Method and system for authenticating USB (universal serial bus) challenge-response token

Abstract

The invention discloses a system for authenticating a USB (universal serial bus) challenge-response token, wherein the client USB challenge-response token is provided with a USB interface but not provided with full keyboard input keys. When transaction of the USB challenge-response token is authenticated, an authentication webpage calls an authentication control to transmit transaction information including a transfer account number and transfer amount to the token through the USB interface, a cryptographic chip of the token calculates dynamic passwords related to transaction data in a challenge-response mode and returns the dynamic passwords through the USB interface, the authentication webpage transmits the transaction data and the returned dynamic passwords containing the transaction information of a user to an authentication server of the system, the authentication server acquires a token seed key according to a user identifier, the transaction data are calculated in the challenge-response mode to obtain the dynamic passwords related to the transaction data, and the dynamic passwords are compared with the dynamic passwords, which is submitted by the token, containing the transaction information of the user to determine whether the transaction data are tampered or not.

Description

technical field [0001] The invention belongs to the technical field of information security, in particular to a USB challenge response token authentication method and system capable of resisting network fraud and third-party attacks. Background technique [0002] Confirming the legitimacy of users through the application of strong two-factor password (dynamic password and static password) authentication technology is a fast-growing security technology that uses passwords to implement identity identification in current computer networks. The application number is 2011100120747.7, and the Chinese patent application titled "a dynamic token two-way authentication method and system" discloses a dynamic token authentication method. The authentication method is generated and displayed by a clock-shaped dynamic two-way authentication token. Challenge code and verification code, enter the challenge code and ID number through the authentication webpage, and send back a set of verifica...

AI Technical Summary

Problems solved by technology

[0004] The purpose of the present invention is to provide a new type of challenge response token with a USB interface without a full-disk input key, and solve the problem of being attacked by a third-party hacker on the basis of the prior art

Images