation factor corresponding to each second card reader in the precondition is stored in the card, the card satisfies the precondition of the authorization given by the first card reader, and acquires a second calculation factor corresponding to the second card reader.
  • the precondition for the authorization of the first card reader can be that the same card does not need to obtain the authorization of any card reader.
  • the precondition for the authorization of the second card reader can be that the same card has successfully obtained the authorization of the first card reader.
  • the premise that the card reader gives authorization may be that the same card has successfully obtained the authorization of the first card reader.
  • the value of the third calculation factor stored in the card is null (NULL), and the background recording of the card is not authorized by any card reader.
  • Step 1 the card requests authorization of the first card reader, the process is as follows: the card receives the authentication command sent by the card reader No. 1, the authentication command carries the first calculation factor r1 and the first authentication information D1; The authentication information D1 is authenticated, and in the case that the authentication is passed, the second calculation factor stored in the card is obtained. Since the premise of the authorization given by the first card reader is that the same card does not need to obtain authorization of any card reader, the card is acquired.
  • the card generates the second authentication information D2 according to at least the first calculation factor r1 and the second calculation factor, and sends the second authentication information D2 to the first card reader, and the card calculates the first calculation factor r1
  • the first card reader receives the second authentication information D2, and sends the first calculation factor r1 and the second authentication information D2 to the background
  • the background obtains the second calculation factor list, because the card is not obtained at this time Authorization of any reader, therefore, the second list of calculation factors is empty, and the sixth calculation factor is also empty
  • the first card reader gives authorization, the prerequisite is A card reader does not require any authorization, therefore, a second factor is calculated according to the background list has been determined proviso
  • One card reader of the authorization given to Authorizing all the second card readers obtaining a fourth calculation factor that is empty in the background, authenticating the second authentication information D2 according to the first calculation factor r1 and the fourth calculation factor, and the authentication is passed, and the first card reader is The card
  • Step 2 The card requests authorization of the second card reader, the process is as follows: the card receives the authentication command sent by the second card reader, and the authentication command carries the first calculation factor r2 and the first authentication information D3; the card pair is first The authentication information D3 is authenticated.
  • the second calculation factor stored in the card is obtained. Since the second card reader gives the authorization condition that the same card has successfully obtained the authorization of the first card reader, the card is The obtained second calculation factor is a third calculation factor r1 obtained when the card obtains the license of the first card reader, and the card generates the second authentication information D4 according to at least the first calculation factor r2 and the third calculation factor r1, and the second authentication information is generated.
  • the second calculation factor list contains the card successfully obtained.
  • the second authentication information D4 is authenticated, the authentication is passed, the second card reader authorizes the card, and the background r2 is recorded into the second calculation factor list.
  • step 3 the card request is authorized by the third card reader, and the process is similar to the process in which the card is authorized by the card reader No. 2, and details are not described herein again.
  • the card stores the first calculation factor r3 sent by the card reader to the card as the third third calculation factor, and the third calculation factor list in the background records the third card reading card.
  • the method provided in this embodiment further includes: clearing the background in the case that the card is authorized to perform the linkage authorization between the card readers. All calculated factors associated with the card are recorded. For example, according to the first method, in the case that the background determines that the card is not authorized, the background clears the calculation factor list corresponding to the card, that is, clears the calculation factor obtained by each card reader when authorizing the card; In the case of determining that the card is not authorized, the second calculation factor list corresponding to the card is cleared in the background. In the case of judging that the card is not authorized, it indicates that the card may be attempting to illegally acquire the authorization of the first card reader. Therefore, all the calculation factors related to the card are cleared in the background, and the card can be prevented from being used by the calculation factor of the background storage. Single to illegally obtain authorization from other readers. In addition, it can also save storage space in the background.
  • the method may further include: the card acquiring the attribute information of the current authentication, and encrypting and storing the attribute information; Before the card receives the authentication command sent by the first card reader, the method may further include: the first card reader acquiring the identification letter of the card The first card reader sends an authentication command to the card; the first card reader sends a notification including at least the identification information of the card to the background; and the background obtains and stores the attribute information of the current authentication of the card according to the notification, for example, the first The card reader can send a card search instruction, the card responds to the card search instruction, and sends a card search response to the first card reader.
  • the first card reader receives the card search response and obtains the card identification information from the card search response.
  • the method may further include: acquiring encrypted attribute information stored in the card; decrypting the encrypted attribute information; and comparing the decrypted attribute information with the attribute information of the card stored in the background If it does not match, the identification card is an illegal card.
  • the card may be instructed to delete the internal calculation factors, indicating that the calculation factor associated with the card is deleted in the background. Therefore, it can be avoided that the background cannot be known that the card is illegally read.
  • the attribute information of the current authentication of the card may be attribute information of the first card reader for authenticating the card, for example, information such as the time, location and number of times the first card reader authenticates the card.
  • the recording mode of the location may be a serial number of the first card reader, and the serial number of the first card reader may be associated with the location of the first card reader, and may be determined according to the serial number of the first card reader.
  • the location of the first card reader; in addition, a chip having a positioning function may be disposed inside the first card reader, and the location information of the card authentication by the first card reader may be acquired according to the positioning chip.
  • the attribute information is encrypted and stored in the card, which prevents the attribute information inside the card from being acquired by other illegal devices, and ensures the security of the attribute information.
  • the attribute information of the current authentication is associated with the identification information of the card and stored.
  • the attribute information may be acquired by the background or read by the verification device capable of reading the attribute information inside the card, and the encrypted attribute information is decrypted, and the decrypted attribute information is decrypted.
  • the attribute information is compared with the attribute information of the card recorded in the background. If the comparison is inconsistent, the card has the risk of being illegally read by the illegal device, and the card is identified as an illegal card.
  • the illegal device can be prevented from attacking the card, the illegal authentication command is initiated, and the data inside the card is obtained, thereby breaking the card.
  • the authorization system includes a card 21, a first card reader 22, and a background 23.
  • the structure of the authorization system is briefly described. For other unworked matters, refer to the description in Embodiment 1.
  • the card 21 is configured to: receive an authentication command sent by the first card reader 22, where the authentication command carries a first calculation factor and first authentication information; and the first authentication information is authenticated, and in the case that the authentication is passed, Calculating a second calculation factor according to at least a third calculation factor stored by the card 21, wherein the third calculation factor comprises: a calculation factor obtained when the card 21 successfully obtains the authorization of the card reader; and generating the second authentication information according to at least the second calculation factor Sending the second authentication information to the first card reader 22; the first card reader 22 is configured to: receive the second authentication information, and send the second authentication information Up to the background 23; the background 23 is configured to: obtain a fourth calculation factor corresponding to the first card reader 22, wherein the fourth calculation factor is obtained according to the precondition of the authorization given by the first card reader 22, the first card reading Prerequisites for granting authorization by the device 22 include whether a second card reader is required to authorize the same card 21, and/or a group of second card readers has authorized the same card 21; at least according to the acquired fourth
  • the card is configured to respond to the authentication command sent by the first card reader, generate the second authentication information according to the stored third calculation factor, and send the second authentication information to the first card reader, where the first card reader is configured to receive
  • the second authentication information is sent to the background, and the background is used to obtain the fourth calculation factor corresponding to the first card reader according to the precondition of the authorization given by the first card reader after receiving the second authentication information, and use the fourth calculation factor.
  • the second authentication information sent by the card is authenticated. If the card does not obtain the authorization of the card reader in the precondition of the authorization given by the first card reader, the calculation factor corresponding to the fourth calculation factor is not stored in the card. The authentication of the second authentication information is not passed, so that the card cannot be authorized.
  • corresponding control authority can be set, for example, one card has been obtained for one or more other readings.
  • Authorization of the card device if an illegal user wants to break a card reader and obtain authorization from the card reader, he must first obtain one or more other card readers. Authorization, authorization may have acquired by the reader, to achieve a more reader interaction effect given authorization.
  • the stored third calculation factor may be obtained when the card 21 is authorized by a certain card reader.
  • the third calculation factor may be obtained by the card 21 at the latest time.
  • the calculation factor that the card reader sends to the card 21 when authorized by a card reader (for example, may be sent along with the first authentication information described above), or the card 21 is locally based on the last time the authorization of a card reader is obtained.
  • the stored calculation factor is calculated, or may be the calculation factor sent by the card reader to the card 21 when the card 21 is authorized by each card reader, and may be set according to a specific application.
  • the card 21 uses the calculation factor obtained when the previous card reader is authorized to be used as a parameter for calculating the second authentication information, so that the background 23 can determine whether the card 21 has obtained a certain reading according to the second authentication information.
  • the card 21 can implement linkage authorization between the readers in the following two ways:
  • the third calculation factor is a calculation factor obtained when the card 21 successfully obtains the authorization of the card reader.
  • the card 21 is further configured to update the stored third calculation factor according to the first calculation factor and/or the third calculation factor after transmitting the second authentication information to the first card reader 22. .
  • the background 23 can obtain the fourth calculation factor corresponding to the first card reader 22 by: the background 23 obtaining the second card reader to authorize the card or the first
  • the card reader 22 gives a fourth calculation factor obtained when the third card reader having the same precondition is authorized to authorize the card 21 most recently.
  • the fifth calculation factor obtained when the card reader 22 authorizes the card 21, the background 23 can also be used after the authentication of the second authentication information is passed, or after determining that the first card reader 22 can perform the card 21
  • the fifth calculation factor is obtained and stored according to the first calculation factor and/or the fourth calculation factor described above.
  • the fifth calculation factor is obtained according to the first calculation factor, the fourth calculation factor, or a combination of the first calculation factor and the fourth calculation factor, and may be determined in a manner corresponding to the third calculation factor.
  • the third calculation factor includes a calculation factor obtained by the card 21 from the card reader when the authorization of the card reader is successfully obtained, wherein the third calculation factor may be one or more.
  • the card 21 obtains a second calculation factor according to a third calculation factor stored by the card 21 by acquiring a second calculation factor according to one or more third calculation factors stored by the card 21, wherein the third calculation factor
  • the calculation factor includes the calculation factor obtained by the card 21 from the fourth card reader upon successful authorization to obtain the fourth card reader.
  • card 21 may select one or more calculation factors from one or more third calculation factors as a second calculation factor.
  • the third calculation factor may be the first calculation factor carried by the fourth card reader in the authentication instruction when the card 21 requests authorization of the fourth card reader.
  • the background 23 can obtain the fourth calculation factor corresponding to the first card reader 22 by acquiring the second calculation factor list, wherein the second calculation factor list includes at least the card 21 when the individual card reader authorization is successfully obtained.
  • a fourth calculation factor corresponding to each second card reader in the precondition is obtained in the list.
  • the sixth calculation factor is included in the second calculation factor list, it indicates that the card 21 has successfully obtained the authorization of the card reader corresponding to the sixth calculation factor.
  • the background 23 is also used to determine the card 21.
  • the second calculation factor list is updated, and the first calculation factor is recorded into the second calculation factor list.
  • the card 21 may obtain a second calculation factor according to one or more third calculation factors stored by the card 21 in such a manner that the card 21 is authorized according to the first card reader 22
  • the preconditions are determined.
  • the authentication command may further carry the identification information, and the card 21 determines, according to the identification information, a precondition for the authorization given by the first card reader 22; the card 21 may determine, according to the stored third calculation factor, whether the card 21 has been Successfully obtaining the authorization of all the second card readers in the precondition, and if so, obtaining the second calculation factor obtained from each of the second card readers in the preconditions from the stored one or more third calculation factors, And returning the second authentication information to the first card reader 22 according to the obtained second calculation factor. If the card 21 judges that the card 21 is not successfully obtained in the precondition The authorization of all of the second card readers, the card 21 may refuse to respond to the authentication command sent by the first card reader 22 and delete all third calculation factors stored locally.
  • the background 23 can also be used to determine that the card 21 is not authorized. Clear all recorded calculation factors associated with card 21.
  • the authorization system provided in this embodiment may further include: a verification device 24; the card 21 is further configured to receive the first card reader 22 and send the message. After the authentication command, the attribute information of the current authentication is obtained, and the attribute information is encrypted and stored.
  • the first card reader 22 is further configured to acquire the identification information of the card 21, and after sending the authentication instruction to the card 21, send the information to the background 23.
  • the notification includes at least the identification information of the card 21; the background 23 is further configured to acquire and store the attribute information of the current authentication of the card 21 according to the notification.
  • the first card reader 22 may be configured to send a card search instruction, and the card 21 It is also operable to send a card seek response to the first card reader 22 in response to the card seek instruction, the first card reader 22 receiving the card seek response, and obtaining the identification information of the card 21 from the card seek response.
  • the verification device 24 is configured to acquire the encrypted attribute information stored by the card 21, decrypt the encrypted attribute information, and decrypt the attribute information obtained by the decryption with the attribute of the card 21 stored in the background 23. The information is compared, and if it does not match, the identification card 21 is an illegal card 21.
  • the card 21 After identifying that the card 21 is an illegal card, the card 21 can be instructed to delete the various calculation factors stored internally, instructing the background 23 to delete the calculation factor associated with the card 21. Therefore, it is possible to prevent the background 23 from being able to know that the card 21 has been illegally read.
  • portions of the invention may be implemented in hardware, software, firmware or a combination thereof.
  • multiple steps or methods may be implemented in software or firmware stored in a memory and executed by a suitable instruction execution system.
  • a suitable instruction execution system For example, if implemented in hardware, as in another embodiment, it can be implemented by any one or combination of the following techniques well known in the art: having logic gates for implementing logic functions on data signals. Discrete logic circuits, application specific integrated circuits with suitable combinational logic gates, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.
  • each functional unit in each embodiment of the present invention may be integrated into one processing component, or each unit may exist physically separately, or two or more units may be integrated into one component.
  • the above integrated components can be implemented in the form of hardware or in the form of software functional components.
  • the integrated components, if implemented in the form of software functional components and sold or used as separate products, may also be stored in a computer readable storage medium.
  • the above mentioned storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Abstract

一种授权方法及系统，其中，授权方法包括：卡片接收第一读卡器发送的携带有第一计算因子和第一认证信息的认证指令（S101）；卡片对第一认证信息进行认证，在认证通过的情况下，至少根据所述卡片存储的第三计算因子得到第二计算因子，其中，所述第三计算因子包括：所述卡片成功获得读卡器的授权时得到的计算因子（S102）；卡片至少根据第二计算因子生成第二认证信息，将第二认证信息发送给第一读卡器（S103）；第一读卡器将第二认证信息发送至后台（S104）；后台获取第一读卡器对应的第四计算因子，其中，第四计算因子为根据第一读卡器给予授权的前提条件得到的，其中，第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组第二读卡器已对同一卡片进行授权（S105）；后台至少根据获取的第四计算因子对第二认证信息进行认证，并至少根据认证结果判断是否对卡片进行授权（S106）。

Description

一种授权方法及系统
相关申请的交叉引用
本申请要求天地融科技股份有限公司于2016年9月9日提交中国专利局、申请号为201610816023.9、发明名称为“一种授权方法及系统”的中国专利申请的优先权。
技术领域
本发明涉及一种电子技术领域，尤其涉及一种授权方法及系统。
背景技术
在授权系统中，为了实现不同等级的授权，往往需要设置多个读卡器，每一个读卡器能够实现特定等级的授权。然而，现有的授权系统中，每个读卡器都是相互独立的，与其他读卡器之间没有关联。因此，不法分子只需要攻破一个读卡器，就能够获取该读卡器能够实现的授权。然而，不法分子攻破每一个读卡器所需的时间都是差不多的，即现有技术中对于更高等级授权的读卡器并没有实现更高的安全保证。
发明内容
本发明旨在解决上述问题/之一。
本发明的主要目的在于提供一种授权方法；
本发明的另一目的在于提供一种授权系统。
为达到上述目的，本发明的技术方案具体是这样实现的：
本发明一方面提供了一种授权方法，其特征在于，包括：卡片接收第一读卡器发送的认证指令，其中，所述认证指令中携带有第一计算因子和第一认证信息；所述卡片对所述第一认证信息进行认证，在认证通过的情况下，至少根据所述卡片存储的第三计算因子得到第二计算因子，其中，所述第三计算因子包括：所述卡片成功获得读卡器的授权时得到的计算因子；所述卡片至少根据所述第二计算因子生成第二认证信息，将所述第二认证信息发送给所述第一读卡器；所述第一读卡器接收所述第二认证信息，并将所述第二认证信息发送至后台；所述后台获取所述第一读卡器对应的第四计算因子，其中，所述第四计算因子为根据所述第一读卡器给予授权的前提条件得到的，所述第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组所述第二读卡器已对同一卡片进行授权；所述后台至少根据获取的所述第四计算因子对所述第二认证信息进行认证，并至少根据认证结 果判断是否对所述卡片进行授权。
本发明另一方面提供了一种授权系统，其特征在于，包括：卡片，第一读卡器和后台；所述卡片，用于：接收所述第一读卡器发送的认证指令，其中，所述认证指令中携带有第一计算因子和第一认证信息；对所述第一认证信息进行认证，在认证通过的情况下，至少根据所述卡片存储的第三计算因子得到第二计算因子，其中，所述第三计算因子包括：所述卡片成功获得读卡器的授权时得到的计算因子；至少根据所述第二计算因子生成第二认证信息，将所述第二认证信息发送给所述第一读卡器；所述第一读卡器，用于：接收所述第二认证信息，并将所述第二认证信息发送至所述后台；所述后台，用于：获取所述第一读卡器对应的第四计算因子，其中，所述第四计算因子为根据所述第一读卡器给予授权的前提条件得到的，所述第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组所述第二读卡器已对同一卡片进行授权；至少根据获取的所述第四计算因子对所述第二认证信息进行认证，并至少根据认证结果判断是否对所述卡片进行授权。
由上述本发明提供的技术方案可以看出，本发明提供了一种授权方法，卡片在响应第一读卡器发送的认证指令时，根据存储的第三计算因子生成第二认证信息发送给第一读卡器，由第一读卡器发送给后台认证，后台接收卡片发送的第二认证信息后，后台根据第一读卡器给予授权的前提条件，获取第一读卡器对应的第四计算因子，至少利用第四计算因子对卡片发送的第二认证信息认证，如果卡片没有获取到第一读卡器给予授权的前提条件中的读卡器的授权，则卡片没有存储有与第四计算因子对应计算因子，后台对第二认证信息的认证不通过，从而无法对卡片进行授权，因此，对于安全级别较高的读卡器，可以设置对应的控制权限，例如，需要一张卡片已经获得其它一个或多个读卡器的授权，非法用户如果想攻破一个读卡器，获得该读卡器的授权，必须先获得其它一个或多个读卡器的授权，才有由可能获取到该读卡器的授权，实现了多个读卡器给予授权的联动效果。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他附图。
图1为本发明实施例1提供的授权方法的流程图；
图2为本发明实施例2提供的一种授权系统的结构示意图；
图3为本发明实施例2提供的另一种授权系统的结构示意图。
具体实施方式
下面结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明的保护范围。
下面将结合附图对本发明实施例作进一步地详细描述。
实施例1
本实施例提供了一种授权方法，如图1所示，该方法包括以下步骤(S101-S106)：
S101：卡片接收第一读卡器发送的认证指令，其中，认证指令中携带有第一计算因子和第一认证信息。
S102：卡片对第一认证信息进行认证，在认证通过的情况下，至少根据存储的第三计算因子得到第二计算因子，其中，第三计算因子包括：所述卡片成功获得读卡器的授权时得到计算因子。
S103：卡片至少根据第二计算因子生成第二认证信息，将第二认证信息发送给第一读卡器。
S104：第一读卡器接收第二认证信息，并将第二认证信息发送至后台。
S105：后台获取第一读卡器对应的第四计算因子，其中，第四计算因子为根据第一读卡器给予授权的前提条件得到的，其中，第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组第二读卡器已对同一卡片进行授权。
S106：后台至少根据获取的第四计算因子对第二认证信息进行认证，并至少根据认证结果判断是否对卡片进行授权。
通过本实施例提供的授权方法，卡片在响应第一读卡器发送的认证指令时，根据存储的第三计算因子生成第二认证信息发送给第一读卡器，由第一读卡器发送给后台，后台接收卡片发送的第二认证信息后，后台根据第一读卡器给予授权的前提条件，获取第一读卡器对应的第四计算因子，利用第四计算因子对卡片发送的第二认证信息认证，如果卡片没有获取到第一读卡器给予授权的前提条件中的读卡器的授权，则卡片中没有存储有与第四计算因子对应的计算因子，后台对第二认证信息的认证不通过，从而无法对卡片进行授权，因此，对于安全级别较高的读卡器，可以设置对应的控制权限，例如，需要一张卡片已经获得其它一个或多个读卡器的授权，非法用户如果想攻破一个读卡器，获得该读卡器的授权，必须先获得其它一个或多个读卡器的授权，才有由可能获取到该读卡器的授权，实现了多个读卡器给予授权的联动效果。
在本实施例中，卡片可以为磁条卡、集成电路卡(Integrated Circuit Card，简称IC卡)、智能卡等类型的卡片，在本实施例中不作具体限定，只要能够被第一读卡器读取的卡片，均在本实施例的保护范围之内。第一读卡器为当前与卡片交互的读卡器，第一读卡器的类型与卡片的类型相对应，例如：当卡片为磁条卡时，第一读卡器为磁卡读卡器；当卡片为IC卡时，第一读卡器为IC卡读卡器，在本实施例中对第一读卡器的类型不作具体限定。
另外，在本实施例中，卡片可以为接触型，也可以为非接触型。如果卡片为非接触型，当卡片位于第一读卡器的工作距离以内时，卡片与第一读卡器可以进行通信，实现无需插卡即可进行通信。当卡片为接触型时，只有卡片的触点与第一读卡器的接口正确连接时，卡片与第一读卡器才能进行通信。在本实施例中，当卡片为非接触型时，第一读卡器可以周期性的广播寻卡指令，卡片如果位于第一读卡器的读卡范围，则卡片可以响应第一读卡器的寻卡指令，向第一读卡器发送寻卡响应，第一读卡器在接收到寻卡响应后，可以确定当前读取的卡片，进而向卡片发送认证指令。
在本实施例中，第一计算因子可以是第一读卡器生成的随机数，也可以为第一读卡器给予授权的次数，还可以是该卡片请求授权的总次数，具体本实施例不作限定，第一读卡器利用认证密钥，按照预设的校验算法对第一计算因子进行计算，得到校验值，将该校验值作为第一认证信息携带在认证指令中发送给卡片。其中，预设的校验算法可以为MAC算法，也可以为其它校验算法，例如，签名算法，具体本实施例不作限定。
而卡片在对第一认证信息进行认证时，首先获取第一读卡器的认证密钥，再采用与第一读卡器相同的校验算法，对第一计算因子进行计算生成校验值，比较计算得到的校验值和接收的认证指令中的校验值是否相同，如果相同，则第一认证信息认证通过，如果不相同，则第一认证信息认证不通过。如果第一认证信息认证通过，则表明第一认证信息没有被篡改且第一读卡器的身份合法，如果认证不通过，则表明第一认证信息被篡改和/或第一读卡器的身份不合法。
其中，在认证指令中还可以携带有与第一读卡器对应的唯一标识，例如，该标识信息可以是第一读卡器的序列号，也可以是第一读卡器对应的认证密钥(即用于对第一认证信息进行认证的认证密钥)的标识信息。卡片根据该标识信息可以确定第一读卡器的认证密钥。
在本实施例中，卡片在第一认证信息认证通过的情况下，向第一读卡器发送第二认证信息，其中，第二认证信息可以是卡片利用认证密钥对第二计算因子按照预设的校验算法进行计算生成的校验值。卡片利用卡片自身的认证密钥，按照预设的校验算法对第二计算因子进行计算，得到校验值，将该校验值携带在第二认证信息中发送给第一读卡器。其中，预设的校验算法可以为MAC算法，也可以为其它校验算法，例如，签名算法，具体本实施例不作限定。
在本实施例中，第一读卡器接收第二认证信息后，与后台联合判断是否为卡片授权。第一读卡器接收第二认证信息后，将第二认证信息发送至后台，后台至少对第二认证信息进行认证，将认证结果返回给第一读卡器，然后第一读卡器至少根据认证结果判断是否为卡片授权。后台对第二认证信息进行认证时，首先获取卡片的认证密钥和第一读卡器对应的第四计算因子，再采用与卡片相同的校验算法，至少对第四计算因子进行计算生成校验值，比较计算得到的校验值和接收的第二认证信息中的校验值是否相同，如果相同，则第二认证信息认证通过，如果不相同，则第二认证信息认证不通过。如果第二认证信息认证通过，则表明卡片中存储有与第四计算因子对应的计算因子，且第二认证信息没有被篡改且卡片的身份合法，如果认证不通过，则表明卡片中没有存储与第四计算因子对应的计算因子，或者第二认证信息被篡改和/或卡片的身份不合法。
在本实施例中，第一读卡器除了可以根据第二认证信息判断是否为卡片授权之外，还可以根据其他信息判断是否为卡片授权，因此，作为本发明实施例的一个可选实施方式，在第二认证信息认证通过的情况下，后台获取第一读卡器授权的权限列表，根据权限列表判断是否对卡片进行授权，将判断结果发送给第一读卡器，其中，第一读卡器授权的权限列表至少记录了允许第一读卡器授权的卡片的标识信息。根据卡片是否在第一读卡器的授权权限列表中判断是否为卡片授权，即判断卡片是否为第一读卡器的授权用户。在具体应用中，第一读卡器的授权权限列表可以存储在后台，也可以存储在第一读卡器本地，如果是存储在第一读卡器本地，则由第一读卡器进行判断，如果是存储在后台，则由后台进行判断，最后结合对第二认证信息进行认证的认证结果判断是否为卡片授权。例如，如果授权权限列表存储在后台，则后台对第二认证信息进行认证通过之后，进一步判断卡片是否在第一读卡器的授权权限列表中，如果是，则向第一读卡器认证通过的认证结果，第一读卡器根据该认证结果，确定对该卡片进行授权；如果授权权限列表存储在第一读卡器，则后台对第二认证信息进行认证通过之后，向第一读卡器返回指示第二认证信息是否认证通过的认证结果，如果该认证结果指示第二认证信息认证通过，则第一读卡器进一步判断卡片是否在第一读卡器的授权权限列表中，如果是，则确定对该卡片进行授权，否则确定不对卡片进行授权。
作为本发明实施例的一个可选实施方式，存储的第三计算因子可以是卡片在获得某个读卡器的授权时获取到的，例如，第三计算因子可以为卡片在最近一次获得某个读卡器的授权时该读卡器发送给卡片的计算因子(例如，可以伴随上述第一认证信息一起发送)，或者，最近一次获得某个读卡器的授权时卡片根据本地存储的计算因子进行计算得到的，或者，也可以是卡片之前获得每个读卡器的授权时该读卡器发送给卡片的计算因子，具体可以根据具体应用进行设置。在本实施例中，卡片通过将之前读卡器给予授权时获取的计算因子作为计算第二认证信息的参数，从而使得后台可以根据该第二认证信息确定卡片是否已获得某个读 卡器的授权，以实现读卡器之间的联动授权。
在本发明实施例的一个可选实施方式中，卡片可以通过以下两种方式实现读卡器之间的联动授权：
方式一：第三计算因子为卡片最近一次成功获得读卡器的授权时得到的计算因子。
例如，第三计算因子可以是卡片最近一次成功获得读卡器的授权时，读卡器通过认证指令发送给卡片的计算因子，即卡片接收到读卡器发送的认证指令后，在对认证指令中的认证信息进行认证通过之后，卡片可以认为已成功获得该读卡器的授权，将认证指令中的计算因子作为第三计算因子存储；或者，第三计算因子可以是卡片最近一次成功获得读卡器的授权时，对读卡器通过认证指令发送给卡片的计算因子进行运算得到的，即卡片接收到读卡器发送的认证指令后，在对认证指令中的认证信息进行认证通过之后，卡片可以认为已成功获得该读卡器的授权，则按照预定的算法对认证指令中的计算因子进行计算，将计算结果作为第三计算因子存储；或者，第三计算因子可以是卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子进行运算得到的，即卡片接收到读卡器发送的认证指令后，在对认证指令中的认证信息进行认证通过之后，卡片可以认为已成功获得该读卡器的授权，则按照预定的算法对本地存储的第三计算因子进行计算，使用计算结果更新存储的第三计算因子；或者，第三计算因子可以是卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子与读卡器通过认证指令发送给卡片的计算因子进行运算得到的，即卡片接收到读卡器发送的认证指令后，在对认证指令中的认证信息进行认证通过之后，卡片可以认为已成功获得该读卡器的授权，则按照预定的算法对本地存储的第三计算因子以及认证指令中的计算因子进行计算，使用计算结果更新存储的第三计算因子，采用这种方式，可以使得后台可以根据第二认证信息的计算参数追溯卡片获取授权的轨迹，进而可以判断出卡片是否满足第一读卡器给予授权的前提条件。
对应地，在该实施方式中，卡片在将第二认证信息发送给第一读卡器之后，卡片根据第一计算因子和/或第三计算因子，更新存储的第三计算因子。
例如，在存储的第三计算因子是卡片最近一次成功获得读卡器的授权时，读卡器通过认证指令发送给卡片的计算因子的情况下，卡片在将第二认证信息发送给第一读卡器之后，使用第一计算因子更新存储的第三计算因子；在第三计算因子为卡片最近一次成功获得读卡器的授权时，对读卡器通过认证指令发送给卡片的计算因子进行运算得到的情况下，卡片在将第二认证信息发送给第一读卡器之后，对第一计算因子进行运算，使用运算结果更新存储的第三计算因子；在第三计算因子是卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子进行运算得到的情况下，卡片在将第二认证信息发送给第一读卡器之后，对本地存储的第三计算因子进行运算，使用运算结果更新存储的第三计算因子；在第三计算因子是 卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子与读卡器通过认证指令发送给卡片的计算因子进行运算得到的情况下，卡片在将第二认证信息发送给第一读卡器之后，对本地存储的第三计算因子和第一计算因子进行运算，使用运算结果更新存储的第三计算因子，例如，卡片可以将存储的第三计算因子和第一计算因子拼接后得到一个拼接值，对得到的拼接值进行自运算(例如，自加运算，自减运算等)或者MAC运算，然后更新存储的第三计算因子，置第三计算因子＝运算结果。采用这种方式存储和更新第三计算因子时，在卡片中只需要存储一个计算因子，有效地节省了卡片的存储空间。
对应地，在对第二认证信息进行认证时，后台可以通过如下方式获取第一读卡器对应的第四计算因子：后台获取第二读卡器对卡片进行授权时或与第一读卡器给予授权的前提条件相同的第三读卡器最近一次对卡片进行授权时得到的第四计算因子。
在具体应用中，后台可以对每张卡片维护一张表，记录该卡片每次获得到授权时得到的第四计算因子，以体现同一卡片已经获得了哪些读卡器的授权。与第三计算因子对应，第四计算因子可以是读卡器对卡片进行授权时，读卡器通过认证指令发送给卡片的计算因子，也可以是读卡器对卡片进行授权时，对读卡器通过认证指令发送给卡片的计算因子进行运算得到的，还可以是对上一个读卡器对该卡片进行授权时得到的第四计算因子进行运算得到的，或者，也可以是对上一个读卡器对该卡片进行授权时得到的第四计算因子与本读卡器通过认证指令发送给卡片的计算因子进行运算得到的。
在本实施例中，由于卡片侧只存储一个第三计算因子，因此，在实际应用中，卡片在获取第二读卡器的授权之后，还可能又获得了其它读卡器的授权，从而使得卡片中存储的第三计算因子可能并不是第一读卡器给予授权的前提条件中的第二读卡器对应的第四计算因子。因此，在本实施例的一个可选实施方式中，后台在验证第二认证信息时，如果采用第二读卡器对卡片进行授权时得到的第四计算因子认证不通过，则还可以再次采用与第一读卡器给予授权的前提条件相同的第三读卡器最近一次对卡片进行授权时得到的第四计算因子进行验证，以减少误判。
在具体应用中，可以根据具体的授权前提条件来确定是否采用与第一读卡器给予授权的前提条件相同的第三读卡器最近一次对卡片进行授权时得到的第四计算因子对第二认证信息进行认证。例如，如果第一读卡器给予授权的前提条件只是卡片已获得第二读卡器的授权，则可以采用与第一读卡器给予授权的前提条件相同的第三读卡器最近一次对卡片进行授权时得到的第四计算因子对第二认证信息进行认证；如果第一读卡器给予授权的前提条件是卡片必须在获得第二读卡器的授权之后，紧接着第一读卡器可以授权，即卡片在请求第二读卡器和第一读卡器的授权之间，没有再获得其它读卡器的授权，后台不能采用与第一读卡器给予授权的前提条件相同的第三读卡器最近一次对卡片进行授权时得到的第四计算因子对第 二认证信息进行认证。
在本实施例中，在卡片没有成功获取第二读卡器的授权或与第一读卡器给予授权的前提条件相同的第三读卡器的授权的情况下，后台不能获取到与卡片中存储的第三计算因子对应的第四计算因子，因此不能对第二认证信息进行认证，第二认证信息认证不通过；在卡片已经成功获取第二读卡器的授权或与第一读卡器给予授权的前提条件相同的第三读卡器的授权的情况下，后台能够获取到与卡片中存储的第三计算因子对应的第四计算因子，此时，第四计算因子和第三计算因子相同，因此，第二认证信息认证通过。从而可以保证卡片只有在满足第一读卡器给予授权的前提条件，才能获得第一读卡器的授权，实现了多个读卡器之间的联动授权。
在本实施例的一个可选实施方式中，为了使以第一读卡器已成功对卡片进行授权为给予授权的前提条件的其它读卡器在给予卡片进行授权时，可以获取第一读卡器对卡片进行授权时得到的第五计算因子，在后台对第二认证信息进行认证通过之后，或者，在确定第一读卡器可以对卡片进行授权之后，后台可以根据上述第一计算因子和/或第四计算因子，得到并存储第五计算因子。在具体应用中，第五计算因子是根据第一计算因子、第四计算因子、或第一计算因子与第四计算因子的组合来得到的，可以采用与第三计算因子对应的方式确定。
例如，在存储的第三计算因子是卡片最近一次成功获得读卡器的授权时，将第一计算因子存储为第五计算因子；在第三计算因子为卡片最近一次成功获得读卡器的授权时，对读卡器通过认证指令发送给卡片的计算因子进行运算得到的情况下，则后台对第一计算因子进行运算，将运算结果存储为第五计算因子；在第三计算因子是卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子进行运算得到的情况下，则后台对第四计算因子进行运算，将运算结果存储为第三计算因子；在第三计算因子是卡片最近一次成功获得读卡器的授权时，对本地存储的第三计算因子与读卡器通过认证指令发送给卡片的计算因子进行运算得到的情况下，后台对第四计算因子和第一计算因子进行运算，将运算结果存储为第五计算因子，例如，后台可以采用与卡片相同的算法对第四计算因子和第一计算因子进行运算，例如，将第四计算因子和第一计算因子拼接后得到一个拼接值，对得到的拼接值进行自运算(例如，自加运算，自减运算等)或者MAC运算，将运算结果存储为第五计算因子。
以在一个包含三个读卡器的系统为例，假设三个读卡器的编号分别为一号读卡器、二号读卡器和三号读卡器。一号读卡器给予授权的前提条件可以为同一卡片不需要获得任何读卡器的授权，二号读卡器给予授权的前提条件可以为同一卡片已成功获得一号读卡器的授权，三号读卡器给予授权的前提条件可以为同一卡片已成功获得一号读卡器和二号读卡器的授权，生成第三计算因子和第五计算因子的预定的算法用M表示。在本实施例的一个可选实施方式中，在初始状态下，卡片中的第二计算因子的值为空(NULL)，后台记录该卡片未获 得任一读卡器的授权。
步骤1，卡片请求获得一号读卡器的授权，过程如下：卡片接收一号读卡器发送的认证指令，认证指令中携带有第一计算因子r1和第一认证信息D1；卡片对第一认证信息D1进行认证，在认证通过的情况下，获取一个为空的第二计算因子，卡片至少根据第一计算因子r1和第二计算因子生成第二认证信息D2，将第二认证信息D2发送给一号读卡器，卡片按照预定算法对第一计算因子r1进行运算，得到第三计算因子M(r1)，使用第三计算因子替换为空的第二计算因子，卡片中的第二计算因子更新为M(r1)；第一读卡器接收第二认证信息D2，并将第一计算因子r1和第二认证信息D2发送至后台；后台根据一号读卡器给予授权的前提条件获取一号读卡器对应的为空的第四计算因子，后台根据第一计算因子r1和获取的第四计算因子对第二认证信息D2进行认证，认证通过，一号读卡器为卡片进行授权，后台对第一计算因子r1进行运算，得到一号读卡器对卡片进行授权时得到的第五计算因子M(r1)。
步骤2，该卡片再请求获得二号读卡器的授权，过程如下：卡片接收二号读卡器发送的认证指令，认证指令中携带有第一计算因子r2和第一认证信息D3；卡片对第一认证信息D3进行认证，在认证通过的情况下，获取第二计算因子M(r1)，卡片至少根据第一计算因子r2和第二计算因子M(r1)生成第二认证信息D4，将第二认证信息D4发送给二号读卡器，卡片按照预定算法对第一计算因子r2和第二计算因子M(r1)进行计算，得到第三计算因子M(r2+M(r1))，使用第三计算因子M(r2+M(r1))替换第二计算因子M(r1)，卡片中的第二计算因子更新为M(r2+M(r1))；二号读卡器接收第二认证信息D4，并将第一计算因子r2和第二认证信息D4发送至后台；后台根据二号读卡器给予授权的前提条件，获取一号读卡器授权时得到的第四计算因子M(r1)，后台根据第一计算因子r2和第四计算因子M(r1)对第二认证信息D4进行认证，认证通过，二号读卡器为卡片进行授权，后台对第一计算因子r2和第四计算因子M(r1)进行计算，生成二号读卡器对卡片进行授权时得到的第五计算因子M(r2+M(r1))。
步骤3，该卡片继续请求获得三号读卡器的授权，过程如下：卡片接收三号读卡器发送的认证指令，认证指令中携带有第一计算因子r3和第一认证信息D5；卡片对第一认证信息D5进行认证，在认证通过的情况下，获取第二计算因子M(r2+M(r1))，卡片至少根据第一计算因子r3和第二计算因子M(r2+M(r1))生成第二认证信息D6，将第二认证信息D6发送给三号读卡器，卡片按照预定算法对第一计算因子r3和第二计算因子M(r2+M(r1))进行计算，得到第三计算因子M(r3+M(r2+M(r1)))，使用第三计算因子M(r3+M(r2+M(r1)))替换第二计算因子M(r2+M(r1))，卡片中的第二计算因子更新为M(r3+M(r2+M(r1)))；三号读卡器接收第二认证信息D6，并将第一计算因子r3和第二认证信息D6发送 至后台；后台根据三号读卡器给予授权的前提条件，获得二号读卡器给予卡片授权时得到的第四计算因子M(r2+M(r1))，后台根据第一计算因子r3和第四计算因子M(r2+M(r1))对第二认证信息D6进行认证，认证通过，三号读卡器为卡片进行授权，后台对第一计算因子r3和第四计算因子M(r2+M(r1))进行计算，生成三号读卡器对卡片进行授权时得到的第五计算因子M(r3+M(r2+M(r1)))。
方式二：第三计算因子包括卡片在成功获得读卡器的授权时从读卡器得到的计算因子，其中，第三计算因子可以为一个也可以为多个。
在该实施方式中，卡片根据卡片存储的第三计算因子得到第二计算因子时，可以根据卡片存储的一个或多个第三计算因子，获取第二计算因子，其中，第三计算因子包括卡片在成功获得第四读卡器的授权时从第四读卡器获得的计算因子。在具体应用中，卡片可以从一个或多个第三计算因子中选择一个或多个计算因子作为第二计算因子。
在该实施方式中，第三计算因子可以为卡片在请求第四读卡器的授权时，第四读卡器携带在认证指令中第一计算因子。
相应地，后台可以采用如下方式获取第一读卡器对应的第四计算因子：后台获取第二计算因子列表，其中，第二计算因子列表至少包括卡片在成功获得各个读卡器授权时每个读卡器发送给卡片的第六计算因子；后台根据第二计算因子列表判断卡片是否已成功获得前提条件中的所有第二读卡器的授权，如果是，则从第二计算因子列表中获取与前提条件中的各个第二读卡器对应的第四计算因子。在本实施方式中，如果第二计算因子列表中包含第六计算因子，则表示卡片已成功获得该第六计算因子对应的读卡器的授权。
作为本发明实施例的一个可选实施方式，在判断对卡片进行授权的情况下，为了便于判断以第一读卡器给予授权为前提的其它读卡器是否可以对卡片进行授权，后台对第二计算因子列表进行更新，将第一计算因子记录到第二计算因子列表中。后台在判断对卡片进行授权的情况下，才将卡片获取第一读卡器授权时的第一计算因子记录到第二计算因子列表中，因此，通过判断第二计算因子列表中是否有第一计算因子，能够判断卡片是否已经成功获得了第一读卡器的授权。如果第二计算因子列表中记录了第一计算因子，则表明卡片已经成功获得第一读卡器的授权；如果第二计算因子列表中没有记录第一计算因子，则表明卡片没有获得第一读卡器的授权。
在本实施例的一个可选实施方式中，卡片根据卡片存储的一个或多个第三计算因子，获取第二计算因子时，可以根据第一读卡器给予卡片授权的前提条件确定。在该实施方式中，认证指令中还可以携带有标识信息，卡片根据该标识信息确定第一读卡器给予授权的前提条件；卡片可以根据存储的第三计算因子判断卡片是否已成功获得前提条件中的所有第二读卡器的授权，如果是，则从存储的一个或多个第三计算因子中获取从前提条件中的各个第二读 卡器获取的第二计算因子，并根据获取的第二计算因子向第一读卡器返回第二认证信息。如果卡片判断卡片未成功获得前提条件中的所有第二读卡器的授权，则卡片可以拒绝响应第一读卡器发送的认证指令，并删除本地存储的所有第三计算因子。通过该实施方式，卡片只有在确定满足第一读卡器给予授权的前提条件的情况下，才对第一读卡器的认证指令进行响应，向第一读卡器发送认证信息，以期获得第一读卡器的授权，因而，对于安全级别较高的读卡器，可以设置对应的授权前提条件，例如，需要一张卡片已经获得其它一个或多个读卡器的授权，非法用户如果想攻破一个读卡器，获得该读卡器的授权，必须先获得其它一个或多个读卡器的授权，才能响应该读卡器的认证指令，进而才有可能获取到该读卡器的授权。
在本实施例中，第一读卡器发送的认证指令中携带的标识信息可以是与第一读卡器对应的唯一标识，例如，该标识信息可以是第一读卡器的序列号，也可以是第一读卡器对应的认证密钥(即用于对第一认证信息进行认证的认证密钥)的标识信息。在本实施例中，卡片通过该标识信息来确定第一读卡器给予授权的前提条件，从而判断卡片是否满足第一读卡器给予授权的前提条件。卡片可以通过判断卡片中是否存储了卡片在成功获得前提条件中的各个第二读卡器的授权时获取的第三计算因子，从而判断卡片是否已成功获得前提条件中的所有第二读卡器的授权。如果卡片中存储了前提条件中的各个第二读卡器对应的第三计算因子，则卡片满足第一读卡器给予授权的前提条件，获取与第二读卡器对应的第二计算因子。
以一个包含三个读卡器的系统为例，假设三个读卡器的编号分别为一号读卡器、二号读卡器和三号读卡器。一号读卡器给予授权的前提条件可以为同一卡片不需要获得任何读卡器的授权，二号读卡器给予授权的前提条件可以为同一卡片已成功获得一号读卡器的授权，三号读卡器给予授权的前提条件可以为同一卡片已成功获得一号读卡器的授权。在本实施例的一个可选实施方式中，在初始状态下，卡片中存储的第三计算因子的值为空(NULL)，后台记录该卡片未获得任一读卡器的授权。
步骤1，卡片请求获得一号读卡器的授权，过程如下：卡片接收一号读卡器发送的认证指令，认证指令中携带有第一计算因子r1和第一认证信息D1；卡片对第一认证信息D1进行认证，在认证通过的情况下，获取卡片中存储的第二计算因子，由于一号读卡器给予授权的前提条件为同一卡片不需要获得任何读卡器的授权，因此卡片获取一个为空的第二计算因子，卡片至少根据第一计算因子r1和第二计算因子生成第二认证信息D2，将第二认证信息D2发送给一号读卡器，卡片将第一计算因子r1作为第三计算因子存储；一号读卡器接收第二认证信息D2，并将第一计算因子r1和第二认证信息D2发送至后台；后台获取第二计算因子列表，由于此时卡片没有获得任何读卡器的授权，因此，第二计算因子列表为空，第六计算因子也为空；由于一号读卡器给予授权的前提条件为同一卡片不需要获得任何读卡器的授权，因此，后台根据第二计算因子列表判断卡片已获得一号读卡器给予授权的前提条件中 的所有第二读卡器的授权，后台获取一个为空的第四计算因子，根据第一计算因子r1和第四计算因子对第二认证信息D2进行认证，认证通过，一号读卡器为卡片进行授权，后台将第一计算因子r1记录到第二计算因子列表中。
步骤2，卡片请求获得二号读卡器的授权，过程如下：卡片接收二号读卡器发送的认证指令，认证指令中携带有第一计算因子r2和第一认证信息D3；卡片对第一认证信息D3进行认证，在认证通过的情况下，获取卡片中存储的第二计算因子，由于二号读卡器给予授权的前提条件为同一卡片已成功获得一号读卡器的授权，因此卡片获取的第二计算因子为卡片获得一号读卡器授权时获得的第三计算因子r1，卡片至少根据第一计算因子r2和第三计算因子r1生成第二认证信息D4，将第二认证信息D4发送给二号读卡器，将第一计算因子r2作为第二个第三计算因子存储；二号读卡器接收第二认证信息D4，并将第一计算因子r2和第二认证信息D4发送至后台；后台获取第二计算因子列表，由于此时卡片已成功获得一号读卡器的授权，因此，第二计算因子列表包含卡片成功获得一号读卡器授权时一号读卡器发送给卡片的第六计算因子r1；由于二号读卡器给予授权的前提条件为同一卡片已成功获得一号读卡器的授权，因此，后台根据第二计算因子列表判断卡片已获得二号读卡器给予授权的前提条件中的一号读卡器的授权，后台获取的第四计算因子r1，根据第一计算因子r2和第四计算因子r1对第二认证信息D4进行认证，认证通过，二号读卡器对卡片进行授权，后台将r2记录到第二计算因子列表中。
步骤3，卡片请求获得三号读卡器的授权，其过程与卡片获得二号读卡器授权的过程类似，在此不再赘述。卡片获得三号读卡器授权后，卡片将三号读卡器发送给卡片的第一计算因子r3作为第三个第三计算因子存储，后台的第二计算因子列表中记录了三号读卡器发送给卡片的第一计算因子r3。
作为本发明实施例的一个可选实施方式，无论卡片具体通过何种方式实现读卡器之间的联动授权，在判断不对卡片进行授权的情况下，本实施例提供的方法还包括：后台清空记录的与卡片相关的所有计算因子。例如：按照方式一，后台在判断不对卡片进行授权的情况下，后台清空与该卡片对应的计算因子列表，即清空各个读卡器在对该卡片进行授权时得到的计算因子；按照方式二，在判断不对卡片进行授权的情况下，后台清空与该卡片对应的第二计算因子列表。在判断不对卡片进行授权的情况下，表明卡片可能正在试图非法获取第一读卡器的授权，因此，后台清空记录的与卡片相关的所有计算因子，可以避免卡片利用后台存储的计算因子进行凑单从而非法获得其他读卡器的授权。另外，也能节省后台的存储空间。
作为本发明实施例的一个可选实施方式，在卡片接收到第一读卡器发送的认证指令之后，该方法还可以包括：卡片获取本次认证的属性信息，对属性信息进行加密后存储；在卡片接收第一读卡器发送的认证指令之前，该方法还可以包括：第一读卡器获取卡片的标识信 息，第一读卡器向卡片发送认证指令；第一读卡器向后台发送至少包括卡片的标识信息的通知；后台根据通知，获取并存储卡片的本次认证的属性信息，例如，第一读卡器可以发送寻卡指令，卡片响应寻卡指令，向第一读卡器发送寻卡响应，第一读卡器接收寻卡响应，从寻卡响应中获取卡片的标识信息。在卡片对属性信息进行加密后存储之后，该方法还可以包括：获取卡片存储的加密的属性信息；对加密的属性信息进行解密；将解密得到的属性信息与后台存储的卡片的属性信息进行对比，如果不匹配，标识卡片为非法卡片。在标识该卡片为非法卡片之后，可以指示卡片删除内部存储的各个计算因子，指示后台删除与该卡片相关的计算因子。从而可以避免后台不能获知卡片被非法读取的情况。
在本实施例中，卡片的本次认证的属性信息可以是第一读卡器对卡片进行认证的属性信息，例如，第一读卡器对卡片进行认证的时间、地点和次数等信息。具体的，地点的记录方式可以为第一读卡器的序列号，根据第一读卡器的序列号可以与第一读卡器的位置进行关联，根据第一读卡器的序列号可以确定第一读卡器的地点；此外，也可以在第一读卡器内部设置具有定位功能的芯片，根据该定位芯片可以获取第一读卡器对卡片进行认证的地点信息。将属性信息加密后存储在卡片内部，可以防止卡片内部的属性信息被其他非法设备获取，保证属性信息的安全。
在本实施例中，后台获取至少包括卡片的标识信息的通知后，将本次认证的属性信息与卡片的标识信息关联并存储。在卡片对属性信息进行加密后存储之后，可以由后台获取或者由能够读取卡片内部的属性信息的验证装置读取卡片存储的加密的属性信息，对加密的属性信息进行解密，将解密得到的属性信息与后台记录的卡片的属性信息进行比对，如果比对不一致，则卡片存在被不法设备非法读取的风险，此时将卡片标识为非法卡片。通过本可选实施方式，可以防止不法设备对卡片进行攻击，发起非法认证指令，获取卡片内部的数据，从而攻破卡片。
实施例2
本实施例提供了一种授权系统，如图2所示，该授权系统包括卡片21、第一读卡器22和后台23。在本实施例中，对授权系统的结构进行了简要说明，其他未尽事宜，可参见实施例1中的说明。
卡片21，用于：接收第一读卡器22发送的认证指令，其中，认证指令中携带有第一计算因子和第一认证信息；对第一认证信息进行认证，在认证通过的情况下，至少根据卡片21存储的第三计算因子得到第二计算因子，其中，第三计算因子包括：卡片21成功获得读卡器的授权时得到的计算因子；至少根据第二计算因子生成第二认证信息，将第二认证信息发送给第一读卡器22；第一读卡器22，用于：接收第二认证信息，并将第二认证信息发送 至后台23；后台23，用于：获取第一读卡器22对应的第四计算因子，其中，第四计算因子为根据第一读卡器22给予授权的前提条件得到的，第一读卡器22给予授权的前提条件包括：是否需要第二读卡器对同一卡片21进行授权，和/或，一组第二读卡器已对同一卡片21进行授权；至少根据获取的第四计算因子对第二认证信息进行认证，并至少根据认证结果判断是否对卡片21进行授权。
通过本实施例提供的授权系统，卡片用于响应第一读卡器发送的认证指令，根据存储的第三计算因子生成第二认证信息发送给第一读卡器，第一读卡器用于接收第二认证信息并发送给后台，后台用于在接收第二认证信息后，根据第一读卡器给予授权的前提条件，获取第一读卡器对应的第四计算因子，利用第四计算因子对卡片发送的第二认证信息认证，如果卡片没有获取到第一读卡器给予授权的前提条件中的读卡器的授权，则卡片中没有存储有与第四计算因子对应的计算因子，后台对第二认证信息的认证不通过，从而无法对卡片进行授权，因此，对于安全级别较高的读卡器，可以设置对应的控制权限，例如，需要一张卡片已经获得其它一个或多个读卡器的授权，非法用户如果想攻破一个读卡器，获得该读卡器的授权，必须先获得其它一个或多个读卡器的授权，才有由可能获取到该读卡器的授权，实现了多个读卡器给予授权的联动效果。
作为本发明实施例的一个可选实施方式，存储的第三计算因子可以是卡片21在获得某个读卡器的授权时获取到的，例如，第三计算因子可以为卡片21在最近一次获得某个读卡器的授权时该读卡器发送给卡片21的计算因子(例如，可以伴随上述第一认证信息一起发送)，或者，最近一次获得某个读卡器的授权时卡片21根据本地存储的计算因子进行计算得到的，或者，也可以是卡片21之前获得每个读卡器的授权时该读卡器发送给卡片21的计算因子，具体可以根据具体应用进行设置。在本实施例中，卡片21通过将之前读卡器给予授权时获取的计算因子作为计算第二认证信息的参数，从而使得后台23可以根据该第二认证信息确定卡片21是否已获得某个读卡器的授权，以实现读卡器之间的联动授权。
在本发明实施例的一个可选实施方式中，卡片21可以通过以下两种方式实现读卡器之间的联动授权：
方式一：第三计算因子为卡片21最近一次成功获得读卡器的授权时得到的计算因子。
对应地，在该实施方式中，卡片21还用于在将第二认证信息发送给第一读卡器22之后，根据第一计算因子和/或第三计算因子，更新存储的第三计算因子。
对应地，在对第二认证信息进行认证时，后台23可以通过以下方式获取第一读卡器22对应的第四计算因子：后台23获取第二读卡器对卡片进行授权时或与第一读卡器22给予授权的前提条件相同的第三读卡器最近一次对卡片21进行授权时得到的第四计算因子。
在本实施例的一个可选实施方式中，为了使以第一读卡器22已成功对卡片21进行授权为给予授权的前提条件的其它读卡器在给予卡片21进行授权时，可以获取第一读卡器22对卡片21进行授权时得到的第五计算因子，后台23还可以用于在对第二认证信息进行认证通过之后，或者，在确定第一读卡器22可以对卡片21进行授权之后，根据上述第一计算因子和/或第四计算因子，得到并存储第五计算因子。在具体应用中，第五计算因子是根据第一计算因子、第四计算因子、或第一计算因子与第四计算因子的组合来得到的，可以采用与第三计算因子对应的方式确定。
方式二：第三计算因子包括卡片21在成功获得读卡器的授权时从读卡器得到的计算因子，其中，第三计算因子可以为一个也可以为多个。
在该实施方式中，卡片21通过以下方式根据卡片21存储的第三计算因子得到第二计算因子：根据卡片21存储的一个或多个第三计算因子，获取第二计算因子，其中，第三计算因子包括卡片21在成功获得第四读卡器的授权时从第四读卡器获得的计算因子。在具体应用中，卡片21可以从一个或多个第三计算因子中选择一个或多个计算因子作为第二计算因子。
在该实施方式中，第三计算因子可以为卡片21在请求第四读卡器的授权时，第四读卡器携带在认证指令中第一计算因子。
相应地，后台23可以通过以下方式获取第一读卡器22对应的第四计算因子：获取第二计算因子列表，其中，第二计算因子列表至少包括卡片21在成功获得各个读卡器授权时每个读卡器发送给卡片21的第六计算因子；根据第二计算因子列表判断卡片21是否已成功获得前提条件中的所有第二读卡器的授权，如果是，则从第二计算因子列表中获取与前提条件中的各个第二读卡器对应的第四计算因子。在本实施方式中，如果第二计算因子列表中包含第六计算因子，则表示卡片21已成功获得该第六计算因子对应的读卡器的授权。
作为本发明实施例的一个可选实施方式，为了便于判断以第一读卡器22给予授权为前提的其它读卡器是否可以对卡片21进行授权，后台23，还用于在判断对卡片21进行授权的情况下，对第二计算因子列表进行更新，将第一计算因子记录到第二计算因子列表中。
在本实施例的一个可选实施方式中，卡片21可以通过以下方式根据卡片21存储的一个或多个第三计算因子，获取第二计算因子：根据第一读卡器22给予卡片21授权的前提条件确定。在该实施方式中，认证指令中还可以携带有标识信息，卡片21根据该标识信息确定第一读卡器22给予授权的前提条件；卡片21可以根据存储的第三计算因子判断卡片21是否已成功获得前提条件中的所有第二读卡器的授权，如果是，则从存储的一个或多个第三计算因子中获取从前提条件中的各个第二读卡器获取的第二计算因子，并根据获取的第二计算因子向第一读卡器22返回第二认证信息。如果卡片21判断卡片21未成功获得前提条件中 的所有第二读卡器的授权，则卡片21可以拒绝响应第一读卡器22发送的认证指令，并删除本地存储的所有第三计算因子。
作为本发明实施例的一个可选实施方式，无论卡片21、后台23具体通过何种方式实现读卡器之间的联动授权，后台23，还可以用于在判断不对卡片21进行授权的情况下，清空记录的与卡片21相关的所有计算因子。
作为本发明实施例的一个可选实施方式，如图3所示，本实施例提供的授权系统还可以包括：验证装置24；卡片21，还用于在接收到第一读卡器22发送的认证指令之后，获取本次认证的属性信息，对属性信息进行加密后存储；第一读卡器22，还用于获取卡片21的标识信息，在向卡片21发送认证指令之后，向后台23发送至少包括卡片21的标识信息的通知；后台23，还用于根据通知，获取并存储卡片21的本次认证的属性信息，例如，第一读卡器22可以用于发送寻卡指令，卡片21还可以用于响应寻卡指令，向第一读卡器22发送寻卡响应，第一读卡器22接收寻卡响应，从寻卡响应中获取卡片21的标识信息。在卡片21对属性信息进行加密后存储之后，验证装置24用于获取卡片21存储的加密的属性信息，对加密的属性信息进行解密，将解密得到的属性信息与后台23存储的卡片21的属性信息进行对比，如果不匹配，标识卡片21为非法卡片21。在标识该卡片21为非法卡片之后，可以指示卡片21删除内部存储的各个计算因子，指示后台23删除与该卡片21相关的计算因子。从而可以避免后台23不能获知卡片21被非法读取的情况。
流程图中或在此以其他方式描述的任何过程或方法描述可以被理解为，表示包括一个或更多个用于实现特定逻辑功能或过程的步骤的可执行指令的代码的组件、片段或部分，并且本发明的优选实施方式的范围包括另外的实现，其中可以不按所示出或讨论的顺序，包括根据所涉及的功能按基本同时的方式或按相反的顺序，来执行功能，这应被本发明的实施例所属技术领域的技术人员所理解。
应当理解，本发明的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式中，多个步骤或方法可以用存储在存储器中且由合适的指令执行系统执行的软件或固件来实现。例如，如果用硬件来实现，和在另一实施方式中一样，可用本领域公知的下列技术中的任一项或他们的组合来实现：具有用于对数据信号实现逻辑功能的逻辑门电路的离散逻辑电路，具有合适的组合逻辑门电路的专用集成电路，可编程门阵列(PGA)，现场可编程门阵列(FPGA)等。
本技术领域的普通技术人员可以理解实现上述实施例方法携带的全部或部分步骤是可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，该 程序在执行时，包括方法实施例的步骤之一或其组合。
此外，在本发明各个实施例中的各功能单元可以集成在一个处理组件中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个组件中。上述集成的组件既可以采用硬件的形式实现，也可以采用软件功能组件的形式实现。所述集成的组件如果以软件功能组件的形式实现并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。
上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本说明书的描述中，参考术语“一个实施例”、“一些实施例”、“示例”、“具体示例”、或“一些示例”等的描述意指结合该实施例或示例描述的具体特征、结构、材料或者特点包含于本发明的至少一个实施例或示例中。在本说明书中，对上述术语的示意性表述不一定指的是相同的实施例或示例。而且，描述的具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。
尽管上面已经示出和描述了本发明的实施例，可以理解的是，上述实施例是示例性的，不能理解为对本发明的限制，本领域的普通技术人员在不脱离本发明的原理和宗旨的情况下在本发明的范围内可以对上述实施例进行变化、修改、替换和变型。本发明的范围由所附权利要求及其等同限定。

Claims (14)

  1. 一种授权方法，其特征在于，包括：
    卡片接收第一读卡器发送的认证指令，其中，所述认证指令中携带有第一计算因子和第一认证信息；
    所述卡片对所述第一认证信息进行认证，在认证通过的情况下，至少根据所述卡片存储的第三计算因子得到第二计算因子，其中，所述第三计算因子包括：所述卡片成功获得读卡器的授权时得到的计算因子；
    所述卡片至少根据所述第二计算因子生成第二认证信息，将所述第二认证信息发送给所述第一读卡器；
    所述第一读卡器接收所述第二认证信息，并将所述第二认证信息发送至后台；
    所述后台获取所述第一读卡器对应的第四计算因子，其中，所述第四计算因子为根据所述第一读卡器给予授权的前提条件得到的，所述第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组所述第二读卡器已对同一卡片进行授权；
    所述后台至少根据获取的所述第四计算因子对所述第二认证信息进行认证，并至少根据认证结果判断是否对所述卡片进行授权。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第三计算因子为所述卡片最近一次成功获得读卡器的授权时得到的计算因子；
    在将所述第二认证信息发送给所述第一读卡器之后，所述方法还包括：卡片根据所述第一计算因子和/或所述第三计算因子，更新存储的所述第三计算因子；
    所述后台获取所述第一读卡器对应的第四计算因子，包括：所述后台获取所述第二读卡器对所述卡片进行授权时得到的所述第四计算因子或与所述第一读卡器给予授权的前提条件相同的第三读卡器最近一次对所述卡片进行授权时得到的所述第四计算因子；
    在至少根据认证结果判断对所述卡片进行授权之后，所述方法还包括：根据所述第四计算因子和/或所述第一计算因子，得到所述第一读卡器对所述卡片进行授权时得到的第五计算因子。
  3. 根据权利要求1所述的方法，其特征在于，
    所述卡片根据卡片存储的第三计算因子得到第二计算因子，包括：根据所述卡片存储的一个或多个所述第三计算因子，获取第二计算因子，其中，所述第三计算因子包括所述卡片在成功获得第四读卡器的授权时从所述第四读卡器获得的计算因子；
    在生成第二认证信息之后，所述方法还包括：所述卡片将所述第一计算因子作为从 所述第一读卡器获得的计算因子存储；
    所述后台获取所述第一读卡器对应的第四计算因子，包括：所述后台获取第二计算因子列表，其中，所述第二计算因子列表至少包括所述卡片在成功获得各个读卡器授权时每个读卡器发送给所述卡片的第六计算因子；所述后台根据所述第二计算因子列表判断所述卡片是否已成功获得所述前提条件中的所有所述第二读卡器的授权，如果是，则从所述第二计算因子列表中获取与所述前提条件中的各个所述第二读卡器对应的所述第四计算因子；
    在至少根据认证结果判断对所述卡片进行授权之后，所述方法还包括：所述后台将所述第一计算因子记录到所述第二计算因子列表中。
  4. 根据权利要求3所述的方法，其特征在于，所述认证指令还携带有标识信息；
    根据所述卡片存储的一个或多个所述第三计算因子，获取第二计算因子，包括：
    所述卡片根据所述标识信息确定所述第一读卡器给予授权的前提条件；
    所述卡片判断所述卡片是否已成功获得所述前提条件中的所有所述第二读卡器的授权，如果是，则从存储的一个或多个所述第三计算因子中获取从所述前提条件中的各个所述第二读卡器中获取的第二计算因子。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，在至少根据认证结果判断不对所述卡片进行授权的情况下，所述方法还包括：所述后台清空与所述卡片相关的所有计算因子。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述后台至少根据认证结果判断是否对所述卡片进行授权，包括：
    在所述第二认证信息认证通过的情况下，所述后台获取所述第一读卡器授权的权限列表，根据所述权限列表判断是否对所述卡片进行授权，将判断结果发送给所述第一读卡器，其中，所述第一读卡器授权的权限列表至少记录了允许第一读卡器授权的卡片的标识信息。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，
    在所述卡片接收到所述第一读卡器发送的认证指令之后，所述方法还包括：所述卡片获取本次认证的属性信息，对所述属性信息进行加密后存储；
    在卡片接收第一读卡器发送的认证指令之前，所述方法还包括：所述第一读卡器获取所述卡片的标识信息；所述第一读卡器向所述卡片发送所述认证指令；所述第一读卡器向后台发送至少包括所述卡片的标识信息的通知；所述后台根据所述通知，获取并存储所述卡片的本次认证的所述属性信息；
    在所述卡片对所述属性信息进行加密后存储之后，所述方法还包括：获取所述卡片 存储的加密的所述属性信息；对所述加密的属性信息进行解密；将解密得到的所述属性信息与所述后台存储的所述卡片的所述属性信息进行对比，如果不匹配，标识所述卡片为非法卡片。
  8. 一种授权系统，其特征在于，包括：卡片，第一读卡器和后台；
    所述卡片，用于：
    接收所述第一读卡器发送的认证指令，其中，所述认证指令中携带有第一计算因子和第一认证信息；
    对所述第一认证信息进行认证，在认证通过的情况下，至少根据所述卡片存储的第三计算因子得到第二计算因子，其中，所述第三计算因子包括：所述卡片成功获得读卡器的授权时得到的计算因子；
    至少根据所述第二计算因子生成第二认证信息，将所述第二认证信息发送给所述第一读卡器；
    所述第一读卡器，用于：
    接收所述第二认证信息，并将所述第二认证信息发送至所述后台；
    所述后台，用于：
    获取所述第一读卡器对应的第四计算因子，其中，所述第四计算因子为根据所述第一读卡器给予授权的前提条件得到的，所述第一读卡器给予授权的前提条件包括：是否需要第二读卡器对同一卡片进行授权，和/或，一组所述第二读卡器已对同一卡片进行授权；
    至少根据获取的所述第四计算因子对所述第二认证信息进行认证，并至少根据认证结果判断是否对所述卡片进行授权。
  9. 根据权利要求8所述的授权系统，其特征在于，
    所述第三计算因子为所述卡片最近一次成功获得读卡器的授权时得到的计算因子；
    所述卡片，还用于在将所述第二认证信息发送给所述第一读卡器之后，根据所述第一计算因子和/或所述第三计算因子，更新存储的所述第三计算因子；
    所述后台通过以下方式获取所述第一读卡器对应的第四计算因子：获取所述第二读卡器对所述卡片进行授权时得到的所述第四计算因子或与所述第一读卡器给予授权的前提条件相同的第三读卡器最近一次对所述卡片进行授权时得到的所述第四计算因子；
    所述后台，还用于在至少根据认证结果判断对所述卡片进行授权之后，根据所述第四计算因子和/或所述第一计算因子，得到所述第一读卡器对所述卡片进行授权时得到的第五计算因子。
  10. 根据权利要求8所述的授权系统，其特征在于，
    所述卡片通过以下方式根据所述卡片存储的第三计算因子得到第二计算因子：根据所述卡片存储的一个或多个所述第三计算因子，获取第二计算因子，其中，所述第三计算因子包括所述卡片在成功获得第四读卡器的授权时从所述第四读卡器获得的计算因子；
    所述卡片，还用于在生成第二认证信息之后，将所述第一计算因子作为从所述第一读卡器获得的计算因子存储；
    所述后台通过以下方式获取所述第一读卡器对应的第四计算因子：获取第二计算因子列表，其中，所述第二计算因子列表至少包括所述卡片在成功获得各个读卡器授权时每个读卡器发送给所述卡片的第六计算因子；根据所述第二计算因子列表判断所述卡片是否已成功获得所述前提条件中的所有所述第二读卡器的授权，如果是，则从所述第二计算因子列表中获取与所述前提条件中的各个所述第二读卡器对应的所述第四计算因子；
    所述后台，还用于在至少根据认证结果判断对所述卡片进行授权之后，将所述第一计算因子记录到所述第二计算因子列表中。
  11. 根据权利要求10所述的授权系统，其特征在于，所述认证指令还携带有标识信息；
    所述卡片通过以下方式根据所述卡片存储的一个或多个所述第三计算因子，获取第二计算因子：根据所述标识信息确定所述第一读卡器给予授权的前提条件，，判断所述卡片是否已成功获得所述前提条件中的所有所述第二读卡器的授权，如果是，则从存储的一个或多个所述第三计算因子中获取从所述前提条件中的各个所述第二读卡器中获取的第二计算因子。
  12. 根据权利要求9至11任一项所述的授权系统，其特征在于，
    所述后台，还用于在至少根据认证结果判断不对所述卡片进行授权的情况下，清空与所述卡片相关的所有计算因子。
  13. 根据权利要求8至12任一项所述的授权系统，其特征在于，
    所述后台通过以下方式判断是否对所述卡片进行授权：在所述第二认证信息认证通过的情况下，获取所述第一读卡器授权的权限列表，根据所述权限列表判断是否对所述卡片进行授权，将判断结果发送给所述第一读卡器，其中，所述第一读卡器授权的权限列表至少记录了允许第一读卡器授权的卡片的标识信息。
  14. 根据权利要求8至13任一项所述的授权系统，其特征在于，所述系统还包括：验证装置；
    所述卡片，还用于在接收到所述第一读卡器发送的认证指令之后，获取本次认证的 属性信息，对所述属性信息进行加密后存储；
    所述第一读卡器，还用于获取所述卡片的标识信息；向所述卡片发送所述认证指令，向后台发送至少包括所述卡片的标识信息的通知；
    所述后台，还用于根据所述通知，获取并存储所述卡片的本次认证的所述属性信息；
    所述验证装置，用于在所述卡片对所述属性信息进行加密后存储之后，获取所述卡片存储的加密的所述属性信息，对所述加密的属性信息进行解密，将解密得到的所述属性信息与所述后台存储的所述卡片的所述属性信息进行对比，如果不匹配，标识所述卡片为非法卡片。
PCT/CN2017/100210 2016-09-09 2017-09-01 一种授权方法及系统 WO2018045918A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610816023.9 2016-09-09
CN201610816023.9A CN107346383B (zh) 2016-09-09 2016-09-09 一种授权方法及系统

Publications (1)

Publication Number Publication Date
WO2018045918A1 true WO2018045918A1 (zh) 2018-03-15

Family

ID=60254162

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/100210 WO2018045918A1 (zh) 2016-09-09 2017-09-01 一种授权方法及系统

Country Status (2)

Country Link
CN (1) CN107346383B (zh)
WO (1) WO2018045918A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112580105B (zh) * 2021-01-14 2021-08-17 杭银消费金融股份有限公司 基于交互类与非交互类的数据权限防护方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4614861A (en) * 1984-11-15 1986-09-30 Intellicard International, Inc. Unitary, self-contained card verification and validation system and method
CN102546172A (zh) * 2011-12-16 2012-07-04 北京握奇数据系统有限公司 智能卡的访问控制方法、智能卡、终端和系统
CN102752118A (zh) * 2012-07-24 2012-10-24 天地融科技股份有限公司 电子签名工具及使用该装置的认证系统、方法
CN103136664A (zh) * 2013-03-06 2013-06-05 天地融科技股份有限公司 具有电子签名功能的智能卡交易系统及方法
CN103366278A (zh) * 2013-06-04 2013-10-23 天地融科技股份有限公司 处理操作请求的方法及系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2768178A1 (en) * 2013-02-14 2014-08-20 Gemalto SA Method of privacy-preserving proof of reliability between three communicating parties
CN103346888B (zh) * 2013-07-02 2016-08-10 山东科技大学 一种基于密码、智能卡和生物特征的远程身份认证方法
CN103929308B (zh) * 2014-04-01 2017-07-18 嘉兴市辰翔信息科技有限公司 应用于rfid卡的信息验证方法
CN104850764B (zh) * 2015-05-22 2018-09-11 东信和平科技股份有限公司 一种基于智能卡的软件保护方法及系统
CN105488367B (zh) * 2015-11-19 2019-05-21 李明 一种sam装置的保护方法、后台及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4614861A (en) * 1984-11-15 1986-09-30 Intellicard International, Inc. Unitary, self-contained card verification and validation system and method
CN102546172A (zh) * 2011-12-16 2012-07-04 北京握奇数据系统有限公司 智能卡的访问控制方法、智能卡、终端和系统
CN102752118A (zh) * 2012-07-24 2012-10-24 天地融科技股份有限公司 电子签名工具及使用该装置的认证系统、方法
CN103136664A (zh) * 2013-03-06 2013-06-05 天地融科技股份有限公司 具有电子签名功能的智能卡交易系统及方法
CN103366278A (zh) * 2013-06-04 2013-10-23 天地融科技股份有限公司 处理操作请求的方法及系统

Also Published As

Publication number Publication date
CN107346383A (zh) 2017-11-14
CN107346383B (zh) 2019-12-10

Similar Documents

Publication Publication Date Title
US11469885B2 (en) Remote grant of access to locked data storage device
CN112513857A (zh) 可信执行环境中的个性化密码安全访问控制
WO2020216131A1 (zh) 数字钥匙的身份认证方法、终端设备及介质
CN105279449A (zh) 基于上下文的数据访问控制
US10979450B2 (en) Method and system for blocking phishing or ransomware attack
JP2017215808A (ja) 情報機器、データ処理システム、データ処理方法およびコンピュータプログラム
WO2018045916A1 (zh) 一种授权方法、系统及卡片
JP2011022785A (ja) 鍵格納装置、生体認証装置、生体認証システム、鍵管理方法、生体認証方法、及びプログラム
US9767264B2 (en) Apparatus, method for controlling apparatus, and program
WO2018045917A1 (zh) 一种授权系统、方法及卡片
KR20190122655A (ko) 생체인식 데이터 템플레이트의 업데이트
WO2018133675A1 (zh) 一种密钥更新方法、装置及系统
US9471808B2 (en) File management system and method
CN111868726A (zh) 电子设备和电子设备的数字钥匙供应方法
KR102553145B1 (ko) 디지털 키를 처리 및 인증하는 보안 요소 및 그 동작 방법
CN113383511A (zh) 用于解锁数据存储设备的恢复密钥
US8407483B2 (en) Apparatus and method for authenticating personal use of contents by using portable storage
CN110298947B (zh) 一种开锁方法及电子锁
CN113545021B (zh) 预先授权设备的注册
WO2018045918A1 (zh) 一种授权方法及系统
JP6344170B2 (ja) 機器、管理モジュール、プログラムおよび制御方法
EP2965295B1 (en) Localized pin management with reader verification and no disclosure
CN113316915B (zh) 解锁数据存储设备
JP4885168B2 (ja) 外部メディア制御方法、システム及び装置
CN105868603A (zh) 基于配置数据的用于访问资源的指纹

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17848091

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17848091

Country of ref document: EP

Kind code of ref document: A1