WO2016107332A1 - 一种基于卡片的动态口令生成方法及设备 - Google Patents

一种基于卡片的动态口令生成方法及设备 Download PDF

Info

Publication number
WO2016107332A1
WO2016107332A1 PCT/CN2015/095270 CN2015095270W WO2016107332A1 WO 2016107332 A1 WO2016107332 A1 WO 2016107332A1 CN 2015095270 W CN2015095270 W CN 2015095270W WO 2016107332 A1 WO2016107332 A1 WO 2016107332A1
Authority
WO
WIPO (PCT)
Prior art keywords
state
data
card
current running
value
Prior art date
Application number
PCT/CN2015/095270
Other languages
English (en)
French (fr)
Inventor
陆舟
于华章
Original Assignee
飞天诚信科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 飞天诚信科技股份有限公司 filed Critical 飞天诚信科技股份有限公司
Priority to US15/529,130 priority Critical patent/US10397200B2/en
Publication of WO2016107332A1 publication Critical patent/WO2016107332A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K7/00—Methods or arrangements for sensing record carriers, e.g. for reading patterns
    • G06K7/0013—Methods or arrangements for sensing record carriers, e.g. for reading patterns by galvanic contacts, e.g. card connectors for ISO-7816 compliant smart cards or memory cards, e.g. SD card readers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0846—Network architectures or network communication protocols for network security for authentication of entities using passwords using time-dependent-passwords, e.g. periodically changing passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3234—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party

Definitions

  • the invention relates to a card-based dynamic password generation method and device, and belongs to the technical field of identity authentication.
  • dynamic passwords are generally generated by the server and sent to the user in the form of text messages or emails or generated by a dynamic token (OTP) held by the user. If the SMS or email is illegally intercepted or the dynamic token is used by an illegal user, or the data is tampered with by the user during the transaction operation, and the user logs in to the phishing website, the entered dynamic password is intercepted, which will cause damage to the user's interests and seriously affect. To the user's rights.
  • OTP dynamic token
  • the object of the present invention is to provide a card-based dynamic password generating method and device for generating a dynamic password by using a card held by a user and a dynamic password generating device to improve the security of the dynamic password.
  • a card-based dynamic password generation method is provided, and when a card is inserted into a device, the following steps are performed:
  • Step S1 The device is powered on, and initializes a current running state to a first state.
  • Step S2 the device determines the operation to be performed, if it is a numeric type button operation, step S3 is performed; if the status type button operation is performed, step S4 is performed, otherwise step S5 is performed;
  • Step S3 the device determines whether it is necessary to input a number, if the user obtains input data according to the user's pressing operation on the numeric type button, and then returns to step S2; otherwise, directly returns to step S2;
  • Step S4 the device determines whether it is necessary to input an acknowledgment state, and if yes, obtains an acknowledgment state according to a user pressing a state type button, and then returns to step S2; otherwise, directly returns to step S2;
  • Step S5 the device determines a current running state
  • the card If the first state is used, the card is powered on, and after the power is successfully applied, a preset instruction is sent to the card, and the first data and the second data are obtained from the first return data returned by the card and saved, and the current running state is updated. Is the sixth state, and then returns to step S2;
  • the user is prompted to input a PIN code, and when the confirmation status is confirmation, the input data is stored as a PIN code, the current running state is updated to the seventh state, and then returns to step S2;
  • step S2 If it is the seventh state, the stored PIN code is obtained, the PIN command is sent to the card, and after the card is successfully verified, the current running state is updated to the eighth state, and then returns to step S2;
  • the password generation instruction is generated according to the saved first data and the data stored in the preset cache, and is sent to the card, and the password data is obtained from the second returned data returned by the card and verified, and updated after the verification succeeds.
  • the current running state is the ninth state, and then returns to step S2;
  • the password data is compressed according to the saved second data, and the compressed data is formatted to obtain a dynamic password, the dynamic password is displayed, the card is powered off, and the current running state is initialized. It is in the first state and then returns to step S2.
  • the method may further include:
  • the current running state is determined as In the first state, the update current operating state is replaced by the sixth state, and the current running state is updated to the second state.
  • the determining that the current running state is the first state further includes setting a currency flag according to the first return data returned by the card; and after determining the current running state, the step S5 further includes:
  • the third state it is determined whether the currency flag is set, if yes, the user is prompted to input the currency number, and when the confirmation state is confirmed, the input data is stored in the preset cache, the current running state is updated to the fourth state, and then returns to step S2; Otherwise, updating the current running state to the fourth state, and then returning to step S2;
  • step S2 If it is the fourth state, the user is prompted to input the amount, and when the confirmation state is the confirmation, the input data is stored in the preset cache, and the current running state is updated to the sixth state, and then returns to step S2;
  • the updating the current running state to the sixth state is replaced by updating the current running state to the third state.
  • the method further includes
  • the user is prompted to input the signature value, and when the confirmation status is confirmed, the input data is stored in the preset cache, and the current update is updated.
  • the running state is the sixth state, and then returns to step S2; correspondingly, when it is determined that the current running state is the first state, the updating the current running state is the sixth state and the updating the current running state is the fifth state.
  • the step S1 may further include: prompting the user to select a mode button, and when the mode button is pressed, acquiring a running state set corresponding to the mode selected by the user, and then performing step S2; determining the current running state according to step S5 is specifically And determining the current running state of the acquired running state set.
  • the acquired set of operating states corresponding to the mode selected by the user may include the first state, the sixth state, the seventh state, the eighth state, and the ninth state, or include the first state, the second state, and the sixth state a seventh state, an eighth state, and a ninth state, or including a first state, a second state, a third state, a fourth state, a sixth state, a seventh state, an eighth state, and a ninth state, or including A state, a fifth state, a sixth state, a seventh state, an eighth state, and a ninth state.
  • step S3 it is determined whether the input number is required to determine whether the digital input flag is 1, or not, indicating that the number needs to be input, otherwise indicating that the input of the number is not required; and the step S3 is performed according to the user pressing the digital type button.
  • the input data is specifically as follows:
  • Step 3-1 Determine whether the digit count flag is less than the preset value. If yes, add 1 to the value of the digit count flag, update the input data according to the value in the digital input buffer, and then perform step 3-2, otherwise the prompt reaches the input.
  • the upper limit, the initialization bit count flag is 0, clear the digital input buffer, and then perform step 3-2;
  • Step 3-2 Set the key value flag to 0.
  • step S4 it is determined whether the input confirmation status needs to be input, and whether the digit count flag is greater than 0, indicating that the confirmation status needs to be input, otherwise indicating that the confirmation status is not required; and the step S4 is based on the user's status button. Press the operation to get the confirmation status:
  • Step 4-1 Determine the value of the key value flag. If it is the fifth preset value, set the confirmation flag to 1, clear the digital input buffer, initialize the digit count flag to 0, and perform step 4-4; Set the value to perform step 4-2;
  • Step 4-3 Clear a value in the digital input buffer, and update the input data, decrement the value of the digit count flag by 1, control the display screen to display the backspace, and perform step 4-4;
  • Step 4-4 Set the key value flag to 0;
  • a card-based dynamic password generating device comprising a button and a display screen, and further comprising the following functional modules:
  • An initialization module configured to initialize a current running state to a first state after the device is powered on
  • a first determining module configured to determine an operation to be performed, for determining whether a number is required to be input, and determining whether a confirmation status needs to be input;
  • a first processing module configured to: when the first determining module determines that the operation to be performed is a digital type key operation and needs to input a number, obtain input data according to a user pressing operation on the digital type key; The first judging module judges that the operation to be performed is a state type key operation and needs to input an acknowledgment state to obtain an acknowledgment state according to a user pressing a state type button;
  • a second determining module configured to determine a current running state when the first determining module determines that the operation to be performed is not the digital input type key operation or the status type key operation;
  • a second processing module configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card Obtaining the first data and the second data in the first return data and saving, updating the current running state to a sixth state;
  • a third processing module configured to prompt the user to input a PIN code when the second determining module determines that the current running state is the sixth state, and when the current confirmation state acquired by the first processing module is a confirmation
  • the current input data obtained by the first processing module is stored as a PIN code, and the current running state is updated to a seventh state;
  • a fourth processing module configured to: when the second determining module determines that the current running state is the seventh state, obtain the stored PIN code, generate a PIN command to send to the card, and update the current after learning that the card is successfully verified
  • the operating state is the eighth state;
  • a fifth processing module configured to: when the second determining module determines that the current running state is the eighth state, generate a password generating command according to the saved first data and the data stored in the preset cache, send the card to the card, and return from the card Obtaining password data in the second return data and verifying, and updating the current running state to the ninth state after the verification succeeds;
  • a sixth processing module configured to: when the second determining module determines that the current running state is the ninth state, compress the password data according to the saved second data, and format the compressed data.
  • the dynamic password is displayed, and the dynamic password is displayed, and the card is powered off, and the current running state is initialized to a first state.
  • the device further includes a seventh processing module, configured to prompt the user to input a challenge code when the second determining module determines that the current running state is the second state, and obtain the input data into the preset when the confirmation state is the confirmation Cache, update the current running state to the sixth state;
  • the second processing module is specifically configured to: when the second determining module determines that the current running state is the first state, on the card After the power is successfully applied, the preset instruction is sent to the card, and the first data and the second data are obtained from the first return data returned by the card and saved, and the current running state is updated to the second state.
  • the device further includes an eighth processing module and a ninth processing module, where the eighth processing module is configured to determine whether the currency flag is set when the second determining module determines that the current operating state is the third state, Prompting the user to input the currency number, and obtaining the input data into the preset cache when the confirmation status is confirmed, updating the current running state to the fourth state; otherwise, updating the current running state to the fourth state;
  • the ninth processing module is configured to prompt the user to input an amount when the second determining module determines that the current running state is the fourth state, and obtain the input data into the preset cache when the confirmation state is confirmed, and update the current The operating state is the sixth state;
  • the second processing module is configured to: when the second determining module determines that the current running state is the first state, powering on the card, and sending a preset instruction to the card after the power is successfully powered, and Obtaining the first data and the second data in the first return data returned by the card and saving, and setting a currency flag according to the first return data returned by the card, and updating the current running state to the second state;
  • the seventh processing module is configured to: when the second determining module determines that the current running state is the second state, prompt the user to input the challenge code, and obtain the input data into the preset cache when the confirmation state is the confirmation, Update the current running state to the third state.
  • the device further includes a tenth processing module, configured to prompt the user to input a signature value when the second determining module determines that the current running state is the fifth state, and obtain the input data into the preset when the confirmation state is the confirmation state. Cache, update the current running state to the sixth state;
  • the second processing module is configured to: when the second determining module determines that the current running state is the first state, powering on the card, and sending a preset instruction to the card after the power is successfully powered, and The first data and the second data are obtained from the first return data returned by the card and saved, and the current running state is updated to the fifth state.
  • the initialization module is further configured to initialize a correspondence between the value of the mode flag and the running state set, and the control display screen prompts the user to press the mode button; when the mode button is pressed, the corresponding operation is obtained according to the mode flag.
  • a state set the initialization module is further configured to initialize a current running state of each running state set to a first state
  • the second determining module is further configured to determine, by the initialization module, the running state set The current running state.
  • the initialization module is configured to initialize a running state set corresponding to the mode flag that is the first preset value to include the first state, the sixth state, the seventh state, the eighth state, and the ninth state, and/or
  • the operating state set corresponding to the mode flag whose initial value is the second preset value includes the first state, the second state, the sixth state, the seventh state, the eighth state, and the ninth state, and/or the initial value is
  • the operating state set corresponding to the mode flag of the third preset value includes a first state, a second state, a third state, a fourth state, a sixth state, a seventh state, an eighth state, and a ninth state
  • the operating state set corresponding to the mode flag that is initialized to the fourth preset value includes a first state, a fifth state, a sixth state, a seventh state, an eighth state, and a ninth state.
  • the initialization module is further configured to initialize the bit count flag to an initial value; the first determining module is further configured to determine whether the digital input flag is set, and if yes, the input number is required, otherwise the Entering a number; the first processing module is further configured to: when the first determining module determines that the operation to be performed is a digital type key operation and needs to input a number, determine whether the digit count flag is less than a preset value, and then The value of the digit count flag is incremented by 1, and the input data is updated according to the value in the digital input buffer; otherwise, the control display prompts that the input upper limit is reached, the initialization digit count flag is the initial value, the digital input buffer is cleared, and the key value flag is set to the default value. .
  • the initialization module is further configured to initialize the digital input flag to a second value, and the initial digit count flag is an initial value; the first determining module is further configured to determine whether the digit count flag is greater than an initial value, If yes, it indicates that the confirmation status needs to be input, otherwise it means that the confirmation status is not required to be input; the first processing module is further configured to be used by the first determination module to determine that the operation to be performed is a status type key operation and needs to input an confirmation status.
  • the fifth preset value is set, the confirmation flag is set to the first value, the digital input buffer is cleared, the initial digit count flag is the initial value, and the key value flag is set as the default value;
  • the six preset values determine whether the digit count flag is an initial value. If yes, set the confirmation flag to the third value and set the key value flag to the default value. Otherwise, perform a clearing of a value in the digital input buffer and update the input data.
  • the value of the digit count flag is decremented by 1, the control display shows the backspace, and the key value flag is set to the default value.
  • the card held by the user participates in generating the dynamic password, and the identity of the holder of the dynamic password generating device is ensured; the information input by the user participates in generating the dynamic password, thereby avoiding the possibility that the data is tampered with during the operation;
  • the dynamic password is generated at the user, avoiding the risk that the dynamic password that appears in the prior art is intercepted in the process of being transmitted by the server to the user.
  • FIG. 1 is a flowchart of a method for generating a dynamic password based on a card according to Embodiment 2 of the present invention
  • FIG. 2 is a flowchart of a button interrupt processing according to Embodiment 2 of the present invention.
  • FIG. 3a-3c are flow diagrams of the dynamic password generation mode flow of FIG. 1;
  • FIG. 4 is a flow chart of the digital input class processing flow of FIG. 1;
  • FIG. 5 is a flow chart of the state input class processing flow of FIG. 1.
  • the method for generating a dynamic password based on the card provided by the first embodiment requires the participation of the user, the card, and the dynamic password generating device.
  • the dynamic password generating device may be various types of terminal devices that interact with the card.
  • the card reader is taken as an example.
  • the card reader has a display screen, digital type keys (such as numeric keys 0-9), status type keys (such as cancel key and OK key), and mode type keys (such as OTP mode).
  • the selection key first inserts the card into the card reader, and the dynamic password generation method includes the following steps:
  • Step S1 the card reader is powered on, and initializes the current running state to the first state
  • the card reader automatically powers up.
  • Step S2 the card reader determines the operation to be performed, if it is a numeric type button operation, step S3 is performed; if the status type button operation is performed, step S4 is performed, otherwise step S5 is performed;
  • the card reader can determine the type of the pressed button in combination with the button interruption process and the interrupt processing flow, and then determine the operation to be performed according to the type of the pressed button, for example, when the numeric button is pressed, the card is executed.
  • the operation is a digital type key operation, and step S3 is performed.
  • the operation to be performed is a status type key operation, and step S4 is performed; otherwise, the operation of step S5 is performed.
  • the button interrupt process is specifically: when a button is pressed, the button is interrupted, the button IO interrupt flag is set, and the button is interrupted.
  • the interrupt processing flow is specifically: when the button IO interrupt flag is set, the interrupt processing is entered, the value of the key value flag is set according to the user's key input, and the value is written into the digital input buffer according to the value of the key value flag. After the button IO interrupt flag is pressed, the interrupt processing is exited.
  • the value of the key value flag belongs to the first preset range, it indicates that the digital type button is pressed, and when the value of the key value flag belongs to the second preset range, it indicates that the status type button is pressed.
  • the first preset range is 0x01-0x0A, corresponding to the numeric keys 0-9
  • the second preset range is 0x0B-0x0C, corresponding to the OK key and the cancel key, respectively.
  • Step S3 the card reader determines whether it is necessary to input a number, if yes, the user obtains input data according to the pressing operation of the numeric type button, and then returns to step S2; otherwise, directly returns to step S2;
  • step S1 further comprises initializing the digital input flag to 0, and initializing the bit count flag to 0, the value of the number of bit count flag being used to indicate the number of digits of the number entered by the user.
  • This step is specifically an operation sub-process to be executed by the card reader, and includes the following steps:
  • Step 1-1 Determine the value of the digital input flag, if it is equal to 1, perform step 1-2, if equal to 0, perform steps 1-3;
  • Step 1-2 Determine whether the digit count flag is less than the preset value. If yes, add 1 to the value of the digit count flag, update the input data according to the value in the digital input buffer, and then perform steps 1-4, otherwise the prompt reaches the input. Upper limit, perform steps 1-3;
  • Step 1-3 The initialization bit count flag is 0, clear the digital input buffer, and then perform steps 1-4;
  • the initial value of the digit count flag 0.
  • Step 1-4 Set the key value flag to 0, and return to step S2.
  • Step S4 the card reader determines whether the confirmation state needs to be input, if yes, the confirmation state is obtained according to the user pressing the state type button, and then returns to step S2; otherwise, directly returns to step S2;
  • step S1 further comprises initializing the confirmation flag to be zero.
  • This step is specifically an operation sub-flow to be executed by the card reader, and the card reader can obtain the confirmation status by confirming the value of the flag.
  • confirm flag 0 to wait for the confirmation status.
  • the specific process of this step may include the following steps:
  • Step 2-1 determining whether the digit count flag is greater than 0, if yes, proceed to step 2-2, otherwise return to step 2-5;
  • Step 2-2 Determine the value of the key value flag. If it is the fifth preset value, set the confirmation flag to 1, clear the digital input buffer, initialize the digit count flag to 0, and perform steps 2-5; Set the value to perform steps 2-3;
  • the fifth preset value is 0x0B
  • the sixth preset value is 0x0C.
  • Step 2-4 Clear a value in the digital input buffer, and update the input data, decrement the value of the digit count flag by 1, and control the display screen to display the backspace;
  • the input data is updated with the data remaining in the digital input buffer after the clear operation.
  • Step 2-5 Set the key value flag to 0, and return to step S2.
  • Step S5 the card reader determines the current running state
  • the card is powered on, and after the power is successfully applied, a preset instruction is sent to the card, and the first data and the second data are obtained from the first return data returned by the card and saved, and the current operation is updated.
  • the state is the sixth state, and then, returning to step S2;
  • step S2 If it is the sixth state, the user is prompted to enter the PIN code, and when the confirmation status is confirmed, the input data is stored as a PIN code, the current running state is updated to the seventh state, and then returns to step S2;
  • step S2 If it is the seventh state, the stored PIN code is obtained, the PIN command is sent to the card, and the current running state is updated to the eighth state after the card is successfully verified, and then returns to step S2;
  • step S2 If it is the eighth state, generating a password generation instruction according to the saved first data and the data stored in the preset cache, sending the password to the card, obtaining the password data from the second return data returned by the card, and verifying, and after the verification succeeds Updating the current running state to the ninth state, and then returning to step S2;
  • the password data is compressed according to the saved second data, and the compressed data is formatted to obtain a dynamic password, the dynamic password is displayed, the card is powered off, and the current running state is initialized. It is in the first state, and then returns to step S2.
  • the card reader provided in the first embodiment can support at least one mode of dynamic password generation.
  • the dynamic password generation mode based on the first preset mode is implemented by using the five states included in step S5. .
  • step S5 is replaced by: determining the current running state
  • the card is powered on, and after the power is successfully applied, a preset instruction is sent to the card, and the first data and the second data are obtained from the first return data returned by the card and saved, and the current operation is updated.
  • the state is the second state, and then, returning to step S2;
  • step S2 If the second state, the user is prompted to enter the challenge code, and when the confirmation state is confirmed, the input data is stored in the preset cache, the current running state is updated to the sixth state, and then, the process returns to step S2;
  • step S2 If it is the sixth state, the user is prompted to input a PIN code, and when the confirmation status is confirmed, the input data is stored as a PIN code, and the current running state is updated to the seventh state, and then returns to step S2;
  • step S2 If it is the seventh state, the stored PIN code is obtained, the PIN command is sent to the card, and after the card is successfully verified, the current running state is updated to the eighth state, and then returns to step S2;
  • step S2 If it is the eighth state, generating a password generation instruction according to the saved first data and the data stored in the preset cache, sending the password to the card, obtaining the password data from the second return data returned by the card, and verifying, and after the verification succeeds Updating the current running state to the ninth state, and then returning to step S2;
  • the password data is compressed according to the saved second data, and the compressed data is formatted to obtain a dynamic password, the dynamic password is displayed, the card is powered off, and the current operation is initialized.
  • the state is the first state, and then returns to step S2.
  • step S5 is replaced by: determining the current running state
  • the card If the card is powered on, the card is powered on, and after the power is successfully applied, a preset instruction is sent to the card, and the first data and the second data are obtained from the first return data returned by the card and saved, according to the The first return data returned by the card sets the currency flag, updates the current running state to the second state, and then returns to step S2;
  • step S2 If it is the second state, the user is prompted to enter the challenge code, and when the confirmation state is the confirmation, the input data is stored in the preset cache, the current running state is updated to the third state, and then, the process returns to step S2;
  • step S2 If it is the third state, it is determined whether the currency flag is set, if yes, the user is prompted to input the currency number, and when the confirmation state is confirmed, the input data is stored in the preset cache, the current running state is updated to the fourth state, and then the process returns to step S2. Otherwise, update the current running state to the fourth state, and then return to step S2;
  • step S2 If it is the fourth state, the user is prompted to input the amount, and when the confirmation state is the confirmation, the input data is stored in the preset cache, and the current running state is updated to the sixth state, and then returns to step S2;
  • step S2 If it is the sixth state, the user is prompted to enter the PIN code, and when the confirmation status is confirmed, the input data is stored as a PIN code, the current running state is updated to the seventh state, and then returns to step S2;
  • step S2 If it is the seventh state, the stored PIN code is obtained, the PIN command is sent to the card, and the current running state is updated to the eighth state after the card is successfully verified, and then returns to step S2;
  • step S2 If it is the eighth state, generating a password generation instruction according to the saved first data and the data stored in the preset cache, sending the password to the card, obtaining the password data from the second return data returned by the card, and verifying, and after the verification succeeds Updating the current running state to the ninth state, and then returning to step S2;
  • the generated password generating instruction is sent to the card according to the saved first data, and the password data obtained from the second returned data returned by the card may be a card internal counter.
  • the generated dynamic password refers to verifying the format of the password data, for example, determining whether the acquired password data format conforms to the TLV format.
  • the password data is compressed according to the saved second data, and the compressed data is formatted to obtain a dynamic password, the dynamic password is displayed, the card is powered off, and the current operation is initialized.
  • the state is the first state, and then returns to step S2.
  • step S5 is replaced by: determining the current running state
  • the card If it is in the first state, the card is powered on, and after the power is successfully sent, a preset instruction is sent to the card, and the first return is returned from the card. Obtaining the first data and the second data in the data and saving, updating the current running state to the fifth state, and then returning to step S2;
  • step S2 If it is the fifth state, the user is prompted to input the signature value, and when the confirmation state is the confirmation, the input data is stored in the preset cache, and the current running state is updated to the sixth state, and then returns to step S2;
  • step S2 If it is the sixth state, the user is prompted to enter the PIN code, and when the confirmation status is confirmed, the input data is stored as a PIN code, the current running state is updated to the seventh state, and then returns to step S2;
  • step S2 If it is the seventh state, the stored PIN code is obtained, the PIN command is sent to the card, and after the card is successfully verified, the current running state is updated to the eighth state, and then returns to step S2;
  • step S2 If it is the eighth state, generating a password generation instruction according to the saved first data and the data stored in the preset cache, sending the password to the card, obtaining the password data from the second return data returned by the card, and verifying, and after the verification succeeds Updating the current running state to the ninth state, and then returning to step S2;
  • the password data is compressed according to the saved second data, and the compressed data is formatted to obtain a dynamic password, the dynamic password is displayed, the card is powered off, and the current operation is initialized.
  • the state is the first state, and then returns to step S2.
  • the mode type button can be set on the card reader for the user to select the dynamic password generation mode to be used.
  • the steps S1 to S5 provided in the first embodiment need to be adjusted as follows:
  • the step S1 further includes prompting the user to press the mode button.
  • step S2 is performed. Further, if the mode button is pressed in this step, step S2 is performed, if other buttons are pressed.
  • the card reader does not respond without a button press. As described above, the card reader can determine the type of the pressed button in combination with the key interrupt process and the interrupt processing flow. Specifically, when the value of the key value flag belongs to the third preset range, the mode type button is pressed.
  • the third preset range is 0xA1-0xA4, and the values of the key value flags 0xA1, 0xA2, 0xA3, and 0xA4 correspond to the first preset mode, the second preset mode, the third preset mode, and the fourth preset mode, respectively. .
  • the step S1 further includes a correspondence between the value of the initialization mode flag and the running state set, where the initial running state is the first state, specifically, the current running state of each running state set is initialized to the first state;
  • the set of operating states corresponding to the mode flag whose initial value is 0xA1 is the first state, the sixth state, the seventh state, the eighth state, and the ninth state, and/or the mode flag corresponding to the value 0xA2 is initialized.
  • the operating state set includes a first state, a second state, a sixth state, a seventh state, an eighth state, and a ninth state
  • an operational state set corresponding to the mode flag having an initial value of 0xA3 is included to include the first state a second state, a third state, a fourth state, a sixth state, a seventh state, an eighth state, and a ninth state, and/or an operational state set corresponding to the mode flag having an initial value of 0xA4, including the first state
  • the method further includes: acquiring a running state set corresponding thereto according to the mode flag; and determining, in the step S5, that the current running state is specifically, determining the current running state of the acquired running state set.
  • a specific implementation process of a card-based dynamic password generation method is provided.
  • the method supports four modes, as shown in FIG. 1, and includes the following contents:
  • Step 1 The device is powered on, initializes each flag, and initializes the running status coding group corresponding to each mode flag and its number;
  • each flag involved in the initialization in this embodiment is 0, and the value of the initialization mode flag is 0xA1, and the running state coding group is ⁇ 0x01, x0x06, x0x07, 0x08, 0x09 ⁇ and its number is 0;
  • the value of the mode flag is 0xA2, and the running state encoding group is ⁇ 0x01, 0x02, x0x06, x0x07, 0x08, 0x09 ⁇ and its number is 0;
  • the value of the initialization mode flag is 0xA3, and the running state encoding group is ⁇ 0x01 , 0x02, 0x03, 0x04, x0x06, x0x07, 0x08, 0x09 ⁇ and its number is 0;
  • the value of the initialization mode flag is 0xA4 corresponding to the running state encoding group is ⁇ 0x01, 0x05, x0x06,
  • Step 2 Control the display prompting the user to select the mode
  • the modes selected by the user include mode1, mode2, mode3, and mode4, and each mode corresponds to a mode button.
  • the mode flag in the second embodiment is 0xA1 corresponding to mode1, and the mode flag is taken.
  • the value of 0xA2 corresponds to mode2
  • the value of the mode flag is 0xA3 corresponding to mode3
  • the value of the mode flag is 0xA4 corresponding to mode4.
  • Step 3 Determine the value range of the key value flag, if it is the first preset range, perform step 5, if it is the second preset range, perform step 6, if otherwise, perform step 4;
  • the first preset range is 0x01 to 0x0A, corresponding to the numeric keys 0-9
  • the second preset range is 0x0B to 0x0C, respectively corresponding to the confirmation key and the cancel key.
  • the flow provided in the second embodiment further includes a button interrupt processing flow as shown in FIG. 2, which is specifically as follows:
  • Step 1-1 Determine whether the button IO interrupt flag is set, if yes, execute step 1-2, otherwise exit;
  • Step 1-2 Initialize the filter number to 0;
  • Step 1-3 determining whether each button IO level has a low level, if yes, perform steps 1-4, otherwise perform steps 1-11;
  • Step 1-4 Add the filter number to 1;
  • Step 1-5 determining whether the filter number is greater than 10, if yes, perform steps 1-6, otherwise return to step 1-3;
  • Step 1-6 Set the key value flag to the corresponding value
  • Step 1-7 Determine whether the key value flag is greater than 0xA0 and less than 0xA5, if yes, perform steps 1-8, otherwise perform steps 1-9;
  • Step 1-8 setting the value of the mode flag according to the value of the key value flag, and then performing steps 1-12;
  • Step 1-9 Determine whether the key value flag is greater than 0x00 and less than 0x0B, then perform steps 1-10, otherwise, perform steps 1-12;
  • Step 1-10 Write a value to the digital input buffer according to the value of the key value flag, and then perform steps 1-12;
  • the value of the key value flag is 0x01, 1 is written to the digital input buffer, and if the value of the key value flag is 0x02, 2 is written to the digital input buffer, and if the value of the key value flag is 0x03, the number is Write 3 in the input buffer. If the value of the key value flag is 0x04, write 4 to the digital input buffer. If the value of the key value flag is 0x05, write 5 to the digital input buffer. If the value of the key value flag is 0x06 writes 6 to the digital input buffer. If the value of the key value flag is 0x07, write 7 to the digital input buffer. If the value of the key value flag is 0x08, write 8 to the digital input buffer. A flag of 0x09 writes 9 to the digital input buffer.
  • Step 1-11 Set the key value flag to 0, and then perform steps 1-12;
  • Step 1-12 Clear the button IO interrupt flag and exit.
  • the clear button IO interrupt flag is equivalent to the reset button IO interrupt flag.
  • Step 4 Enter the dynamic password generation mode process, and return to step 3 after the process ends;
  • Step 5 Enter the digital input class processing flow, and return to step 3 after the process ends;
  • Step 6 Enter the state input class processing flow, and return to step 3 after the process ends.
  • the dynamic password generation mode flow described in the above step 4, as shown in Figures 3a-3c, includes the following steps:
  • Step 101 Determine a mode flag, if it is 0xA1 or 0xA2 or 0xA3 or 0xA4, execute step 102, and if it is other, end;
  • Step 102 Determine a state code corresponding to the current number of the state code group corresponding to the mode flag. If it is equal to 0x01, execute step a1. If it is equal to 0x02, execute step b1. If it is equal to 0x03, execute step c1. If it is equal to 0x04, execute step D1, if equal to 0x06, execute step e1, if equal to 0x07, execute step f1, if equal to 0x08, execute step g1, if equal to 0x05, execute step h1, if equal to 0x09, execute step i1;
  • Step a1 powering on the card
  • Step a2 determining whether the power-on is successful, if yes, performing step a3; otherwise, performing step a9;
  • Step a3 sending a preset instruction to the card
  • the sending the preset instruction to the card may be specifically: sending a first preset command to the card, and composing a second preset command according to the data acquired from the response data of the first preset command, and sending the card to the card.
  • the second preset command, and the third preset command is formed according to the data obtained from the response data of the second preset command, and finally the third preset command is sent to the card.
  • the first preset command is an application selection command
  • the data field of the command includes a value preset by the card issuing line
  • the data acquired from the response data of the first preset command is PDOL (partial file control information).
  • the second preset command is an application initialization command, where the data field of the command includes a PDOL, and the data obtained from the response data of the second preset command is an AFL (Application File Identification Information), and the third preset
  • the command is a read application data command, and the data field of the command includes an AFL, and the first data and the second data can be obtained from the response data of the third preset command.
  • Step a4 parsing the first return data returned by the card to obtain the first data and the second data and saving;
  • the step of parsing the first return data returned by the card and acquiring the first data (CDOL, ie, the in-card application data) according to the first identifier and the second pre-identifier in the first returned data returned by the card, and saving, Obtaining second data (IPB, ie, issuer-specific bitmap) according to the third identifier and saving;
  • CDOL the first data
  • IPB issuer-specific bitmap
  • the first identifier is 0x8c
  • the second identifier is 0x8d
  • the third identifier is 0x9F56.
  • This step is specifically: parsing the first return data returned by the card, according to the first identifier. One byte value of the first data length is obtained, and data with a bit length equal to the first data length after the one byte value is intercepted is used as the first component of the first data, and is obtained according to a byte value after the second identifier.
  • the data length of the second data length after the one byte value is intercepted is used as the second component of the first data, and the first component and the second component are sequentially spliced to obtain the first data and saved. And obtaining a second data length according to a byte value after the third identifier, and intercepting the data with the bit length equal to the second data length after the one byte value as the second data and saving.
  • the first return data returned by the card is 0x 8c 06 9F 33 03 9F 4E 14 8d 08 A0 00 00 03 33 01 01 01 9F 56 03 9F 4E 14 90 00, according to the first identifier 0x8c and the first data length 0x06 And the second identifier 0x8d and the second data length 0x08, the first data obtained by the truncation is: 0x 9F 33 03 9F 4E 14 A0 00 00 03 33 01 01 01, according to the third identifier 0x9F56
  • the second data is: 03 9F 4E 14.
  • Step a5 determining whether there is a currency label in the first returned data returned by the card, if yes, proceed to step a6, otherwise, perform step a7;
  • the identifier indicating the currency label is 0x8e.
  • Step a8 adding 1 to the current number and ending
  • Step a9 controlling the display screen to display a card operation error
  • Step a10 Initialize the current number to 0, and end;
  • Step b1 controlling the display screen to prompt the user to input a challenge code
  • Step b3 determining the confirmation flag, if equal to 1, executing step b4, if equal to 2, executing step b7, if equal to 0, returning;
  • Step b5 storing the input data as a challenge code in a preset cache
  • Step b6 adding 1 to the current number and ending
  • Step b7 The control display screen indicates that the input fails, and the card is powered off;
  • Step b8 Initialize the current number to 0 and end.
  • Step c1 judging the currency flag, if equal to 1, performing step c2, if equal to 0, performing step c7;
  • Step c2 The control display prompts the user to input the currency number
  • Step c4 determining the confirmation flag, if it is equal to 1, executing step c5, if equal to 2, executing step c8, if equal to 0, ending;
  • Step c6 storing the input data as a currency type in a preset cache
  • Step c7 adding 1 to the current number and ending
  • Step c8 The control display screen indicates that the input fails, and the card is powered off;
  • Step c9 Initialize the current number to 0 and end.
  • Step d1 controlling the display screen to prompt the user to input the amount
  • Step d3 determining the confirmation flag, if it is equal to 1, performing step d4, if equal to 2, executing step d7, if equal to 0, ending;
  • Step d5 storing the input data as an amount in a preset cache
  • Step d6 adding 1 to the current number and ending
  • Step d7 The control display screen indicates that the input fails, and the card is powered off;
  • Step d8 Initialize the current number to 0 and end.
  • Step e1 controlling the display screen to prompt the user to input a PIN code
  • Step e3 determining the confirmation flag, if equal to 1, executing step e4, if equal to 2, executing step e7, if equal to 0, ending;
  • Step e5 recording the input data as a PIN code
  • Step e6 adding 1 to the current number and ending
  • Step e7 The control display screen indicates that the input fails, and the card is powered off;
  • Step e8 Initialize the current number to 0 and end.
  • Step f1 generating a PIN command according to the PIN code, and sending a PIN command to the card;
  • the format of the PIN command sent to the card is: 0x 00 20 00 80 nn PIN code, where nn represents the length of the PIN code.
  • Step f2 determining whether the PIN is successful, if yes, proceeding to step f3, otherwise, performing step f4;
  • the PIN it is determined whether the PIN is successful according to the return value of the card. For example, if the card returns 0x9000, it indicates that the PIN is successful, otherwise, it indicates that the PIN failed.
  • Step f3 adding 1 to the current number and ending
  • Step f4 controlling the display screen to display a card operation error
  • Step f5 Initialize the current number to 0 and end.
  • Step g1 Generate a password generation instruction according to the saved first data and the data stored in the preset cache, and send a password generation instruction to the card;
  • the data is generated according to the first data and the data stored in the preset cache.
  • the password generation instruction format is: 0x80AE8000 nn first data, where nn represents the length of the first data (CDOLData).
  • the password generation instruction format generated according to the first data and the data stored in the preset cache is: 0x80AE8000 nn CDOLData+champ code, where nn represents the length of the CDOLData+ challenge code.
  • the password generation instruction format generated according to the first data and the data stored in the preset cache is: 0x80AE8000 nn CDOLData + challenge code + amount and currency type, wherein nn represents CDOLData + challenge code + amount and The length of the currency type.
  • the password generation instruction format generated according to the first data and the data stored in the preset cache is: 0x80AE8000 nn CDOLData+ signature value, where nn represents the length of the CDOLData+ signature value.
  • Step g2 parsing the second return data returned by the card to obtain password data and verifying
  • the step further includes: encrypting the saved signature value by using the password data obtained from the second return data returned from the card as a key, and replacing the operation result with New password data.
  • Step g3 determining whether the verification is successful, if yes, executing step g4; otherwise, performing step g5;
  • the verification it is determined whether the password data conforms to the TLV format, and then the verification succeeds; otherwise, the verification fails.
  • Step g4 Add 1 to the current number to end
  • Step g5 Control the display screen to display a card operation error, and power off the card;
  • Step g6 Initialize the current number to 0 and end.
  • Step h1 controlling the display screen to prompt the user to input the signature value
  • Step h3 determining the confirmation flag, if equal to 1, executing step h4, if equal to 2, executing step h7, if equal to 0, ending;
  • Step h5 storing the input data as a signature value in a preset cache
  • Step h6 adding 1 to the current number and ending
  • Step h7 The control display screen indicates that the input fails, and the card is powered off;
  • Step h8 Initialize the current number to 0, and end;
  • Step i1 power off the card
  • Step i2 compressing the password data according to the saved second data, and formatting the compressed data to obtain a dynamic password, and controlling the display screen to display the dynamic password;
  • the compression processing of the password data according to the saved second data is specifically: selecting, according to the bit address of the second data with a bit value of “1”, from the data domain data of the password data.
  • the bit values corresponding to the bit address are recombined into one binary data, and if the composed binary data is less than the integer number of bytes, the high bit is padded.
  • the second data is: 00010100001111110001010000010111
  • the data field data of the password data is: 01001101010110010110010111010010
  • the compressed data is: 0001011001011010
  • the compressed data is formatted to obtain a dynamic password.
  • the compressed binary number is represented by a decimal number as a dynamic password.
  • the compressed data is: 0001011001011010
  • the hexadecimal representation is 0x165A
  • the decimal number is: 5722
  • the display shows 5722.
  • Step i3 Initialize the current number to 0 and end.
  • the digital input class processing flow described in the above step 5 is as shown in FIG. 4, and includes the following steps:
  • Step 201 Determine the digital input flag, if equal to 1 to perform step 202, if equal to 0, perform step 208;
  • Step 202 Start a timeout timer.
  • the timeout flag is set to 1, otherwise, the timeout flag defaults to 0.
  • Step 203 Determine whether the timeout flag is equal to 1, if yes, go to step 204, otherwise, go to step 205;
  • Step 204 Power off the card, control the display screen to prompt the operation timeout, initialize the current number to 0, and then perform step 208;
  • Step 205 Determine whether the digit count flag is less than the preset value, if yes, go to step 206, otherwise, go to step 207;
  • Step 206 The value of the bit count flag is incremented by 1, the input data is updated according to the value of the digital input buffer, and then, step 209 is performed;
  • Step 207 Control the display screen prompts to reach the input upper limit, step 208;
  • Step 208 The initialization bit count flag is 0, and the digital input buffer is cleared
  • Step 209 Turn off the timeout timer, set the key value flag to 0, and end.
  • the state input class processing flow described in the above step 6 is as shown in FIG. 5, and includes the following steps:
  • Step 301 Determine whether the value of the mode flag is greater than 0, if yes, go to step 302, otherwise, go to step 309;
  • Step 302 Determine whether the digit count flag is greater than 0, if yes, go to step 303, otherwise, go to step 309;
  • Step 303 Determine the value of the key value flag, if equal to 0x0B, execute step 307, if equal to 0x0C, execute step 304;
  • Step 304 Determine whether the digit count flag is 0, if yes, go to step 308, otherwise, go to step 305;
  • Step 305 Clear a value in the digital input buffer, and update the input data, and decrement the value of the digit count flag by one;
  • the last value stored in the digital input buffer is first cleared, and then the input data is updated with the data in the digital input buffer.
  • Step 306 Control the display screen to display the backspace, and then perform step 309.
  • Step 307 Set the confirmation flag to 1, clear the digital input buffer, initialize the bit count flag to 0, and then perform step 309.
  • Step 309 Set the key value flag to 0 and end.
  • the third embodiment provides a card-based dynamic password generating device, which includes a button and a display screen, and the button mainly includes a numeric button (such as a numeric button 0-9) and a status button (such as a cancel button, OK). Key), the device also contains the following functional modules:
  • An initialization module configured to initialize a current running state to a first state after the device is powered on
  • a first determining module configured to determine an operation to be performed, for determining whether a number is required to be input, and determining whether a confirmation status needs to be input;
  • a first processing module configured to: when the first determining module determines that the operation to be performed is a digital type key operation and needs to input a number, obtain input data according to a user pressing operation on the digital type key; The first judging module judges that the operation to be performed is a state type key operation and needs to input an acknowledgment state to obtain an acknowledgment state according to a user pressing a state type button;
  • a second determining module configured to determine a current running state when the first determining module determines that the operation to be performed is not the digital input type key operation or the status type key operation;
  • a second processing module configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card Obtaining the first data and the second data in the first return data and saving, updating the current running state to a sixth state;
  • a third processing module configured to prompt the user to input a PIN code when the second determining module determines that the current running state is the sixth state, and when the current confirmation state acquired by the first processing module is a confirmation
  • the current input data obtained by the first processing module is stored as a PIN code, and the current running state is updated to a seventh state;
  • a fourth processing module configured to: when the second determining module determines that the current running state is the seventh state, obtain the stored PIN code, generate a PIN command to send to the card, and update the current after learning that the card is successfully verified
  • the operating state is the eighth state;
  • a fifth processing module configured to: when the second determining module determines that the current running state is the eighth state, generate a password generating command according to the saved first data and the data stored in the preset cache, send the card to the card, and return from the card Obtaining the password data in the second return data and verifying, and updating the current running state to the ninth state after the verification succeeds;
  • a sixth processing module configured to: when the second determining module determines that the current running state is the ninth state, compress the password data according to the saved second data, and format the compressed data.
  • the dynamic password is displayed, and the dynamic password is displayed, and the card is powered off, and the current running state is initialized to a first state.
  • the judgment of the first type judgment module for the digital type key operation or the state type key operation may be specifically implemented by the interrupt module and the interrupt processing module, as follows:
  • the interrupt module is configured to detect whether a button is pressed, and when detecting that a button is pressed, setting a button IO interrupt flag; and the interrupt processing module is configured to detect whether the button IO interrupt flag is set, When it is detected that the button IO interrupt is set, the value of the key value flag is set according to the user's key input, and the value is written into the digital input buffer according to the value of the key value flag, and the button IO interrupt flag is reset.
  • the first determining module is specifically configured to determine a value of the current key value flag, and if it belongs to the first preset range, determine that the operation to be performed is a digital type key operation, and if it belongs to the second preset range, determine The action to be performed is a state class key operation.
  • the function implementation of the first processing module may be specifically as follows:
  • the first processing module is further configured to: when the first determining module determines that the operation to be performed is a digital type key operation and needs to input a number, determine whether the digit count flag is less than a preset value, and The value is incremented by 1, and the input data is updated according to the value in the digital input buffer; otherwise, the control display prompts that the input upper limit is reached, the initial digit count flag is the initial value, the digital input buffer is cleared, and the key value flag is set to the default value.
  • the function implementation of the first processing module may also be specifically as follows:
  • the first processing module is further configured to determine, when the first determining module determines that the operation to be performed is a state-type key operation and needs to input an acknowledgement state, determine a value of the key value flag, if the fifth preset value is set.
  • the confirmation flag is the first value, the digital input buffer is cleared, the initialization digit count flag is the initial value and the key value flag is set as the default value; if it is the sixth preset value, it is determined whether the digit count flag is the initial value, and the setting is The confirmation flag is the third value and the key value flag is set to the default value. Otherwise, a value in the digital input buffer is cleared, and the input data is updated, the value of the digit count flag is decremented by 1, and the display screen displays the backspace, and Set the key value flag to the default value.
  • the initialization module is further configured to initialize the digital input flag to a second value, and the initialization bit count flag is an initial value; the first determining module is further configured to determine whether the digit count flag is greater than the initial value, and the Enter the confirmation status, otherwise it means that you do not need to enter the confirmation status.
  • the dynamic password generating device provided in the third embodiment can support only one password generating mode.
  • the above describes a device that only supports the first preset mode. If only the second preset mode is supported, the dynamic password is generated.
  • the functional modules of the device mainly include: an initialization module, a first determining module, a first processing module, a second determining module, a second processing module, a third processing module, a fourth processing module, a fifth processing module, a sixth processing module, and
  • the seventh processing module adds a seventh processing module to the dynamic password generating device that only supports the first preset mode, and changes the function of the original second processing module, as follows:
  • the seventh processing module is configured to prompt the user to input a challenge code when the second determining module determines that the current running state is the second state, and obtain the input data to be stored in the preset cache when the confirmation state is confirmed, and update the current running.
  • the state is the sixth state;
  • the second processing module is configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card
  • the first data and the second data are acquired in the first return data and saved, and the current running state is updated to the second state.
  • the function module of the dynamic password generating device mainly includes: an initialization module, a first determining module, a first processing module, a second determining module, a second processing module, and a third processing. a module, a fourth processing module, a fifth processing module, a sixth processing module, a seventh processing module, an eighth processing module, and a ninth processing module; and a new dynamic password generating device that supports only the second preset mode,
  • the eighth processing module and the ninth processing module, and the functions of the original second processing module and the seventh processing module are changed, as follows:
  • the eighth processing module is configured to determine whether the currency flag is set when the second determining module determines that the current running state is the third state, and prompts the user to input the currency number, and obtains the input data when the confirmation state is the confirmation state. Stored in the preset cache, updating the current running state to the fourth state; otherwise, updating the current running state to the fourth state;
  • the ninth processing module is configured to prompt the user to input the amount when the second determining module determines that the current running state is the fourth state, and obtain the input data into the preset cache when the confirmation state is confirmed, and update the current running state. Is the sixth state;
  • the second processing module is configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card Obtaining the first data and the second data in the first return data and saving, and setting a currency flag according to the first return data returned by the card, and updating the current running state to the second state;
  • the seventh processing module is configured to: when the second determining module determines that the current running state is the second state, prompt the user to input the challenge code, and obtain the input data into the preset cache when the confirmation state is the confirmation, and update the current The operating state is the third state.
  • the function module of the dynamic password generating device mainly includes: an initialization module, a first determining module, a first processing module, a second determining module, a second processing module, and a third processing. a module, a fourth processing module, a fifth processing module, a sixth processing module, and a tenth processing module; a tenth processing module is added to the dynamic password generating device that only supports the first preset mode, and the first processing module is added
  • the functions of the two processing modules have been changed as follows:
  • a tenth processing module configured to: when the second determining module determines that the current running state is the fifth state, prompt the user to input the signature value, and obtain the input data into the preset cache when the confirmation state is confirmed, and update the current running.
  • the state is the sixth state;
  • the second processing module is configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card
  • the first data and the second data are acquired in the first return data and saved, and the current running state is updated to the fifth state.
  • the dynamic password generating device of any one of the above modes wherein the function of acquiring the first data and the second data and saving the first return data returned from the card is implemented by the second processing module.
  • the specific implementation is to acquire and save the first data according to the first identifier and the second identifier in the first return data returned by the card, and acquire the second data according to the third identifier and save the data.
  • the second processing module is further configured to determine whether the card is successfully powered on, and if the power is successfully sent, send a preset instruction to the card, parse the first return data returned by the card, and return according to the card.
  • the first identifier and the second identifier in the returned data acquire the first data and save, acquire the second data according to the third identifier and save, update the current running state to the sixth state; if the power fails, control the display screen The card operation error is displayed, and the current running state is initialized to the first state.
  • the third processing module is specifically configured to: when the second determining module determines that the current running state is the sixth state, prompt the user to input a PIN code, set a digital input flag, and determine a confirmation flag, if the confirmation flag Equal to the first value, the digital input flag is reset, the input data is recorded as a PIN code, and the current running state is updated to a seventh state; if the confirmation flag is equal to the third value, the display screen is controlled. The display input fails, the card is powered off, and the current running state is initialized to the first state.
  • the fourth processing module is configured to: when the second determining module determines that the current running state is the seventh state, obtain the stored PIN code, generate a PIN command to send to the card, determine whether the card is successful in checking the PIN, and if successful, Update the current running state to the eighth state; if it fails, the control display screen displays the card operation error, and initializes the current running state to the first state.
  • the fifth processing module is configured to: when the second determining module determines that the current running state is the eighth state, generate a password generating command according to the saved first data and the data stored in the preset cache, and send the card to the card, from the card
  • the returned second data returns the password data and is checked to determine whether the verification is successful. If the verification is successful, the current running state is updated to the ninth state; if the verification fails, the control display screen displays the card operation error, and initializes the current operation.
  • the state is the first state.
  • the sixth processing module is configured to: when the second determining module determines that the current running state is the ninth state, select, according to the stored bit data address of the second data with a bit value of 1, from the data domain data of the password data.
  • the bit values corresponding to the bit address are recombined into a binary number, the binary number is converted into a decimal number, and the converted decimal number is used as a dynamic password, and the control screen displays the dynamic password, and the card is placed under the card. Electric, initialize the current running state to the first state; or
  • a sixth processing module configured to: when the second determining module determines that the current running state is the ninth state, compare the length of the data data of the second data and the password data, if the second If the data is longer than the data field data of the password data, the control display screen prompts that the password generation fails. If the data field data of the password data is longer than the second data, the zero data is added to the right side of the second data.
  • Data corresponding to the data field data bit length of the password data, and then selecting a bit value corresponding to the bit address from the data field data of the password data according to the stored bit address of the second data with a bit value of 1 Combine a binary number, convert the binary number into a decimal number, use the converted decimal number as a dynamic password, control the display screen to display the dynamic password, power off the card, and initialize the current running state to the first state. ;
  • the seventh processing module is configured to: when the second determining module determines that the current running state is the second state, prompt the user to input a challenge code, set a digital input flag, and determine a confirmation flag, if the confirmation flag is equal to the first The value resets the digital input flag, stores the input data as a challenge code in the preset buffer, and updates the current running state to the sixth state; if the confirmation flag is equal to the third value, the control display screen displays the input failure, and the card is powered off. Initialize the current running state to the first state; or
  • the second processing module is specifically configured to: when the second determining module determines that the current running state is the first state, powering on the card, sending a preset instruction to the card after power-on success, and returning from the card Obtaining the first data and the second data in a return data and saving, and determining whether there is a currency label in the first return data, and setting the currency flag and updating the current running state to the second state; otherwise, resetting the currency flag And update the current running state to the second state.
  • the eighth processing module is configured to: when the second determining module determines that the current running state is the third state, determine whether the currency flag is set, and prompt the user to input the currency number, and set the digital input flag. Determining the confirmation flag, if the confirmation flag is equal to the first value, setting the digital input flag, storing the input data as a currency type in a preset cache, updating the current running state to a fourth state; if the confirmation flag is equal to the third value Then the control display shows that the input fails, the card is powered off, and the current running state is initialized to the first state.
  • the ninth processing module is configured to: when the second determining module determines that the current running state is the fourth state, prompt the user to input the amount, set the digital input flag, and determine the confirmation flag, if the confirmation flag is equal to the first value Then reset the digital input flag, store the input data as a deposit in the preset cache, update the current running state to the sixth state, and if the confirmation flag is equal to the third value, control the display screen to display the input failure, power off the card, initialize the current The operating state is the first state.
  • the tenth processing module is specifically configured to: when the second determining module determines that the current running state is the fifth state, prompt the user to input a signature value, set a digital input flag, and determine a confirmation flag, if the confirmation flag is equal to the first The value resets the digital input flag, stores the input data as a signature value in a preset buffer, and updates the current running state to a sixth state; if the confirmation flag is equal to the third value, the control display screen indicates that the input fails, and the card is powered off. Initialize the current running state to the first state.
  • the mode type button can be set on the device for the user to select a dynamic password generating mode to be used, for example, adding the first preset mode button and the second preset mode button. Used by the user to select the dynamic password generation mode. Accordingly, the functional implementation of the functional modules of the device changes as follows:
  • the initialization module is further configured to: after the device is powered on, control the display screen to prompt the user to press the mode button; the second determining module is further configured to: when determining that the value of the key value flag belongs to the third preset range, continue to determine The action performed.
  • the value of the key value flag corresponding to the first preset mode button is 0xA1
  • the value of the key value flag corresponding to the second preset mode button is 0xA2
  • the third preset range is 0xA1-0xA2.
  • the interrupt processing module is further configured to set a value of the mode flag according to the value of the key value flag. For example, if the value of the key value flag is 0xA1, the value of the mode flag is set to 0xA1.
  • the initialization module is further configured to initialize a correspondence between the value of the mode flag and the running state set. When the mode button is pressed, the running state set corresponding to the mode flag is obtained according to the mode flag; The current running state of the state set is a first state; the second determining module is further configured to determine a current running state of the running state set obtained by the initialization module.
  • the initialization module is configured to initialize the operation state set corresponding to the mode flag that is the first preset value to include the first state, the sixth state, the seventh state, the eighth state, and the ninth state, and/or
  • the operating state set corresponding to the mode flag whose initial value is the second preset value includes the first state, the second state, the sixth state, the seventh state, the eighth state, and the ninth state, and/or the initial value is
  • the operating state set corresponding to the mode flag of the third preset value includes a first state, a second state, a third state, a fourth state, a sixth state, a seventh state, an eighth state, and a ninth state
  • the operating state set corresponding to the mode flag that is initialized to the fourth preset value includes a first state, a fifth state, a sixth state, a seventh state, an eighth state, and a ninth state.
  • the password data is generated by the card combined with the card internal data and user input data (such as challenge code, transaction amount, etc.) and returned to the device, thereby avoiding the possibility that the password data is tampered with. , thereby improving the security of dynamic password generation.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Telephone Function (AREA)
  • Storage Device Security (AREA)

Abstract

一种基于卡片的动态口令生成方法，所述方法包括：设备上电，初始化当前运行状态为第一状态，提示用户按下模式类按键，当模式类按键被按下时设备判断要执行的操作，若是数字类按键被按下则根据用户对数字类按键的按下操作获得输入数据；若是状态类按键被按下则根据用户对状态类按键的按下操作获得确认状态；否则根据当前运行状态执行相应操作，包括根据与卡片的交互获取口令数据以及对所述口令数据进行预设处理输出动态口令。本发明可以将用户持有的卡片内部数据以及用户输入的信息参与生成动态口令，避免了口令数据被篡改的可能性，从而提高了动态口令生成的安全性。

Description

一种基于卡片的动态口令生成方法及设备 技术领域
本发明涉及涉及一种基于卡片的动态口令生成方法及设备，属于身份认证技术领域。
背景技术
随着网络的发展，人们越来越多的活动依赖于网络进行，如网上银行、电话银行等，网络信息安全与人们的利益密切相关，身份认证技术也随之发展，比静态口令更为安全的身份认证方法—动态口令认证方法也越来越受到人们的青睐。
目前，动态口令一般由服务器生成并以短信或者邮件的形式下发给用户或者由用户持有的动态令牌(OTP)生成。倘若短信或邮件被非法截获或者动态令牌被非法用户利用，又或者用户进行交易操作时数据被篡改、用户登录了钓鱼网站，输入的动态口令被截获，都会对用户的利益造成损害，严重影响到用户的权益。
发明内容
本发明的目的提供一种基于卡片的动态口令生成方法及设备，其利用用户持有的卡片和动态口令生成设备来生成动态口令，以提高动态口令的安全性。
为此，根据本发明的一个方面，提供了一种基于卡片的动态口令生成方法，当卡片***到设备上时，执行以下步骤：
步骤S1：所述设备上电，初始化当前运行状态为第一状态；
步骤S2：所述设备判断要执行的操作，若是数字类按键操作则执行步骤S3；若是状态类按键操作则执行步骤S4，否则执行步骤S5；
步骤S3：所述设备判断是否需要输入数字，是则根据用户对数字类按键的按下操作获得输入数据，然后返回执行步骤S2；否则直接返回步骤S2；
步骤S4：所述设备判断是否需要输入确认状态，是则根据用户对状态类按键的按下操作获得确认状态，然后返回执行步骤S2；否则直接返回步骤S2；以及
步骤S5：所述设备判断当前运行状态；
若是第一状态则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态，然后返回执行步骤S2；
若是第六状态则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后返回步骤S2；
若是第七状态则获取存储的PIN码，生成验PIN指令发送给卡片，并在卡片验PIN成功后更新当前运行状态为第八状态，然后返回步骤S2；
若是第八状态则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后返回步骤S2；以及
若是第九状态则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后返回步骤S2。
上述步骤S5所述判断当前运行状态之后还可以包括，
若是第二状态则提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后返回执行步骤S2；相应地，判断当前运行状态为第一状态时所述更新当前运行状态为第六状态替换为，更新当前运行状态为第二状态。
上述判断当前运行状态为第一状态时还包括根据所述卡片返回的第一返回数据设置货币标志；步骤S5所述判断当前运行状态之后还包括，
若是第三状态则判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态，然后返回步骤S2；否则更新当前运行状态为第四状态，然后返回步骤S2；
若是第四状态则提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后返回步骤S2；
相应地，判断当前运行状态为第二状态时，所述更新当前运行状态为第六状态替换为更新当前运行状态为第三状态。
上述步骤S5所述判断当前运行状态之后还包括，
若是第五状态则提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前 运行状态为第六状态，然后返回步骤S2；相应地，判断当前运行状态为第一状态时，所述更新当前运行状态为第六状态替换为更新当前运行状态为第五状态。
上述步骤S1还可以包括：提示用户选择模式类按键，当模式类按键被按下时，获取与用户所选模式对应的运行状态集合，然后执行步骤S2；步骤S5所述判断当前运行状态具体为，判断获取的所述运行状态集合下的当前运行状态。
所述获取的与用户所选模式对应的运行状态集合可以是包括第一状态、第六状态、第七状态、第八状态和第九状态，或包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，或包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，或包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
上述步骤S3所述判断是否需要输入数字具体为，判断数字输入标志是否为1，是则表示需要输入数字，否则表示不需要输入数字；步骤S3所述根据用户对数字类按键的按下操作获得输入数据具体为：
步骤3-1：判断位数计数标志是否小于预设值，是则将位数计数标志的值加1，根据数字输入缓存中的数值更新输入数据，然后执行步骤3-2，否则提示达到输入上限，初始化位数计数标志为0，清空数字输入缓存，然后执行步骤3-2；
步骤3-2：设置键值标志为0。
上述步骤S4所述判断是否需要输入确认状态具体为，判断位数计数标志是否大于0，是则表示需要输入确认状态，否则表示不需要输入确认状态；步骤S4所述根据用户对状态类按键的按下操作获得确认状态具体为：
步骤4-1：判断键值标志的值，若为第五预设值则置确认标志＝1，清空数字输入缓存，初始化位数计数标志为0，执行步骤4-4；若为第六预设值则执行步骤4-2；
步骤4-2：判断位数计数标志是否为0，是则置确认标志＝2，执行步骤4-4；否则执行步骤4-3；
步骤4-3：清除数字输入缓存中的一个数值，并更新输入数据，将位数计数标志的值减1，控制显示屏显示退格，执行步骤4-4；
步骤4-4：设置键值标志为0；
所述确认标志＝1表示获得的确认状态为确认，所述确认标志＝2表示获得的确认状态为取消，所述确认标志＝0表示等待获取确认状态。
根据本发明的另外一个方面，还提供了一种基于卡片的动态口令生成设备，包括按键和显示屏，还包括以下功能模块：
初始化模块，用于在设备上电后，初始化当前运行状态为第一状态；
第一判断模块，用于判断要执行的操作，用于判断是否需要输入数字，用于判断是否需要输入确认状态；
第一处理模块，用于在所述第一判断模块判断出要执行的操作是数字类按键操作且需要输入数字时，根据用户对数字类按键的按下操作获得输入数据；用于在所述第一判断模块判断出要执行的操作是状态类按键操作且需要输入确认状态时根据用户对状态类按键的按下操作获得确认状态；
第二判断模块，用于在所述第一判断模块判断出要执行的操作不是所述数字输入类按键操作或所述状态类按键操作时，判断当前运行状态；
第二处理模块，用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态；
第三处理模块，用于在所述第二判断模块判断出当前运行状态是第六状态时，提示用户输入PIN码，并在所述第一处理模块获取的当前的确认状态为确认时将所述第一处理模块获取的当前的输入数据存储为PIN码，更新当前运行状态为第七状态；
第四处理模块，用于在所述第二判断模块判断出当前运行状态是第七状态时，获取存储的PIN码，生成验PIN指令发送给卡片，并在得知卡片验PIN成功后更新当前运行状态为第八状态；
第五处理模块，用于在所述第二判断模块判断出当前运行状态是第八状态时，根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态；以及
第六处理模块，用于在所述第二判断模块判断出当前运行状态是第九状态时，根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态。
所述设备还包括第七处理模块，用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上 电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第二状态。
所述设备还包括第八处理模块和第九处理模块，所述第八处理模块用于在所述第二判断模块判断出当前运行状态是第三状态时，判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态；否则更新当前运行状态为第四状态；
所述第九处理模块，用于在所述第二判断模块判断出当前运行状态是第四状态时，提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，以及根据所述卡片返回的第一返回数据设置货币标志，更新当前运行状态为第二状态；
所述第七处理模块，具体用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第三状态。
所述设备还包括第十处理模块，用于在所述第二判断模块判断出当前运行状态是第五状态时，提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第五状态。
所述初始化模块，还用于初始化模式标志的取值与运行状态集合的对应关系，控制显示屏提示用户按下模式类按键；当模式类按键被按下时，根据模式标志获取与其对应的运行状态集合；所述初始化模块，还具体用于初始化各个运行状态集合的当前运行状态为第一状态；所述第二判断模块，还具体用于判断所述初始化模块获取的所述运行状态集合下的当前运行状态。
所述初始化模块，具体用于初始化取值为第一预设值的模式标志对应的运行状态集合为包括第一状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第二预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第三预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第四预设值的模式标志对应的运行状态集合为包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
进一步地，所述初始化模块，还用于初始化位数计数标志为初值；所述第一判断模块，还具体用于判断数字输入标志是否置位，是则表示需要输入数字，否则表示不需要输入数字；所述第一处理模块，还具体用于在第一判断模块判断出要执行的操作是数字类按键操作且需要输入数字时，判断位数计数标志是否小于预设值，是则将位数计数标志的值加1，根据数字输入缓存中的数值更新输入数据；否则控制显示屏提示达到输入上限，初始化位数计数标志为初值，清空数字输入缓存，设置键值标志为默认值。
进一步地，所述初始化模块，还用于初始化数字输入标志为第二数值，初始化位数计数标志为初值；所述第一判断模块，还具体用于判断位数计数标志是否大于初值，是则表示需要输入确认状态，否则表示不需要输入确认状态；所述第一处理模块，还具体用于用于在第一判断模块判断出要执行的操作是状态类按键操作且需要输入确认状态时，判断键值标志的值，若为第五预设值则设置确认标志为第一数值，清空数字输入缓存，初始化位数计数标志为初值并设置键值标志为默认值；若为第六预设值则判断位数计数标志是否为初值，是则设置确认标志为第三数值并设置键值标志为默认值，否则执行清除数字输入缓存中的一个数值，并更新输入数据，将位数计数标志的值减1，控制显示屏显示退格，以及设置键值标志为默认值。
根据本发明，用户持有的卡片参与生成动态口令，保证了动态口令生成设备持有者的身份合法性；用户输入的信息参与生成动态口令，避免了数据在操作过程中被篡改的可能性；动态口令在用户处生成，避免了现有技术中出现的动态口令在由服务器传送给用户的过程中被截获的风险。
附图说明
图1是本发明实施例2提供的一种基于卡片的动态口令生成方法的流程图；
图2是本发明实施例2提供的一种按键中断处理流程图；
图3a-3c是图1中的动态口令生成模式流程的流程图；
图4是图1中的数字输入类处理流程的流程图；
图5是图1中的状态输入类处理流程的流程图。
具体实施方式
下面将结合附图对本发明作进一步地详细描述。
实施例1
本实施例1提供的一种基于卡片的动态口令生成方法，需要用户、卡片、动态口令生成设备三者的参与来完成，所述动态口令生成设备可以是与卡进行交互的各类终端设备，本实施例中以读卡器为例，该读卡器具有显示屏、数字类按键(如数字键0-9)、状态类按键(如取消键和OK键)和模式类按键(如OTP模式选择键)，首先用户将卡片***到读卡器上，所述动态口令生成方法包括以下步骤：
步骤S1：读卡器上电，初始化当前运行状态为第一状态；
具体地，当有卡片***到读卡器时，读卡器自动上电。
步骤S2：读卡器判断要执行的操作，若是数字类按键操作则执行步骤S3；若是状态类按键操作则执行步骤S4，否则执行步骤S5；
优选地，读卡器可以结合按键中断流程和中断处理流程判断出被按下的按键类型，进而根据被按下的按键类型确定要执行的操作，例如，当数字类按键被按下则要执行的操作为数字类按键操作，执行步骤S3，当状态类按键被按下则要执行的操作为状态类按键操作，执行步骤S4，否则均执行步骤S5的操作。
所述按键中断流程具体为：当有按键被按下时进入按键中断，置位按键IO中断标志，退出按键中断。
所述中断处理流程具体为：当按键IO中断标志被置位时进入中断处理，根据用户的按键输入设置键值标志的值，以及根据键值标志的值向数字输入缓存中写入数值，清按键IO中断标志后退出中断处理。
进一步地，当所述键值标志的值属于第一预设范围时，表示数字类按键被按下，当所述键值标志的值属于第二预设范围时，表示状态类按键被按下，例如，第一预设范围为0x01-0x0A，分别对应数字键0-9，第二预设范围为0x0B-0x0C，分别对应OK键和取消键。
步骤S3：读卡器判断是否需要输入数字，是则根据用户对数字类按键的按下操作获得输入数据，然后返回执行步骤S2；否则直接返回步骤S2；
具体地，在本发明的流程中通过数字输入标志的值来判断是否需要输入数字，例如，若数字输入标志＝1，则表示需要输入数字，若数字输入标志＝0，则表示不需要输入数字。优选地步骤S1还包括初始化数字输入标志为0，初始化位数计数标志为0，该位数计数标志的值用于表示用户按键输入的数字的位数。
本步骤具体为读卡器要执行的一个操作子流程，包括以下步骤：
步骤1-1：判断数字输入标志的值，若等于1则执行步骤1-2，若等于0则执行步骤1-3；
步骤1-2：判断位数计数标志是否小于预设值，是则将位数计数标志的值加1，根据数字输入缓存中的数值更新输入数据，然后执行步骤1-4，否则提示达到输入上限，执行步骤1-3；
步骤1-3：初始化位数计数标志为0，清空数字输入缓存，然后执行步骤1-4；
例如，位数计数标志的初值＝0。
步骤1-4：设置键值标志为0，返回步骤S2。
例如，键值标志的默认值＝0。
步骤S4：读卡器判断是否需要输入确认状态，是则根据用户对状态类按键的按下操作获得确认状态，然后返回执行步骤S2；否则直接返回步骤S2；
具体地，在本发明的流程中通过判断位数计数标志是否大于0来判断是否需要输入确认状态，若大于0则表示需要输入确认状态，否则表示不需要输入确认状态。优选地，步骤S1还包括初始化确认标志为0。
本步骤具体为读卡器要执行的一个操作子流程，读卡器可以通过确认标志的值得到确认状态，例如，确认标志＝1表示的确认状态为确认，确认标志＝2表示的确认状态为取消，确认标志＝0表示等待获取确认状态。
本步骤的具体化流程可以包括以下步骤：
步骤2-1：判断位数计数标志是否大于0，是则执行步骤2-2，否则返回执行步骤2-5；
步骤2-2：判断键值标志的值，若为第五预设值则置确认标志＝1，清空数字输入缓存，初始化位数计数标志为0，执行步骤2-5；若为第六预设值则执行步骤2-3；
例如，第五预设值为0x0B，第六预设值为0x0C。位数计数标志的初值＝0。
步骤2-3：判断位数计数标志是否为0，是则置确认标志＝2，执行步骤2-5；否则执行步骤2-4；
步骤2-4：清除数字输入缓存中的一个数值，并更新输入数据，将位数计数标志的值减1，控制显示屏显示退格；
具体地，用清除操作之后数字输入缓存中剩余的数据更新输入数据。
步骤2-5：设置键值标志为0，返回执行步骤S2。
例如，键值标志的默认值＝0。
步骤S5：读卡器判断当前运行状态；
若是第一状态，则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态，然后，返回执行步骤S2；
若是第六状态，则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后，返回步骤S2；
若是第七状态，则获取存储的PIN码，生成验PIN指令发送给卡片，并在卡片验PIN成功后更新当前运行状态为第八状态，然后，返回步骤S2；
若是第八状态，则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后，返回步骤S2；
若是第九状态则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后，返回步骤S2。
本实施例1提供的读卡器可以至少支持一种模式的动态口令生成方式，例如其中基于第一预设模式的动态口令生成方式为通过上述步骤S5所包含的五个状态的运行来实现的。
进一步地，基于仅支持第二预设模式的动态口令生成方式，上述步骤S5替换为：判断当前运行状态；
若是第一状态，则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第二状态，然后，返回执行步骤S2；
若是第二状态，则提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后，返回执行步骤S2；
若是第六状态则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后，返回步骤S2；
若是第七状态，则获取存储的PIN码，生成验PIN指令发送给卡片，并在卡片验PIN成功后更新当前运行状态为第八状态，然后返回步骤S2；
若是第八状态，则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后，返回步骤S2；
若是第九状态，则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后，返回步骤S2。
进一步地，基于仅支持第三预设模式的动态口令生成方式，上述步骤S5替换为：判断当前运行状态；
若是第一状态，则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，根据所述卡片返回的第一返回数据设置货币标志，更新当前运行状态为第二状态，然后，返回执行步骤S2；
若是第二状态，则提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第三状态，然后，返回执行步骤S2；
若是第三状态，则判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态，然后返回步骤S2；否则更新当前运行状态为第四状态，然后，返回步骤S2；
若是第四状态，则提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后，返回步骤S2；
若是第六状态，则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后，返回步骤S2；
若是第七状态，则获取存储的PIN码，生成验PIN指令发送给卡片，并在卡片验PIN成功后更新当前运行状态为第八状态，然后，返回步骤S2；
若是第八状态，则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后，返回步骤S2；
具体地，本实施例1中，若预设缓存中无数据，则根据保存的第一数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取的口令数据可以是卡片内部计数器产生的动态口令。本步骤所述校验是指对口令数据的格式进行校验，例如判断获取的口令数据格式是否符合TLV格式。
若是第九状态，则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后，返回步骤S2。
进一步地，基于仅支持第四预设模式的动态口令生成方式，上述步骤S5替换为：判断当前运行状态；
若是第一状态，则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回 数据中获取第一数据和第二数据并保存，更新当前运行状态为第五状态，然后，返回执行步骤S2；
若是第五状态，则提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后，返回步骤S2；
若是第六状态，则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后，返回步骤S2；
若是第七状态，则获取存储的PIN码，生成验PIN指令发送给卡片，并在卡片验PIN成功后更新当前运行状态为第八状态，然后，返回步骤S2；
若是第八状态，则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后，返回步骤S2；
若是第九状态，则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后，返回步骤S2。
进一步地，基于多种模式的动态口令生成方式，可以通过在读卡器上设置模式类按键供用户选择要使用的动态口令生成模式，本实施例1提供的步骤S1-步骤S5需做以下调整：
所述步骤S1还包括提示用户按下模式类按键，当模式类按键被按下时执行步骤S2，进一步地，本步骤中若模式类按键被按下则执行步骤S2，若其他按键被按下或无按键按下则读卡器无响应。同上所述，读卡器可以结合按键中断流程和中断处理流程判断出被按下的按键类型，具体地，当键值标志的值属于第三预设范围时，表示模式类按键被按下，例如，第三预设范围为0xA1-0xA4，键值标志的取值0xA1、0xA2、0xA3、0xA4分别对应第一预设模式、第二预设模式、第三预设模式和第四预设模式。
步骤S1还包括初始化模式标志的取值与运行状态集合的对应关系，所述初始化当前运行状态为第一状态具体为初始化各个运行状态集合的当前运行状态为第一状态；
例如，初始化取值为0xA1的模式标志对应的运行状态集合为包括第一状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为0xA2的模式标志对应的运行状态集合为包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为0xA3的模式标志对应的运行状态集合为包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为0xA4的模式标志对应的运行状态集合为包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
所述当模式类按键被按下时还包括：根据模式标志获取与其对应的运行状态集合；步骤S5所述判断当前运行状态具体为，判断获取的所述运行状态集合下的当前运行状态。
实施例2
本实施例2在实施例1的基础上，提供了一种基于卡片的动态口令生成方法的具体实现流程，该方法支持四种模式，如图1所示，包括以下内容：
步骤1：设备上电，初始化各个标志，初始化各取值的模式标志对应的运行状态编码组及其编号；
具体地，初始化本实施例中涉及的各个标志的值为0，初始化模式标志的取值为0xA1对应的运行状态编码组为{0x01，x0x06，x0x07，0x08，0x09}及其编号为0；初始化模式标志的取值为0xA2对应的运行状态编码组为{0x01，0x02，x0x06，x0x07，0x08，0x09}及其编号为0；初始化模式标志的取值为0xA3对应的运行状态编码组为{0x01，0x02，0x03，0x04，x0x06，x0x07，0x08，0x09}及其编号为0；初始化模式标志的取值为0xA4对应的运行状态编码组为{0x01，0x05，x0x06，x0x07，0x08，0x09}及其编号为0。具体地，所述编号与各个运行状态编码组中的状态编码对应，例如，对于运行状态编码组{0x01，0x02，x0x06，x0x07，0x08，0x09}，编号＝0时对应0x01，编号＝1时对应0x02，编号＝2时对应0x06，以此类推。
步骤2：控制显示屏提示用户选择模式；
本实施例2中，供用户选择的模式包括mode1、mode2、mode3和mode4，每个模式对应有一个模式按键，其中，本实施例2中模式标志的取值为0xA1对应mode1，模式标志的取值为0xA2对应mode2，模式标志的取值为0xA3对应mode3，模式标志的取值为0xA4对应mode4。
步骤3：判断键值标志的取值范围，若是第一预设范围则执行步骤5，若是第二预设范围则执行步骤6，若是其他则执行步骤4；
具体地，第一预设范围为0x01至0x0A，分别对应数字键0-9，第二预设范围为0x0B至0x0C，分别对应确认键和取消键。
进一步地，本实施例2提供的流程中还包括如图2所示的按键中断处理流程，具体如下：
步骤1-1：判断按键IO中断标志是否置位，是则执行步骤1-2，否则退出；
步骤1-2：初始化滤波计数字为0；
步骤1-3：判断各按键IO电平是否有低电平，是则执行步骤1-4，否则执行步骤1-11；
步骤1-4：将滤波计数字加1；
步骤1-5：判断滤波计数字是否大于10，是则执行步骤1-6，否则返回执行步骤1-3；
步骤1-6：设置键值标志为相应数值；
例如，若检测到数字键0被按下，则设置键值标志＝0x01，若检测到确认键被按下，则设置键值标志＝0x0B。
步骤1-7：判断键值标志是否大于0xA0且小于0xA5，是则执行步骤1-8，否则执行步骤1-9；
步骤1-8：根据键值标志的值设置模式标志的值，然后，执行步骤1-12；
具体地，若键值标志的值为0xA1则设置模式标志＝0xA1，若键值标志的值为0xA2则设置模式标志＝0xA2，若键值标志的值为0xA3则设置模式标志＝0xA3，若键值标志的值为0xA4则设置模式标志＝0xA4。
步骤1-9：判断键值标志是否大于0x00且小于0x0B，是则执行步骤1-10，否则，执行步骤1-12；
步骤1-10：根据键值标志的值向数字输入缓存中写入数值，然后执行步骤1-12；
具体地，若键值标志的值为0x01则向数字输入缓存中写入1，若键值标志的值为0x02则向数字输入缓存中写入2，若键值标志的值为0x03则向数字输入缓存中写入3，若键值标志的值为0x04则向数字输入缓存中写入4，若键值标志的值为0x05则向数字输入缓存中写入5，若键值标志的值为0x06则向数字输入缓存中写入6，若键值标志的值为0x07则向数字输入缓存中写入7，若键值标志的值为0x08则向数字输入缓存中写入8，若键值标志的值为0x09则向数字输入缓存中写入9。
步骤1-11：设置键值标志为0，然后，执行步骤1-12；
步骤1-12：清按键IO中断标志，退出。
具体地，所述清按键IO中断标志等同于复位按键IO中断标志。
步骤4：进入动态口令生成模式流程，流程结束后返回步骤3；
步骤5：进入数字输入类处理流程，流程结束后返回步骤3；
步骤6：进入状态输入类处理流程，流程结束后返回步骤3。
上述步骤4中所述的动态口令生成模式流程，如图3a-3c所示，包括以下步骤：
步骤101：判断模式标志，若为0xA1或0xA2或0xA3或0xA4则执行步骤102，若为其他则结束；
步骤102：判断与模式标志对应的状态编码组的当前编号对应的状态编码，若等于0x01则执行步骤a1，若等于0x02则执行步骤b1，若等于0x03则执行步骤c1，若等于0x04则执行步骤d1，若等于0x06则执行步骤e1，若等于0x07则执行步骤f1，若等于0x08则执行步骤g1，若等于0x05则执行步骤h1，若等于0x09则执行步骤i1；
步骤a1：对卡片上电；
步骤a2：判断上电是否成功，是则执行步骤a3，否则，执行步骤a9；
步骤a3：向卡片发送预设指令；
优选地，所述向卡片发送预设指令可以具体为：向卡片发送第一预设命令，并根据从第一预设命令的响应数据中获取的数据组成第二预设命令，向卡片发送第二预设命令，并根据从第二预设命令的响应数据中获取的数据组成第三预设命令，最后向卡片发送第三预设命令。
例如，第一预设命令为应用选择命令，该命令的数据域中包含有发卡行预先设定的一个数值，从第一预设命令的响应数据中获取的数据为PDOL(部分文件控制信息)。所述第二预设命令为应用初始化命令，该命令的数据域中包含有PDOL，从第二预设命令的响应数据中获取的数据为AFL(应用文件标识信息)，所述第三预设命令为读应用数据命令，该命令的数据域中包含有AFL，从第三预设命令的响应数据中可以获取第一数据和第二数据。
步骤a4：解析卡片返回的第一返回数据获取第一数据和第二数据并保存；
具体地，本步骤解析卡片返回的第一返回数据，根据卡片返回的第一返回数据中的第一标识符和第二预识符获取第一数据(CDOL，即卡内应用数据)并保存，根据第三标识符获取第二数据(IPB，即发卡行专有位图)并保存；
优选地，本实施例2中，第一标识符为0x8c，第二标识符为0x8d，第三标识符为0x9F56；本步骤具体为：解析卡片返回的第一返回数据，根据第一标识符后的一个字节数值得到第一数据长度，截取该一个字节数值之后的位长等于第一数据长度的数据作为第一数据的第一组成部分，根据第二标识符后的一个字节数值得到第二数据长度，截取该一个字节数值之后的位长等于第二数据长度的数据作为第一数据的第二组成部分，将第一组成部分和第二组成部分顺序拼接得到第一数据并保存；根据第三标识符后的一个字节数值得到第二数据长度，截取该一个字节数值之后的位长等于第二数据长度的数据作为第二数据并保存。
例如：卡片返回的第一返回数据为0x 8c 06 9F 33 03 9F 4E 14 8d 08 A0 00 00 03 33 01 01 01 9F 56 03 9F 4E 14 90 00，根据第一标识符0x8c和第一数据长度0x06以及第二标识符0x8d和第二数据长度0x08，截取得到的第一数据为：0x 9F 33 03 9F 4E 14 A0 00 00 03 33 01 01 01，根据第三标识符0x9F56截取得到的 第二数据为：03 9F 4E 14。
步骤a5：判断卡片返回的第一返回数据中是否有货币标签，是则执行步骤a6，否则，执行步骤a7；
例如，表示货币标签的标识为0x8e，本步骤具体为判断卡片返回的第一返回数据中是否包含有0x8e，是则执行步骤a6，否则，执行步骤a7。
步骤a6：置货币标志＝1，然后，执行步骤a8；
步骤a7：置货币标志＝0，然后，执行步骤a8；
步骤a8：将当前编号加1，结束；
步骤a9：控制显示屏显示卡片操作错误；
步骤a10：将当前编号初始化为0，结束；
步骤b1：控制显示屏提示用户输入挑战码；
步骤b2：置数字输入标志＝1；
步骤b3：判断确认标志，若等于1则执行步骤b4，若等于2则执行步骤b7，若等于0则返回；
步骤b4：置数字输入标志＝0；
步骤b5：将输入数据作为挑战码存入预设缓存；
步骤b6：将当前编号加1，结束；
步骤b7：控制显示屏显示输入失败，对卡片下电；
步骤b8：将当前编号初始化为0，结束。
步骤c1：判断货币标志，若等于1则执行步骤c2，若等于0则执行步骤c7；
步骤c2：控制显示屏提示用户输入货币编号；
步骤c3：置数字输入标志＝1；
步骤c4：判断确认标志，若等于1则执行步骤c5，若等于2则执行步骤c8，若等于0则结束；
步骤c5：置数字输入标志＝0；
步骤c6：将输入数据作为货币类型存入预设缓存；
步骤c7：将当前编号加1，结束；
步骤c8：控制显示屏显示输入失败，对卡片下电；
步骤c9：将当前编号初始化为0，结束。
步骤d1：控制显示屏提示用户输入金额；
步骤d2：置数字输入标志＝1；
步骤d3：判断确认标志，若等于1则执行步骤d4，若等于2则执行步骤d7，若等于0则结束；
步骤d4：置数字输入标志＝0；
步骤d5：将输入数据作为金额存入预设缓存；
步骤d6：将当前编号加1，结束；
步骤d7：控制显示屏显示输入失败，对卡片下电；
步骤d8：将当前编号初始化为0，结束。
步骤e1：控制显示屏提示用户输入PIN码；
步骤e2：置数字输入标志＝1；
步骤e3：判断确认标志，若等于1则执行步骤e4，若等于2则执行步骤e7，若等于0则结束；
步骤e4：置数字输入标志＝0；
步骤e5：将输入数据记录为PIN码；
步骤e6：将当前编号加1，结束；
步骤e7：控制显示屏显示输入失败，对卡片下电；
步骤e8：将当前编号初始化为0，结束。
步骤f1：根据PIN码生成验PIN指令，并向卡片发送验PIN指令；
具体地，向卡片发送的验PIN指令的格式为：0x 00 20 00 80 nn PIN码，其中nn表示PIN码的长度。
步骤f2：判断验PIN是否成功，是则执行步骤f3，否则，执行步骤f4；
具体地，根据卡片的返回值判断验PIN是否成功，例如，若卡片返回0x9000则表示验PIN成功，否则，表示验PIN失败。
步骤f3：将当前编号加1，结束；
步骤f4：控制显示屏显示卡片操作错误；
步骤f5：将当前编号初始化为0，结束。
步骤g1：根据保存的第一数据和预设缓存中存储的数据生成口令生成指令，并向卡片发送口令生成指令；
具体地，本实施例2中，若当前的模式标志为0xA1，则根据第一数据和预设缓存中存储的数据生成 的口令生成指令格式为：0x80AE8000 nn第一数据，其中，nn表示第一数据(CDOLData)的长度。
若当前的模式标志为0xA2，则根据第一数据和预设缓存中存储的数据生成的口令生成指令格式为：0x80AE8000 nn CDOLData+挑战码，其中，nn表示CDOLData+挑战码的长度。
若当前的模式标志为0xA3，则根据第一数据和预设缓存中存储的数据生成的口令生成指令格式为：0x80AE8000 nn CDOLData+挑战码+金额与货币类型，其中，nn表示CDOLData+挑战码+金额与货币类型的长度。
若当前的模式标志为0xA4，则根据第一数据和预设缓存中存储的数据生成的口令生成指令格式为：0x80AE8000 nn CDOLData+签名值，其中，nn表示CDOLData+签名值的长度。
步骤g2：解析卡片返回的第二返回数据获取口令数据并校验；
进一步地，若当前的模式标志为0xA4，则本步骤之后还包括：用从卡片返回的第二返回数据中获取的口令数据作为密钥对保存的签名值进行加密运算，并将运算结果替换为新的口令数据。
步骤g3：判断校验是否成功，是则执行步骤g4，否则，执行步骤g5；
具体地，判断所述口令数据是否符合TLV格式，是则校验成功，否则，校验失败。
步骤g4：将当前编号加1，结束；
步骤g5：控制显示屏显示卡片操作错误，对卡片下电；
步骤g6：将当前编号初始化为0，结束。
步骤h1：控制显示屏提示用户输入签名值；
步骤h2：置数字输入标志＝1；
步骤h3：判断确认标志，若等于1则执行步骤h4，若等于2则执行步骤h7，若等于0则结束；
步骤h4：置数字输入标志＝0；
步骤h5：将输入数据作为签名值存入预设缓存；
步骤h6：将当前编号加1，结束；
步骤h7：控制显示屏显示输入失败，对卡片下电；
步骤h8：将当前编号初始化为0，结束；
步骤i1：对卡片下电；
步骤i2：根据保存的第二数据对口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，控制显示屏显示所述动态口令；
具体地，本实施例2中，根据保存的第二数据对口令数据进行压缩处理具体为：根据第二数据中位值为“1”的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数据，若组成的二进制数据不足整数字节数则在高位补零。
例如：第二数据为：00010100001111110001010000010111
口令数据的数据域数据为：01001101010110010110010111010010
压缩处理后的数据为：0001011001011010
进一步地，当第二数据与口令数据的数据域数据位长不一致时，包括以下处理：
1)若第二数据比口令数据的数据域数据长，则控制LED屏提示口令生成失败。
2)若口令数据的数据域数据比第二数据长，则在第二数据右侧补0，凑成和口令数据的数据域数据位长等同的数据。
本实施例2中，具体地，将压缩处理后的数据格式化得到动态口令具体为：将压缩后的二进制数用十进制数表示作为动态口令。
例如，压缩处理后的数据为：0001011001011010，则十六进制表示为0x165A，代表十进制数为：5722，则显示屏显示5722。
步骤i3：将当前编号初始化为0，结束。
上述步骤5中所述的数字输入类处理流程如图4所示，包括以下步骤：
步骤201：判断数字输入标志，若等于1则执行步骤202，若等于0则执行步骤208；
步骤202：启动超时定时器；
具体地，当超时定时器达到预设的按键操作超时时间时，会将超时标志置为1，否则，超时标志默认为0。
步骤203：判断超时标志是否等于1，是则执行步骤204，否则，执行步骤205；
步骤204：对卡片下电，控制显示屏提示操作超时，将当前编号初始化为0，然后，执行步骤208；
步骤205：判断位数计数标志是否小于预设值，是则执行步骤206，否则，执行步骤207；
步骤206：将位数计数标志的值加1，根据数字输入缓存的数值更新输入数据，然后，执行步骤209；
步骤207：控制显示屏提示达到输入上限，执行步骤208；
步骤208：初始化位数计数标志为0，清空数字输入缓存；
步骤209：关闭超时定时器，设置键值标志为0，结束。
上述步骤6中所述的状态输入类处理流程如图5所示，包括以下步骤：
步骤301：判断模式标志的值是否大于0，是则执行步骤302，否则，执行步骤309；
步骤302：判断位数计数标志是否大于0，是则执行步骤303，否则，执行步骤309；
步骤303：判断键值标志的值，若等于0x0B则执行步骤307，若等于0x0C则执行步骤304；
步骤304：判断位数计数标志是否为0，是则执行步骤308，否则，执行步骤305；
步骤305：清除数字输入缓存中的一个数值，并更新输入数据，将位数计数标志的值减1；
具体地，先清除数字输入缓存中最后存入的一个数值，然后，用数字输入缓存中的数据更新输入数据。
步骤306：控制显示屏显示退格，然后，执行步骤309。
步骤307：置确认标志＝1，清空数字输入缓存，初始化位数计数标志为0，然后，执行步骤309。
步骤308：置确认标志＝2，然后，执行步骤309。
步骤309：设置键值标志为0，结束。
实施例3
本实施例3提供了一种基于卡片的动态口令生成设备，该设备包含有按键和显示屏，且按键主要包含数字类按键(如数字键0-9)和状态类按键(如取消键、OK键)，该设备还包含有以下功能模块：
初始化模块，用于在设备上电后，初始化当前运行状态为第一状态；
第一判断模块，用于判断要执行的操作，用于判断是否需要输入数字，用于判断是否需要输入确认状态；
第一处理模块，用于在所述第一判断模块判断出要执行的操作是数字类按键操作且需要输入数字时，根据用户对数字类按键的按下操作获得输入数据；用于在所述第一判断模块判断出要执行的操作是状态类按键操作且需要输入确认状态时根据用户对状态类按键的按下操作获得确认状态；
第二判断模块，用于在所述第一判断模块判断出要执行的操作不是所述数字输入类按键操作或所述状态类按键操作时，判断当前运行状态；
第二处理模块，用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态；
第三处理模块，用于在所述第二判断模块判断出当前运行状态是第六状态时，提示用户输入PIN码，并在所述第一处理模块获取的当前的确认状态为确认时将所述第一处理模块获取的当前的输入数据存储为PIN码，更新当前运行状态为第七状态；
第四处理模块，用于在所述第二判断模块判断出当前运行状态是第七状态时，获取存储的PIN码，生成验PIN指令发送给卡片，并在得知卡片验PIN成功后更新当前运行状态为第八状态；
第五处理模块，用于在所述第二判断模块判断出当前运行状态是第八状态时，根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态；
第六处理模块，用于在所述第二判断模块判断出当前运行状态是第九状态时，根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态。
其中，第一判断模块对于数字类按键操作或状态类按键操作的判断，可以具体通过中断模块和中断处理模块实现，具体如下：
所述中断模块，用于检测是否有按键被按下，当检测到有按键被按下时，置位按键IO中断标志；所述中断处理模块，用于检测按键IO中断标志是否被置位，当检测到按键IO中断被置位时，根据用户的按键输入设置键值标志的值，以及根据键值标志的值向数字输入缓存中写入数值，复位按键IO中断标志。
相应地，第一判断模块具体用于判断当前的键值标志的值，若属于第一预设范围，则判断出要执行的操作为数字类按键操作，若属于第二预设范围，则判断出要执行的操作为状态类按键操作。
其中，第一处理模块的功能实现可以具体如下：
第一处理模块，还具体用于在第一判断模块判断出要执行的操作是数字类按键操作且需要输入数字时，判断位数计数标志是否小于预设值，是则将位数计数标志的值加1，根据数字输入缓存中的数值更新输入数据；否则控制显示屏提示达到输入上限，初始化位数计数标志为初值，清空数字输入缓存，设置键值标志为默认值。
相应地，所述初始化模块，还用于初始化位数计数标志为初值；所述第一判断模块，还具体用于判断数字输入标志是否置位，是则表示需要输入数字，否则，表示不需要输入数字；例如，所述初值＝0，所述默认值＝0。
进一步地，第一处理模块的功能实现还可以具体如下：
第一处理模块，还具体用于用于在第一判断模块判断出要执行的操作是状态类按键操作且需要输入确认状态时，判断键值标志的值，若为第五预设值则设置确认标志为第一数值，清空数字输入缓存，初始化位数计数标志为初值并设置键值标志为默认值；若为第六预设值则判断位数计数标志是否为初值，是则设置确认标志为第三数值并设置键值标志为默认值，否则，执行清除数字输入缓存中的一个数值，并更新输入数据，将位数计数标志的值减1，控制显示屏显示退格，以及设置键值标志为默认值。
相应地，初始化模块，还用于初始化数字输入标志为第二数值，初始化位数计数标志为初值；第一判断模块，还具体用于判断位数计数标志是否大于初值，是则表示需要输入确认状态，否则，表示不需要输入确认状态。例如，所述初值＝0，所述默认值＝0，所述第一数值＝1，所述第二数值＝0，所述第三数值＝2。
本实施例3提供的动态口令生成设备，可以仅支持一种口令生成模式，上面介绍的是一种仅支持第一预设模式的设备，如果仅支持第二预设模式，则该动态口令生成设备的功能模块主要包括：初始化模块、第一判断模块、第一处理模块、第二判断模块、第二处理模块、第三处理模块、第四处理模块、第五处理模块、第六处理模块和第七处理模块；相比仅支持第一预设模式的动态口令生成设备，新增了第七处理模块，并对原有第二处理模块的功能进行了改变，说明如下：
第七处理模块，用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第二状态。
进一步地，如果仅支持第三预设模式，则该动态口令生成设备的功能模块主要包括：初始化模块、第一判断模块、第一处理模块、第二判断模块、第二处理模块、第三处理模块、第四处理模块、第五处理模块、第六处理模块、第七处理模块、第八处理模块和第九处理模块；相比仅支持第二预设模式的动态口令生成设备，新增了第八处理模块和第九处理模块，并对原有第二处理模块和第七处理模块的功能进行了改变，说明如下：
第八处理模块，用于在所述第二判断模块判断出当前运行状态是第三状态时，判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态；否则，更新当前运行状态为第四状态；
第九处理模块，用于在所述第二判断模块判断出当前运行状态是第四状态时，提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，以及根据所述卡片返回的第一返回数据设置货币标志，更新当前运行状态为第二状态；
第七处理模块，具体用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第三状态。
进一步地，如果仅支持第四预设模式，则该动态口令生成设备的功能模块主要包括：初始化模块、第一判断模块、第一处理模块、第二判断模块、第二处理模块、第三处理模块、第四处理模块、第五处理模块、第六处理模块和第十处理模块；相比仅支持第一预设模式的动态口令生成设备，新增了第十处理模块，并对原有第二处理模块的功能进行了改变，说明如下：
第十处理模块，用于在所述第二判断模块判断出当前运行状态是第五状态时，提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第五状态。
本实施例3提供的支持上述任意一种模式的动态口令生成设备，其中包含的第二处理模块所实现的从卡片返回的第一返回数据中获取第一数据和第二数据并保存的功能，具体实现方式为根据所述卡片返回的第一返回数据中的第一标识符和第二标识符获取第一数据并保存，根据第三标识符获取第二数据并保存。
进一步地，第二处理模块，具体还用于判断对卡片上电是否成功，若上电成功则向所述卡片发送预设指令，解析卡片返回的第一返回数据，根据所述卡片返回的第一返回数据中的第一标识符和第二标识符获取第一数据并保存，根据第三标识符获取第二数据并保存，更新当前运行状态为第六状态；若上电失败则控制显示屏显示卡片操作错误，初始化当前运行状态为第一状态。
进一步地，第三处理模块，具体用于在所述第二判断模块判断出当前运行状态是第六状态时，提示用户输入PIN码，置位数字输入标志，判断确认标志，若所述确认标志等于第一数值则复位数字输入标志，将输入数据记录为PIN码，更新当前运行状态为第七状态；若所述确认标志等于第三数值则控制显示屏 显示输入失败，对卡片下电，初始化当前运行状态为第一状态。
第四处理模块，具体用于在所述第二判断模块判断出当前运行状态是第七状态时，获取存储的PIN码，生成验PIN指令发送给卡片，判断卡片验PIN是否成功，若成功则更新当前运行状态为第八状态；若失败则控制显示屏显示卡片操作错误，初始化当前运行状态为第一状态。
第五处理模块，具体用于在所述第二判断模块判断出当前运行状态是第八状态时，根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，判断校验是否成功，若校验成功则更新当前运行状态为第九状态；若校验失败则控制显示屏显示卡片操作错误，初始化当前运行状态为第一状态。
第六处理模块，具体用于在所述第二判断模块判断出当前运行状态是第九状态时，根据保存的第二数据中位值为1的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数，将所述二进制数转换为十进制数，将转换得到的十进制数作为动态口令，控制显示屏显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态；或者
第六处理模块，具体用于在所述第二判断模块判断出当前运行状态是第九状态时，比对所述第二数据和所述口令数据的数据域数据的长度，若所述第二数据比所述口令数据的数据域数据长，则控制显示屏提示口令生成失败，若所述口令数据的数据域数据比所述第二数据长，则在第二数据右侧补零，凑成和所述口令数据的数据域数据位长一致的数据，然后根据保存的第二数据中位值为1的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数，将所述二进制数转换为十进制数，将转换得到的十进制数作为动态口令，控制显示屏显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态；
第七处理模块，具体用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，置位数字输入标志，判断确认标志，若所述确认标志等于第一数值则复位数字输入标志，将输入数据作为挑战码存入预设缓存，更新当前运行状态为第六状态；若所述确认标志等于第三数值则控制显示屏显示输入失败，对卡片下电，初始化当前运行状态为第一状态；或者
第二处理模块，具体用于在第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，以及判断所述第一返回数据中是否有货币标签，是则置位货币标志并更新当前运行状态为第二状态；否则，复位货币标志并更新当前运行状态为第二状态。
相应地，第八处理模块，具体用于在所述第二判断模块判断出当前运行状态是第三状态时，判断货币标志是否置位，是则提示用户输入货币编号，置位数字输入标志，判断确认标志，若所述确认标志等于第一数值则置位数字输入标志，将输入数据作为货币类型存入预设缓存，更新当前运行状态为第四状态；若所述确认标志等于第三数值则控制显示屏显示输入失败，对卡片下电，初始化当前运行状态为第一状态。
第九处理模块，具体用于在所述第二判断模块判断出当前运行状态是第四状态时，提示用户输入金额，置位数字输入标志，判断确认标志，若所述确认标志等于第一数值则复位数字输入标志，将输入数据作为金额存入预设缓存，更新当前运行状态为第六状态，若所述确认标志等于第三数值则控制显示屏显示输入失败，对卡片下电，初始化当前运行状态为第一状态。
第十处理模块，具体用于在所述第二判断模块判断出当前运行状态是第五状态时，提示用户输入签名值，置位数字输入标志，判断确认标志，若所述确认标志等于第一数值则复位数字输入标志，将输入数据作为签名值存入预设缓存，更新当前运行状态为第六状态；若所述确认标志等于第三数值则控制显示屏显示输入失败，对卡片下电，初始化当前运行状态为第一状态。
进一步地，基于多种模式的动态口令生成设备，可以通过在设备上设置模式类按键供用户选择要使用的动态口令生成模式，例如，增加第一预设模式按键和第二预设模式按键，用于供用户选择动态口令生成模式。相应地，设备的功能模块的功能实现改变如下：
其中，初始化模块还用于在设备上电后，控制显示屏提示用户按下模式类按键；第二判断模块还用于，在判断键值标志的值属于第三预设范围时，继续判断要执行的操作。例如，第一预设模式按键对应的键值标志的值为0xA1，第二预设模式按键对应的键值标志的值为0xA2，相应地，第三预设范围为0xA1-0xA2。
进一步地，中断处理模块还用于根据键值标志的值设置模式标志的值，例如，键值标志的值为0xA1则设置模式标志的值为0xA1。相应地，初始化模块，还用于初始化模式标志的取值与运行状态集合的对应关系，当模式类按键被按下时，根据模式标志获取与其对应的运行状态集合；还具体用于初始化各个运行状态集合的当前运行状态为第一状态；第二判断模块，还具体用于判断所述初始化模块获取的所述运行状态集合下的当前运行状态。
例如，初始化模块，具体用于初始化取值为第一预设值的模式标志对应的运行状态集合为包括第一状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第二预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为 第三预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第四预设值的模式标志对应的运行状态集合为包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
本发明提供的基于卡片的动态口令生成设备，口令数据是卡片结合了卡片内部数据和用户输入数据(例如挑战码、交易金额等)生成并返回给设备的，避免了口令数据被篡改的可能性，从而提高了动态口令生成的安全性。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，本领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，但都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求书为准。

Claims (20)

  1. 一种基于卡片的动态口令生成方法，所述卡片***到设备上，其特征在于，所述方法包括：
    步骤S1：所述设备上电，初始化当前运行状态为第一状态；
    步骤S2：所述设备判断要执行的操作，若是数字类按键操作则执行步骤S3；若是状态类按键操作则执行步骤S4，否则执行步骤S5；
    步骤S3：所述设备判断是否需要输入数字，是则根据用户对数字类按键的按下操作获得输入数据，然后返回执行步骤S2；否则直接返回步骤S2；
    步骤S4：所述设备判断是否需要输入确认状态，是则根据用户对状态类按键的按下操作获得确认状态，然后返回执行步骤S2；否则直接返回步骤S2；以及
    步骤S5：所述设备判断当前运行状态；
    若是第一状态则对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态，然后返回执行步骤S2；
    若是第六状态则提示用户输入PIN码，并在确认状态为确认时将输入数据存储为PIN码，更新当前运行状态为第七状态，然后返回步骤S2；
    若是第七状态则获取存储的PIN码，生成验PIN指令发送给卡片，并在得知卡片验PIN成功后更新当前运行状态为第八状态，然后返回步骤S2；
    若是第八状态则根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态，然后返回步骤S2；以及
    若是第九状态则根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态，然后返回步骤S2。
  2. 如权利要求1所述的基于卡片的动态口令生成方法，其特征在于：所述方法还包括按键中断流程和中断处理流程，所述按键中断流程具体为：当有按键被按下时进入按键中断，置位按键IO中断标志，退出按键中断；所述中断处理流程具体为：当按键IO中断标志被置位时进入中断处理，根据用户的按键输入设置键值标志的值，以及根据键值标志的值向数字输入缓存中写入数值，清按键IO中断标志后退出中断处理。
  3. 如权利要求2所述的基于卡片的动态口令生成方法，其特征在于，所述步骤S2具体为：
    所述设备判断键值标志的值，若属于第一预设范围，则确定要执行的操作为数字类按键操作，执行步骤S3，若属于第二预设范围，则确定要执行的操作为状态类按键操作，执行步骤S4；否则执行步骤S5；
    所述步骤S1还包括，判断键值标志的值，若属于第三预设范围，则执行步骤S2，若为其他值，则提示用户按下模式类按键。
  4. 如权利要求2所述的基于卡片的动态口令生成方法，其特征在于，所述中断处理流程还包括：根据键值标志的值设置模式标志的值；
    步骤S1还包括：初始化模式标志的取值与运行状态集合的对应关系，提示用户按下模式类按键，当模式类按键被按下时，根据模式标志获取与其对应的运行状态集合，然后执行步骤S2；
    所述步骤S1中，所述初始化当前运行状态为第一状态，具体为：初始化各个运行状态集合的当前运行状态为第一状态；以及
    所述步骤S5中，所述判断当前运行状态，具体为：判断获取的所述运行状态集合下的当前运行状态。
  5. 如权利要求4所述的基于卡片的动态口令生成方法，其特征在于：所述初始化模式标志的取值与运行状态集合的对应关系具体为：初始化取值为第一预设值的模式标志对应的运行状态集合为包括第一状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第二预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第三预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第四预设值的模式标志对应的运行状态集合为包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
  6. 如权利要求1所述的基于卡片的口令生成方法，其特征在于：所述判断当前运行状态之后还包括，
    若是第二状态则提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后返回执行步骤S2；
    相应地，判断当前运行状态为第一状态时所述更新当前运行状态为第六状态替换为，更新当前运行状态为第二状态，
    所述判断当前运行状态为第一状态时还包括根据所述卡片返回的第一返回数据设置货币标志；
    所述判断当前运行状态之后还包括，
    若是第三状态则判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态，然后返回步骤S2；否则更新当前运行状态为第四状态，然后返回步骤S2；
    若是第四状态则提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后返回步骤S2；
    相应地，判断当前运行状态为第二状态时，所述更新当前运行状态为第六状态替换为更新当前运行状态为第三状态。
  7. 如权利要求1所述的基于卡片的动态口令生成方法，其特征在于：所述判断当前运行状态之后还包括，
    若是第五状态则提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态，然后返回步骤S2；
    相应地，判断当前运行状态为第一状态时，所述更新当前运行状态为第六状态替换为更新当前运行状态为第五状态。
  8. 如权利要求1所述的基于卡片的动态口令生成方法，其特征在于：所述从卡片返回的第一返回数据中获取第一数据和第二数据并保存具体为：解析卡片返回的第一返回数据，根据所述第一返回数据中的第一标识符和第二标识符获取第一数据并保存，根据第三标识符获取第二数据并保存。
  9. 如权利要求1所述的基于卡片的动态口令生成方法，其特征在于：所述根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令具体为：根据第二数据中位值为1的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数，将所述二进制数转换为十进制数，将转换得到的十进制数作为动态口令。
  10. 如权利要求9所述的基于卡片的动态口令生成方法，其特征在于：所述压缩处理之前还包括，比对所述第二数据和所述口令数据的数据域数据的长度，若所述第二数据比所述口令数据的数据域数据长，则提示口令生成失败，若所述口令数据的数据域数据比所述第二数据长，则在第二数据右侧补零，凑成和所述口令数据的数据域数据位长一致的数据。
  11. 一种基于卡片的动态口令生成设备，所述设备包括按键和显示屏，其特征在于，所述设备还包括：
    初始化模块，用于在设备上电后，初始化当前运行状态为第一状态；
    第一判断模块，用于判断要执行的操作，用于判断是否需要输入数字，用于判断是否需要输入确认状态；
    第一处理模块，用于在所述第一判断模块判断出要执行的操作是数字类按键操作且需要输入数字时，根据用户对数字类按键的按下操作获得输入数据；用于在所述第一判断模块判断出要执行的操作是状态类按键操作且需要输入确认状态时根据用户对状态类按键的按下操作获得确认状态；
    第二判断模块，用于在所述第一判断模块判断出要执行的操作不是所述数字输入类按键操作或所述状态类按键操作时，判断当前运行状态；
    第二处理模块，用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第六状态；
    第三处理模块，用于在所述第二判断模块判断出当前运行状态是第六状态时，提示用户输入PIN码，并在所述第一处理模块获取的当前的确认状态为确认时将所述第一处理模块获取的当前的输入数据存储为PIN码，更新当前运行状态为第七状态；
    第四处理模块，用于在所述第二判断模块判断出当前运行状态是第七状态时，获取存储的PIN码，生成验PIN指令发送给卡片，并在得知卡片验PIN成功后更新当前运行状态为第八状态；
    第五处理模块，用于在所述第二判断模块判断出当前运行状态是第八状态时，根据保存的第一数据和预设缓存中存储的数据生成口令生成指令发送给卡片，从卡片返回的第二返回数据中获取口令数据并校验，并在校验成功后更新当前运行状态为第九状态；以及
    第六处理模块，用于在所述第二判断模块判断出当前运行状态是第九状态时，根据保存的第二数据对所述口令数据进行压缩处理，并将压缩处理后的数据格式化得到动态口令，显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态。
  12. 如权利要求11所述的设备，其特征在于，所述设备还包括中断模块和中断处理模块；
    所述中断模块，用于检测是否有按键被按下，当检测到有按键被按下时，置位按键IO中断标志；
    所述中断处理模块，用于检测按键IO中断标志是否被置位，当检测到按键IO中断被置位时，根据用户的按键输入设置键值标志的值，以及根据键值标志的值向数字输入缓存中写入数值，复位按键IO中断标志。
  13. 如权利要求12所述的设备，其特征在于，所述第一判断模块，具体用于判断键值标志的值，若属于第一预设范围，则判断出要执行的操作为数字类按键操作，若属于第二预设范围，则判断出要执行的操作为状态类按键操作；
    所述第一判断模块，还具体用于当键值标志的值属于第三预设范围时，执行所述判断要执行的操作。
  14. 如权利要求12所述的设备，其特征在于，所述中断处理模块还用于根据键值标志的值设置模式标志的值；
    所述初始化模块，还用于初始化模式标志的取值与运行状态集合的对应关系，控制显示屏提示用户按下模式类按键；当模式类按键被按下时，根据模式标志获取与其对应的运行状态集合；
    所述初始化模块，还具体用于初始化各个运行状态集合的当前运行状态为第一状态；以及
    所述第二判断模块，还具体用于判断所述初始化模块获取的所述运行状态集合下的当前运行状态。
  15. 如权利要求14所述的设备，其特征在于，所述初始化模块，具体用于初始化取值为第一预设值的模式标志对应的运行状态集合为包括第一状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第二预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第三预设值的模式标志对应的运行状态集合为包括第一状态、第二状态、第三状态、第四状态、第六状态、第七状态、第八状态和第九状态，和/或初始化取值为第四预设值的模式标志对应的运行状态集合为包括第一状态、第五状态、第六状态、第七状态、第八状态和第九状态。
  16. 如权利要求11所述的设备，其特征在于，所述设备还包括第七处理模块，用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
    所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，以及根据所述卡片返回的第一返回数据设置货币标志，更新当前运行状态为第二状态；
    所述设备还包括第八处理模块，用于在所述第二判断模块判断出当前运行状态是第三状态时，判断货币标志是否置位，是则提示用户输入货币编号，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第四状态；否则更新当前运行状态为第四状态；
    所述设备还包括第九处理模块，用于在所述第二判断模块判断出当前运行状态是第四状态时，提示用户输入金额，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
    所述第七处理模块，具体用于在所述第二判断模块判断出当前运行状态是第二状态时，提示用户输入挑战码，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第三状态。
  17. 如权利要求11所述的设备，其特征在于，所述设备还包括第十处理模块，用于在所述第二判断模块判断出当前运行状态是第五状态时，提示用户输入签名值，并在确认状态为确认时获取输入数据存入预设缓存，更新当前运行状态为第六状态；
    所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，并从卡片返回的第一返回数据中获取第一数据和第二数据并保存，更新当前运行状态为第五状态。
  18. 如权利要求11所述的设备，其特征在于，所述第二处理模块，具体用于在所述第二判断模块判断出当前运行状态是第一状态时，对所述卡片上电，上电成功后向所述卡片发送预设指令，解析卡片返回的第一返回数据，根据所述卡片返回的第一返回数据中的第一标识符和第二标识符获取第一数据并保存，根据第三标识符获取第二数据并保存，更新当前运行状态为第六状态。
  19. 如权利要求11所述的设备，其特征在于，所述第六处理模块，用于在所述第二判断模块判断出当前运行状态是第九状态时，根据保存的第二数据中位值为1的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数，将所述二进制数转换为十进制数，将转换得到的十进制数作为动态口令，控制显示屏显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态。
  20. 如权利要求19所述的设备，其特征在于，所述第六处理模块，用于在所述第二判断模块判断出当前运行状态是第九状态时，比对所述第二数据和所述口令数据的数据域数据的长度，若所述第二数据比所述口令数据的数据域数据长，则控制显示屏提示口令生成失败，若所述口令数据的数据域数据比所述第二数据长，则在第二数据右侧补零，凑成和所述口令数据的数据域数据位长一致的数据，然后根据保存的第二数据中位值为1的位地址，从口令数据的数据域数据中选择出与该位地址对应的位值重新组合成一个二进制数，将所述二进制数转换为十进制数，将转换得到的十进制数作为动态口令，控制显示屏显示所述动态口令，对所述卡片下电，初始化当前运行状态为第一状态。
PCT/CN2015/095270 2014-12-30 2015-11-23 一种基于卡片的动态口令生成方法及设备 WO2016107332A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/529,130 US10397200B2 (en) 2014-12-30 2015-11-23 Card-based dynamic password generation method and device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410840454.X 2014-12-30
CN201410840454.XA CN104539430B (zh) 2014-12-30 2014-12-30 一种基于卡片的动态口令生成方法及设备

Publications (1)

Publication Number Publication Date
WO2016107332A1 true WO2016107332A1 (zh) 2016-07-07

Family

ID=52854901

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/095270 WO2016107332A1 (zh) 2014-12-30 2015-11-23 一种基于卡片的动态口令生成方法及设备

Country Status (3)

Country Link
US (1) US10397200B2 (zh)
CN (1) CN104539430B (zh)
WO (1) WO2016107332A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104539430B (zh) * 2014-12-30 2018-11-30 飞天诚信科技股份有限公司 一种基于卡片的动态口令生成方法及设备
US10572376B2 (en) * 2016-12-30 2020-02-25 Intel Corporation Memory ordering in acceleration hardware
US10333913B2 (en) * 2017-05-15 2019-06-25 International Business Machines Corporation Dynamic object passwords
CN108038694B (zh) 2017-12-11 2019-03-29 飞天诚信科技股份有限公司 一种具有指纹验证功能的金融卡及其工作方法
US11200186B2 (en) 2018-06-30 2021-12-14 Intel Corporation Apparatuses, methods, and systems for operations in a configurable spatial accelerator
US11907713B2 (en) 2019-12-28 2024-02-20 Intel Corporation Apparatuses, methods, and systems for fused operations using sign modification in a processing element of a configurable spatial accelerator
CN112636910B (zh) * 2020-12-29 2021-08-24 北京深思数盾科技股份有限公司 临时密码的生成与验证方法、设备及***

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163014A (zh) * 2007-11-30 2008-04-16 中国电信股份有限公司 一种动态口令身份认证***和方法
CN101296241A (zh) * 2008-06-30 2008-10-29 北京飞天诚信科技有限公司 基于口令卡提高身份认证安全性的方法
CN101895391A (zh) * 2009-04-21 2010-11-24 谈剑锋 卡式动态密码身份认证设备及其实现方法
CN102377570A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种生成动态口令的方法和装置
CN102377783A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种动态口令生成及认证的方法和***
CN104539430A (zh) * 2014-12-30 2015-04-22 飞天诚信科技股份有限公司 一种基于卡片的动态口令生成方法及设备

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8949608B2 (en) * 2000-02-18 2015-02-03 Vasco Data Security, Inc. Field programmable smart card terminal and token device
US9251637B2 (en) * 2006-11-15 2016-02-02 Bank Of America Corporation Method and apparatus for using at least a portion of a one-time password as a dynamic card verification value
US20080201264A1 (en) * 2007-02-17 2008-08-21 Brown Kerry D Payment card financial transaction authenticator
GB2442249B (en) * 2007-02-20 2008-09-10 Cryptomathic As Authentication device and method
DE602007007085D1 (de) * 2007-09-20 2010-07-22 Tds Todos Data System Ab System, Verfahren und Vorrichtung zur Ermöglichung von Interaktionen mit dynamischer Sicherheit
WO2010022129A1 (en) * 2008-08-20 2010-02-25 Xcard Holdings Llc Secure smart card system
US9158905B2 (en) * 2008-09-28 2015-10-13 Feitian Technologies Co., Ltd. Method for computer startup protection and system thereof
US8369521B2 (en) 2008-10-17 2013-02-05 Oracle International Corporation Smart card based encryption key and password generation and management
US8201747B2 (en) * 2008-11-26 2012-06-19 Qsecure, Inc. Auto-sequencing financial payment display card
US20100241865A1 (en) * 2009-03-19 2010-09-23 Chunghwa Telecom Co., Ltd One-Time Password System Capable of Defending Against Phishing Attacks
US8413894B2 (en) * 2009-11-05 2013-04-09 X-Card Holdings, Llc Card with illuminated codes for use in secure transactions
US20120260324A1 (en) * 2009-11-06 2012-10-11 Emue Holdings Pty Ltd. Method and a system for validating identifiers
TW201250601A (en) * 2011-06-01 2012-12-16 Ultracap Technologies Corp Smart card with regenerative power
PL2885904T3 (pl) * 2012-08-03 2018-09-28 Vasco Data Security International Gmbh Dogodny dla użytkownika sposób uwierzytelniania i urządzenie stosujące mobilną aplikację uwierzytelniania
CN103312517B (zh) * 2013-06-28 2016-04-06 飞天诚信科技股份有限公司 一种双用途设备共用显示屏和按键的实现方法
CN103746816B (zh) * 2014-02-18 2017-11-28 飞天诚信科技股份有限公司 一种多功能认证设备及其工作方法
US9218596B2 (en) * 2014-04-28 2015-12-22 Bank Of America Corporation Method and apparatus for providing real time mutable credit card information

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101163014A (zh) * 2007-11-30 2008-04-16 中国电信股份有限公司 一种动态口令身份认证***和方法
CN101296241A (zh) * 2008-06-30 2008-10-29 北京飞天诚信科技有限公司 基于口令卡提高身份认证安全性的方法
CN101895391A (zh) * 2009-04-21 2010-11-24 谈剑锋 卡式动态密码身份认证设备及其实现方法
CN102377570A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种生成动态口令的方法和装置
CN102377783A (zh) * 2011-11-07 2012-03-14 飞天诚信科技股份有限公司 一种动态口令生成及认证的方法和***
CN104539430A (zh) * 2014-12-30 2015-04-22 飞天诚信科技股份有限公司 一种基于卡片的动态口令生成方法及设备

Also Published As

Publication number Publication date
US10397200B2 (en) 2019-08-27
CN104539430B (zh) 2018-11-30
US20170295149A1 (en) 2017-10-12
CN104539430A (zh) 2015-04-22

Similar Documents

Publication Publication Date Title
WO2016107332A1 (zh) 一种基于卡片的动态口令生成方法及设备
US10177816B2 (en) Devices and methods for identification, authentication and signing purposes
US9124433B2 (en) Remote authentication and transaction signatures
KR101706173B1 (ko) 모바일 애플리케이션을 보안하기 위한 방법 및 장치
BRPI0807776B1 (pt) Aparelho e método para gerar dados de criptograma intermediários correspondentes a uma senha dinâmica; circuito integrado; cartão; código de controle de processador e meio legível por computador
CN113344570A (zh) 传输和处理交易消息的方法及数据处理装置
CN102377783B (zh) 一种动态口令生成及认证的方法和***
CN104486343A (zh) 一种双因子双向认证的方法及***
CN106850503A (zh) 一种免登录身份认证方法及装置
WO2018166163A1 (zh) Pos终端控制方法、pos终端、服务器及存储介质
CN107480513B (zh) 一种认证实现方法及装置、计算机装置、可读存储介质
US20190139009A1 (en) Management system, control method therefor, and non-transitory computer-readable medium
JP2022539773A (ja) モバイル近距無線離通信がペイメントカード上の表示を更新することを可能にするシステムおよび方法
CN106781070B (zh) 一种自助快递柜服务***
CN103235911A (zh) 一种签名方法
CN106411523B (zh) 银行卡密码的生成方法、校验方法、设备以及***
CN101369891A (zh) 一种动态密码认证方法及双矩阵动态密码卡
JP5670001B1 (ja) 取引システム、取引方法、ならびに、情報記録媒体
CN108763934A (zh) 数据处理方法及装置、存储介质、服务器
CN101533539B (zh) 密码输入方法及设备
CN110210831B (zh) 一种基于数据短信技术的办公审批方法及***
KR101808315B1 (ko) 모바일 장치 및 사용자 단말기 사이의 인증서 로밍 방법 및 시스템
CN103888267A (zh) 基于音频接口的网上银行数据加密、认证方法和装置
JP6336383B2 (ja) 取引システム
CN103020532A (zh) 一种车载终端Flash加密方法及其装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15875011

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15529130

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15875011

Country of ref document: EP

Kind code of ref document: A1