Electronic cipher generating method, device and equipment and electronic cipher authentication system

Abstract

The invention discloses an electronic cipher generating method, device and equipment and an electronic cipher authentication system. The method comprises the following steps: prompting a user to input a challenge code by prompting information, wherein the prompting information is the information that the user knows the implication of the challenge code to be input; receiving the challenge code input by the user; and generating a dynamic electronic cipher according to the input challenge code and the current time parameter. Because the challenge code is classified into a plurality of parts, the user is prompted to know the practical implication of the challenge code to be input by the prompting information, and the user sequentially inputs each part of the challenge code according to the prompting information, so that whether the deal is the true deal needed by the user is confirmed according to the prompting information for prompting the user to know the practical implication of the challenge code to be input and the challenge code to be input, hacker fishing behavior is prevented to a certain extent, and the user property safety is guaranteed.

Description

technical field [0001] The invention relates to the field of information security, in particular to an electronic password generation method, device and equipment, and an electronic password authentication system. Background technique [0002] In recent years, with the rapid development of the Internet and financial informatization, online banking has been widely praised by users and the banking industry for its advantages of convenience and high efficiency. Banks and various large-scale e-commerce websites mostly use dynamic password tokens or dynamic password cards to strengthen the security of network identity authentication in order to overcome the security flaws of authentication methods based on static passwords. [0003] Dynamic password technology is also known as One Time Password (OTP for short) technology, which is characterized in that users enter electronic passwords according to the display numbers of dynamic password tokens provided by service providers, while...

AI Technical Summary

Problems solved by technology

That is, the existing time-based dynamic password technology has a relatively large security risk

[0008] (2) When the dynamic password technology based on challenge / response is adopted, the server generally sends a challenge code to the user's transaction terminal or mobile phone at random. The random challenge code has nothing to do with transaction information and user information (collectively referred to as user transaction information). It is impossible to know whether it is a real transaction that you need to carry out, and you cannot know which transaction it is. When the user cannot know whether it is a real transaction that you need to carry out, and pays for a non-real transaction, It will cause the loss of the user's property. Therefore, the server may send a random challenge code to the user's transaction terminal or mobile phone, which may become an unsafe factor in electronic transactions.

[0009] When the dynamic password technology based on challenge / response is adopted, the electronic password generating device generates an electronic password according to the challenge code, wherein, even if the challenge code adopts user transaction information, such as account number and amount, once a hacker obtains the user's account information, pretending to be a bank Send the user's account number and amount, and inform the user to send the displayed result to the "bank". For example, a hacker pretends to be a bank and sends a text message to the user, informing the user that the electronic password generation device needs to be upgraded, and the user is required to input the information sent to the user The electronic password generating device generates an electronic password and feeds the electronic password back to the hacker. In this way, the hacker can directly obtain the user's electronic password for subsequent operations, which becomes a major security risk

Images