Dynamic token seed key self-help update method and system

Abstract

The invention discloses a dynamic token seed key self-help update method and a dynamic token seed key self-help update system. The method comprises the following steps that: S1, an initial seed key is downloaded for a token and an initial seed key file is submitted to a distributor; S2, the distributor gives the token to a final user; S3, the final user opens the token to get random codes; S4, the token is pressed for a plurality of seconds such that current random codes can be selected as activation codes; S5, the token permanently locks the random codes as the activation codes; S6, the activation codes are submitted to a server; S7, after the token is activated, the server updates the seed key; S8, the user presses the token for a plurality of seconds so as to select current activation codes as an updated initial seed key; and S9, after being updated, the seed key of the token is used initially. The dynamic token seed key self-help update method is advantageous in convenience and safety. According to the dynamic token seed key self-help update method, the generation of a final key is realized when a client actually activates the token, and therefore, a series of problems in token usage security which are brought about by the crack of a preset seed key can be solved.

Description

technical field [0001] The invention relates to the field of updating a dynamic token seed, in particular to a method and a system for self-service updating of a dynamic token seed key. Background technique [0002] The current general disadvantage in the industry is that in token products, it is impossible to guarantee that the seed key of the token will not be artificially copied and leaked. The good reputation of the RSA SecurID system in some large enterprises and government agencies has made this system considered to be an unbreakable system for a long time. In the end, however, like most security breaches, the system was compromised through human error, not a bug in the technology. A phishing email was sent to certain low-level RSA employees with the subject line "2011 Hiring Plan" containing an excel spreadsheet with a zero-day exploit flash file. One or more employees opened the file, thinking it was legitimate mail. The exploit then retrieves the user ID and pass...

Images