The application is Application No. 201410160099.1, the applying date to be on April 21st, 2014, entitled " be based on
The divisional application of the patent of the dynamic password formation method of integrated mode ".
The content of the invention
In order to solve the above problems, the invention provides a kind of dynamic password formation method based on integrated mode, pass through
Existing three kinds of generation modes are combined, the dynamic of different integrated mode generation combinations is selected based on present system time
Password, on the one hand, integrated mode changes at any time with system time, increases the difficulty that dynamic password is cracked, on the other hand, combination die
Formula is constant within a certain minute, also avoids dynamic password generation mode from frequently changing the inconvenience brought to user, so as to close
Improve to reason the security of dynamic password.
There is provided a kind of dynamic password formation method based on integrated mode, the dynamic according to an aspect of the present invention
Password generated method includes:
Step 1:The system time of hardware token is obtained, the system time includes date and time information, hour information and minute
Information;
Step 2:First pre-defined algorithm calculating is carried out to the date and time information, the hour information and the minute information,
Generalized time information is obtained, the generalized time information is a numeral;
Step 3:The unit numbers of the generalized time information are taken as the integrated mode generation factor;
Step 4:The integrated mode generation factor is based on according to the first predetermined corresponding relation and obtains dynamic password generation group
Syntype;
Step 5:Dynamic password generation integrated mode based on acquisition generates the password of two sequences, and by described two sequences
The password of row merges into a sequence, to obtain merging password;The display of the hardware token shows the merging password;
Step 6:The merging password is entered into the authentication window of authentication server by user;
Step 7:Authentication server is authenticated according to the merging password of user's typing to user identity;
Step 8:The authentication server is to the authentication window return authentication result;
Wherein, the authentication server is authenticated including according to the merging password of user's typing to user identity:
The authentication server obtains the system time of the authentication server, during the system of the authentication server
Between include date and time information, hour information and minute information;The date and time information, the hour information and the minute information are entered
The pre-defined algorithm of row second is calculated, and obtains the generalized time information of the authentication server, the authentication server
Generalized time information is a numeral;The unit numbers of generalized time information of the authentication server are taken as the identity
The integrated mode generation factor of certificate server;According to the second combination of the predetermined corresponding relation based on the authentication server
The schema creation factor obtains dynamic password generation integrated mode;Dynamic password generation integrated mode based on acquisition generates two sequences
The password of row, and the password of described two sequences is merged into a sequence, to obtain the merging of the authentication server
Password;User's typing that the merging password of the authentication server is received with the authentication server merges
Password is matched, and the match is successful then judges user for validated user, and it fails to match then judges user for disabled user;
Wherein, the dynamic password generation integrated mode includes synchronous mode, static plus event synchronization mould between the static added-time
Formula, static plus challenge response pattern, time synchronized add event synchronization pattern, time synchronized plus challenge response pattern and event synchronization
Plus challenge response pattern;
Wherein, first pre-defined algorithm is identical with the algorithm of second pre-defined algorithm, and the described first predetermined correspondence is closed
System is identical with the described second predetermined corresponding relation.
More specifically, the dynamic password formation method based on integrated mode further comprises, closed in user by described
And after password is entered into the authentication window of authentication server, the authentication window sets scheduled time window, in institute
When stating that the authentication server is not to the authentication window return authentication result in scheduled time window, the authentication window
User is reminded to re-enter the merging password.
More specifically, the dynamic password formation method based on integrated mode further comprises, when the authentication
Server to the authentication window return authentication result be repeatedly disabled user when, authentication window locking forbids user to exist
The same day continues to input the merging password.
More specifically, the dynamic password formation method based on integrated mode further comprises, the described first predetermined calculation
Method be with or, one kind in XOR, addition or subtraction.
More specifically, the dynamic password formation method based on integrated mode further comprises, described first predetermined pair
It should be related to for when the integrated mode generation factor is 0, the dynamic password generation integrated mode is static plus time synchronized
Pattern, when the integrated mode generation factor is 1 or 2, the dynamic password generation integrated mode is static plus event synchronization
Pattern, when the integrated mode generation factor is 3 or 4, the dynamic password generation integrated mode is static plus challenge response
Pattern, when the integrated mode generation factor is 5 or 6, the dynamic password generation integrated mode is that time synchronized adds event
Synchronous mode, when the integrated mode generation factor is 7 or 8, the dynamic password generation integrated mode adds for time synchronized
Challenge response pattern, when the integrated mode generation factor is 9, the dynamic password generation integrated mode adds for event synchronization
Challenge response pattern.
Embodiment
The embodiment to the dynamic password formation method based on integrated mode of the present invention is carried out below with reference to accompanying drawings
Describe in detail.
Password authentication is most simple, is also a kind of the most frequently used remote identity authentication method.Can in order to solve static password
The problems such as being stolen or be stolen in database in the transmission of energy appearance, while the password in order to be effectively prevented from attacker
Guess and retry attack, dynamic password arises at the historic moment.The main thought of dynamic password is added in process of user login
Uncertain factor, such as time, random number so that the information transmitted in each process of user login is all different, so as to resist weight
Examination attack, improves the security in login process.Dynamic-password technique is mainly divided to two kinds, i.e. synchronization Password Technology and asynchronous password
Technology, wherein asynchronous password technology employ challenge response mode, and synchronization Password Technology is divided into time synchronized password and thing
Part synchronization password.Currently, three of the above mainly generates the dynamic password that mode generates and is widely used in ecommerce, electronics postal
In the service of the multiple networks such as part, wireless access, network equipment login, Web bank, taken by the token and distal end of validated user
The cooperation of business device, completes the Electronic dicrimination to user.
Time synchronized password, is the time synchronized based on token and server, and consistent dynamic mouth is generated by computing
Order, the token based on time synchronized, general turnover rate is 60 seconds, produces a new password within every 60 seconds, but due to its synchronous base
Plinth is universal time, then the correct clock of holding that its server can be exactly accurate is required, while to the crystalline substance of its token
Vibration frequency has strict requirements, so that reducing system loses synchronous probability, from another point of view, the token based on time synchronized exists
When being authenticated every time, server end will detect the clock offset of token, accordingly constantly finely tune the time record of oneself,
So as to ensure that the synchronization of token and server, it is ensured that daily use, but because the working environment of token is different, in magnetic field,
High temperature, high pressure, concussion, the uncertain skew and damage that clock pulses easily occurs when immersion, therefore for time synchronized
It is very necessary, the token for losing time synchronized that equipment, which carries out preferably protection, at present can be by increasing offset
Technology (front and rear 10 minutes) carry out remote synchronization, it is ensured that it can continue to use, and reduce the influence to application, but for super
Go out the time synchronized token of acquiescence (totally 20 minutes), will be unable to be continuing with or carry out remote synchronization, it is necessary to send server end back to
Otherwise processed.Equally, for the server based on time synchronized, its system clock should be preferably protected, should not arbitrarily be changed, with
Exempt from occur stationary problem, so as to influence to be all based on the token that this server is authenticated.
Event synchronization password, its principle is to be used as input by a certain specific event order and identical seed,
Consistent password is calculated in algorithm, its computing mechanism determines that its whole workflow is unrelated with clock, not by the shadow of clock
Ring, time pulse crystal oscillator is not present in token, but due to the uniformity of its algorithm, its password is knowable in advance, by token,
You can be known a priori by multiple passwords from now on, therefore when token is lost and does not use PIN code to protect token, exist
The risk illegally logged in, therefore the token of event synchronization is used, the protection to PIN code is very necessary.Equally, it is same based on event
The token of step, which is equally existed, loses synchronous risk, such as user's repeatedly random generation password, for the step-out of token,
The server of event synchronization is resynchronized using the mode of increase offset, and its server end can be calculated certain time backward automatically
Several passwords, comes synchronous token and server, when step loss condition is through very serious, when exceeding normal range (NR) on a large scale, by even
The continuous input password that token computation goes out twice, server will carry out token synchronization, generally, token in the larger context
Synchronous required number of times is not over 3 times.But in extreme circumstances, do not discharge and lose synchronous possibility, such as power drain,
Operational error etc. when changing battery.Now, token still can be by manually entering the one group of sequential value generated by keeper come real
Existing remote synchronization, without returning to server end re-synchronization.
Asynchronous password technology, employs challenge response mode, does not have between token and server in addition to identical algorithm
The problem of needing the condition synchronized, therefore can effectively solve token step-out, reduces the influence to application, while greatly
Add the reliability of system.The shortcoming that asynchronous password is used is mainly when in use, and user needs many input challenging values
Step, for operating personnel, adds complexity, therefore in use, by the sensitivity applied according to user and to safety
It is required that degree selects the generating mode of password.
Above-mentioned three kinds of dynamic password generation modes are effectively guaranteed the degree of accuracy of Electronic dicrimination, but three to a certain extent
The generating mode for planting each pattern in dynamic password generation mode is known content, is familiar with the criminal of cryptographic technique
By the trial of limited number of time, it is still able to obtain shredder meeting.Fixed and fragile to solve existing dynamic password generation mode
The technical problem of solution, the present invention proposes a kind of dynamic password formation method based on integrated mode.
Fig. 1 is the method flow of the dynamic password formation method based on integrated mode according to embodiment of the present invention
Figure, the dynamic password formation method comprises the following steps:
Step 101:The system time of hardware token is obtained, the system time includes date and time information, hour information and divided
Clock information;
Step 102:First pre-defined algorithm meter is carried out to the date and time information, the hour information and the minute information
Calculate, obtain generalized time information, the generalized time information is a numeral;
Step 103:The unit numbers of the generalized time information are taken as the integrated mode generation factor;
Step 104:The integrated mode generation factor is based on according to the first predetermined corresponding relation and obtains dynamic password generation
Integrated mode;
Step 105:Dynamic password generation integrated mode based on acquisition generates the password of two sequences, and will be described two
The password of sequence merges into a sequence, to obtain merging password;The display of the hardware token shows the merging password;
Step 106:The merging password is entered into the authentication window of authentication server by user;
Step 107:Authentication server is authenticated according to the merging password of user's typing to user identity;
Step 108:The authentication server is to the authentication window return authentication result, when authentication result judges to use
When family is validated user, step 109 is jumped to, when authentication result judges user for disabled user, step 110 is jumped to;
Step 109:The authentication window completes certification, enters access customer mandate interface;
Step 110:The authentication window points out authentification failure, and request user inputs the merging password again;
Wherein, step 107 also includes, when the authentication server obtains the system of the authentication server
Between, the system time of the authentication server includes date and time information, hour information and minute information;The date is believed
Breath, the hour information and the minute information carry out the second pre-defined algorithm calculating, obtain the comprehensive of the authentication server
Temporal information is closed, the generalized time information of the authentication server is a numeral;Take the comprehensive of the authentication server
The unit numbers for closing temporal information are used as the integrated mode generation factor of the authentication server;According to the second predetermined correspondence
The integrated mode generation factor of the relation based on the authentication server obtains dynamic password generation integrated mode;Based on acquisition
Dynamic password generation integrated mode generate the passwords of two sequences, and the password of described two sequences is merged into a sequence
Row, to obtain the merging password of the authentication server;By the merging password of the authentication server and the body
The merging password for user's typing that part certificate server is received is matched, and the match is successful then judges user for validated user,
It fails to match then judges user for disabled user;
Wherein, after step 106, scheduled time window also can be set in the authentication window, in the scheduled time window
When the intraoral authentication server is not to the authentication window return authentication result, the authentication window reminds user again
Input the merging password;And when the authentication server to the authentication window return authentication result repeatedly be illegal
During user, the authentication window can be locked automatically, forbid user to continue the input merging password on the day of.
Wherein, the dynamic password generation integrated mode includes synchronous mode, static plus event synchronization mould between the static added-time
Formula, static plus challenge response pattern, time synchronized add event synchronization pattern, time synchronized plus challenge response pattern and event synchronization
Plus challenge response pattern;First pre-defined algorithm is identical with the algorithm of second pre-defined algorithm, the described first predetermined correspondence
Relation is identical with the described second predetermined corresponding relation;The first predetermined corresponding relation may be selected to be, when integrated mode life
When into the factor being 0, dynamic password generation integrated mode is synchronous mode between the static added-time, when integrated mode generation because
When son is 1 or 2, dynamic password generation integrated mode is static plus event synchronization pattern, when integrated mode generation because
When son is 3 or 4, dynamic password generation integrated mode is static plus challenge response pattern, when integrated mode generation because
When son is 5 or 6, the dynamic password generation integrated mode is that time synchronized adds event synchronization pattern, when integrated mode life
When into the factor being 7 or 8, dynamic password generation integrated mode is that time synchronized adds challenge response pattern, when the combination die
When the formula generation factor is 9, the dynamic password generation integrated mode is that event synchronization adds challenge response pattern.
In addition, in order that hardware token end and authentication server end generation two merge passwords it is identical always,
The system time stringent synchronization at hardware token end and authentication server end must be ensured, the general system time difference of the two is come
Source has two kinds:1) time of hardware token device is produced by crystal oscillator module, and crystal oscillator module has deviation, although crystal oscillator module
The amplitude of deviation is different, but the deviation of this part is all positive;2) user inputs dynamic password to dynamic password being serviced device
Receive, there is also time deviation between this.The time deviation of this part is mainly by user's input delay, Network Transmission Delays institute
Cause.The system time at authentication server end can be compensated using time bias mode, with realization, the two is
The synchronization of system time, effectively overcomes above mentioned problem.
Then, with continued reference to Fig. 2, the present invention will be described, and Fig. 2 is based on dynamic according to embodiment of the present invention
The block diagram of the electronic dicrimination system of state password, the electronic dicrimination system include hardware token 201, certification terminal 202,
Authentication server 203 and communication network 204, the hardware token 201 include display, and display is dynamic based on integrated mode
The dynamic password that state password generated method is generated, the dynamic password is a merging password, and the display of certification terminal 202 is recognized
Window is demonstrate,proved, the dynamic password that the hardware token 201 is shown is inputted for user, the certification terminal 202 passes through communication network 204
It is connected with authentication server 203, the dynamic password that user inputs is sent to the end of authentication server 203, the body
Part certificate server 203 itself generates another dynamic password according to identical dynamic password formation method simultaneously, to realize two
Matching result is returned to certification terminal 202 by the matching of individual dynamic password, authentication server 203, to inform certification terminal
Whether active user is validated user, so as to complete Electronic dicrimination.
It is solid for existing dynamic password generation mode using the dynamic password formation method based on integrated mode of the present invention
The fixed technical problem for being easy to crack, using the dynamic password combination producing pattern changed with system time, changes combination life at any time
Become the mode so that the personnel of cracking are difficult to find the Conduce Disciplinarian of dynamic password, ensure the peace of the Electronic dicrimination based on dynamic password
Quan Xing.
Although it is understood that the present invention is disclosed as above with preferred embodiment, but above-described embodiment and being not used to
Limit the present invention.For any those skilled in the art, without departing from the scope of the technical proposal of the invention,
Many possible variations and modification are all made to technical solution of the present invention using the technology contents of the disclosure above, or are revised as
With the equivalent embodiment of change.Therefore, every content without departing from technical solution of the present invention, the technical spirit pair according to the present invention
Any simple modifications, equivalents, and modifications made for any of the above embodiments, still fall within the scope of technical solution of the present invention protection
It is interior.