A login verification method and system based on dynamic password

Abstract

The application belongs to the technical field of information security, and provides a login verification method and system based on dynamic password. The method comprises the following steps: when the front end of a service system receives a user dynamic password acquisition request, the front end of the service system applies for an online authentication password or an offline authentication password to a smart card application according to network state and security requirements; when the offline authentication password is applied for, the terminal application initiates an offline authentication password request to the smart card application. The dynamic password is generated by using the password algorithm, parameter item, hash value conversion and encryption calculation selected by the counter, and the dynamic password is returned to the current terminal application and the user; when the operator service end receives a data verification request, the authentication type is automatically identified, and the dynamic password is calculated to perform data verification. The application improves the verification success rate and realizes the multi-factor authentication mode.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of information security, and provides a login verification method and system based on dynamic passwords, which can be used for offline authentication login and online authentication login. BACKGROUND

[0002] In the prior art, the existing username and password login method has user password security problems, some websites store passwords in plaintext, which is prone to risk situations. In addition, user weak passwords are easy to be cracked. Users need to record passwords and need to modify them regularly. In addition, the existing short message verification code login method has the following problems: the delay is serious, and there are even cases where the verification code cannot be received, especially after multiple failures, there is a short message frequency limit, which cannot send and receive short messages again, and does not support offline authentication. In addition, the existing two-dimensional code login method has the following risks: 1) two-dimensional code attack risk; 2) device permission risk, scanning code login usually depends on the camera permission of the mobile phone, which causes risks caused by device permissions; 3) network connection requirement, two-dimensional code login requires the mobile phone and the target device to be connected to the network, if the network is interrupted (such as unstable public WiFi), the login process will fail; 4) environmental restrictions: insufficient light, blurred two-dimensional code, screen glare and other environmental factors cause low scanning code success rate; 5) cannot be used offline, in terminal no mobile operator signal or no cellular network scene (such as remote areas), two-dimensional code login is completely invalid, and needs to rely on other backup solutions. In addition, the existing one-key login method only supports mobile phone login and must enable mobile traffic. In addition, the existing offline authentication method cannot verify the user's identity in real time, and cannot update the security policy in time.

[0003] Therefore, it is necessary to provide an improved authentication login method and system based on dynamic passwords to solve the above problems. SUMMARY

[0004] The present application provides a login verification method and system based on dynamic passwords to solve the verification problem when online authentication is not available in the prior art, support offline authentication, improve the verification success rate, and solve the technical problems such as the lack of convenient hardware device support during offline authentication. The technical problems to be solved by the present application are solved by the following technical solutions.

[0005] The first aspect of the present application provides a login verification method based on dynamic password, the login verification method comprises: when the front end of a service system receives a dynamic password acquisition request, the front end of the service system applies the following authentication passwords to a smart card application according to network state and security requirements: online authentication password, offline authentication password; the smart card application uses selected password algorithms and parameter items to perform hash value conversion and encryption calculation, and intercepts according to an interception algorithm to generate dynamic passwords corresponding to offline authentication password requests or online authentication password requests in different ways, and returns the generated dynamic passwords to a current terminal application and a current user; after the current terminal application receives the dynamic passwords, the smart card serial number, the generated dynamic passwords, and related data are transmitted to a server of the current terminal application, and then transmitted to an operator service end; when the operator service end receives a data verification request, the authentication type is automatically identified, dynamic password calculation is performed for data verification, and a data verification result is returned to the service end of the service system, and the authentication type includes offline authentication and online authentication.

[0006] The second aspect of the present application provides a login verification system based on dynamic password, which executes the login verification method based on dynamic password of the first aspect of the present application, and the login verification system comprises: a request processing module, configured to, when the front end of a service system receives a dynamic password acquisition request, the front end of the service system applies the following authentication passwords to a smart card application according to network state and security requirements: online authentication password, offline authentication password; a calculation processing module, configured to, the smart card application uses selected password algorithms and parameter items to perform hash value conversion and encryption calculation, and intercepts according to an interception algorithm to generate dynamic passwords corresponding to offline authentication password requests or online authentication password requests in different ways, and returns the generated dynamic passwords to a current terminal application and a current user; a data transmission module, configured to, after the current terminal application receives the dynamic passwords, the smart card serial number, the generated dynamic passwords, and related data are transmitted to a server of the current terminal application, and then transmitted to an operator service end; a data verification module, configured to, when the operator service end receives a data verification request, the authentication type is automatically identified, dynamic password calculation is performed for data verification, and a data verification result is returned to the service end of the service system, and the authentication type includes offline authentication and online authentication.

[0007] The third aspect of the present application provides an electronic device, comprising: one or more processors; a storage device configured to store one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the login verification method based on dynamic password of the first aspect of the present application.

[0008] The fourth aspect of the present application provides a computer readable medium, which stores a computer program, and the computer program is executed by a processor to realize the dynamic password-based login verification method of the first aspect of the present application.

[0009] The embodiments of the present application have the following advantages:

[0010] Compared with the prior art, in the present application, when the front end of the service system receives a dynamic password acquisition request, the front end of the service system applies for the following authentication passwords according to the network state and security requirements: online authentication password, offline authentication password; the smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, intercepts according to the interception algorithm, generates dynamic passwords corresponding to the offline authentication password request or the online authentication password request in different ways, and returns the generated dynamic passwords to the current terminal application and the current user; after the current terminal application receives the dynamic password, the smart card serial number, the generated dynamic password, and related data are transmitted to the server of the current terminal application, and then transmitted to the operator service end; when the operator service end receives the data verification request, the authentication type is automatically identified, dynamic password calculation is performed for data verification, and the data verification result is returned to the service end of the service system. Among them, the smart card and the operator service end generate dynamic passwords according to the same algorithm and related parameters, the user fills in the parameters in the smart card application, the smart card application transmits the parameters to the server of the smart card application, and then transmits the parameters to the operator service end through the server of the smart card application for data verification. The operator service end can independently generate dynamic passwords for comparison and verification, thereby completing data verification, supporting offline authentication, and effectively solving the problem that the "one-key login" cannot be authenticated when there is no network provided by the operator.

[0011] In addition, the quantum key improves the transmission security of system data and improves the cracking difficulty.

[0012] In addition, the present application can realize flexible verification mode and OTP generation mode, support offline authentication, as a supplement to the operator "one-key login" scheme, improve the verification success rate, and the login verification mode of the present application can improve the security level and optimize the one-time password generation method. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 is a step flow chart of an example of the dynamic password-based login verification method of the present application;

[0014] Figure 2 is a flowchart of another angle of the dynamic password-based login verification method of the present application;

[0015] Figure 3is a partial flow diagram of online authentication in a login verification method based on dynamic password of the present application;

[0016] Figure 4 is a structural block diagram of a login verification system based on dynamic password of the present application;

[0017] Figure 5 is a structural schematic diagram of an electronic device embodiment according to the present application;

[0018] Figure 6 is a structural schematic diagram of a computer readable medium embodiment according to the present application. DETAILED DESCRIPTION

[0019] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0020] In view of the above problems, the present application proposes a login verification method based on dynamic password, in which, when the front end of a service system receives a dynamic password acquisition request, the front end of the service system applies for the following authentication passwords according to network status and security requirements: online authentication password, offline authentication password; the smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, and intercepts according to an interception algorithm to generate dynamic passwords corresponding to the offline authentication password request or the online authentication password request in different ways, and returns the generated dynamic passwords to the current terminal application and the current user; after the current terminal application receives the dynamic password, the smart card serial number, the generated dynamic password, and related data are transmitted to the server of the current terminal application, and then to the operator service end; when the operator service end receives the data verification request, it automatically identifies the authentication type, performs dynamic password calculation for data verification, and returns the data verification result to the service end of the service system. Among them, the smart card and the operator service end generate dynamic passwords according to the same algorithm and related parameters, the user fills in the parameters in the smart card application, the smart card application transmits the parameters to the server of the smart card application, and then transmits them to the operator service end through the server of the smart card application for data verification. The operator service end can independently generate dynamic passwords for comparison and verification, thereby completing data verification, realizing offline authentication, and effectively solving the problem that "one-key login" cannot be authenticated when there is no network provided by the operator.

[0021] Embodiment 1

[0022] The content of the present application will be described in detail below with reference to Figure 1 , Figure 2 , Figure 3 .

[0023] Figure 1 is a step flow chart of an example of the dynamic password-based login verification method of the present application. Figure 2 is a flow chart of an example of the dynamic password-based login verification method of the present application.

[0024] Referring to Figure 1 and Figure 2 In step S101, when the front end of the service system receives a current dynamic password acquisition request, the front end of the service system applies for the following authentication passwords according to the network state and security requirements: online authentication password, offline authentication password.

[0025] Specifically, the front end of the service system includes but is not limited to smart card application and terminal application (such as application in mobile phone or tablet), smart terminal operating system, smart card operating system. The online authentication password and offline authentication password correspond to online authentication and offline authentication respectively.

[0026] Further, the front end of the service system also includes smart card system, etc. In addition, it also includes the back end corresponding to the front end of the service system, and the back end of the service system includes the server of the terminal application and the server of the operator (i.e. the server corresponding to the server of the operator), etc.

[0027] In Figure 2 the example, it includes user, smart card application, terminal application (or terminal application of the service system, such as user interface), server of the terminal application (i.e. the server corresponding to the server of the terminal application), server of the operator (i.e. the server corresponding to the server of the operator, i.e. server of the operator), wherein the smart card installs, for example, one-time password applet (i.e. OTP Applet) or installs other service application, and the one-time password applet is used to store quantum secret key, store algorithm configuration and perform data operation.

[0028] It should be noted that in the present application, the smart card refers to SIM card, Subscriber Identity Module, and specifically includes but is not limited to SIM card, eSIM, NanoSIM, etc., which has the ability to access the network and talk, and has the ability to process OTA data short message.

[0029] Specifically, the smart card includes four layers of modules, a hardware layer, a COS layer, a capability support layer, and an application layer. In the hardware layer, the SIM card physical layer access interface, IO, CPU, memory, algorithm unit, etc. In the COS layer, the SIM card memory management, application management, various security mechanisms, over-the-air short message transmission protocol control, etc. The capability support layer is used to define various API interfaces supporting the application layer calls, etc. The application layer is used to carry various applications, including various industry applications (such as public transportation, finance, etc.). The smart card application is an application program running on the smart card, which is developed to complete a specific function, for example, a one-time password applet.

[0030] The smart card application and the network operator server perform key distribution through a quantum key distribution system, for example, filling a D group symmetric key, for example, D is 20000, and a secret key occupies 20 bytes of space, specifically including 3 bytes of index, 1 byte of state, and 16 bytes of secret key data.

[0031] In a specific embodiment, the smart card is pre-installed with a set of asymmetric keys, specifically a first public key (e.g., SimSM2pub) and a first private key (e.g., SimSM2pri). The operator server is pre-installed with a set of asymmetric keys, specifically a second public key (e.g., MNOSM2pub) and a second private key (e.g., MNOSM2pri). The operator server and the smart card each know the public key of the other party (e.g., SimSM2pub, MNOSM2pub).

[0032] Preferably, the smart card and the OTP Applet are configured with parameters in the same way, specifically including configuring the password algorithm identifier, the hash algorithm identifier, the signature algorithm identifier, the truncation algorithm identifier, and the optional and default items of each algorithm.

[0033] In a specific embodiment, the user browses a webpage on a PC or mobile phone, etc., and requests to log in to a website or system (corresponding to Figure 2 "1. User requests dynamic password" in the specification), specifically after the user's security verification (corresponding to Figure 2 "2. After security verification, obtain user input parameters, current timestamp, and determine security level parameters" in the specification), the dynamic password acquisition process (i.e., the one-time password acquisition process) is entered, that is, the user initiates a current dynamic password acquisition request to the terminal application (corresponding to Figure 2 "3. Initiating a dynamic password acquisition request" in the specification), when the terminal application receives the current dynamic password acquisition request, it applies the following authentication passwords to the smart card application (specifically, the one-time password applet) according to the network status and security requirements: online authentication password, offline authentication password.

[0034] The user security verification refers to, for example, a biometric security verification of a smart terminal, a password security verification of a smart application, a user password security verification of a smart card application, and specifically includes fingerprint verification or first layer PIN password verification.

[0035] Specifically, when the front end of the service system receives a dynamic password obtaining request, the terminal application can determine online authentication or offline authentication according to network status and security requirements, and thus determine an online authentication password or an offline authentication password corresponding to the online authentication or offline authentication. The terminal application can interact with the smart card application through a machine card protocol. The smart card application can be regarded as a front end of an operator server, and the operator server can issue data (including a smart card serial number corresponding to a mobile phone number, operation data, etc.) to the smart card. Each smart card corresponds to a mobile phone number, that is, each mobile phone number corresponds to a unique smart card serial number. The smart card application can interact with the smart card and can obtain the smart card serial number corresponding to the smart card. Alternatively, existing data such as the number of login times, login time, and data verification time can also be obtained.

[0036] It should be noted that in some embodiments of the present application, the user applies for a one-time password service, that is, opens the service to the operator. After the operator verifies the identity of the user, the one-time password service is opened. The operator updates the smart card application in the smart card of the user's smart terminal through an over-the-air (OTA) server. The initial value of the default counter at both the operator and the smart card application is 0. The smart card application internally supports the following hash algorithm, password algorithm, asymmetric algorithm, truncation algorithm, and one-time password generation method. The operator updates the one-time password service through the OTA server to synchronously update the updated offline parameters and online parameters to the smart card application, and the service end of the operator (that is, the operator server) also saves the synchronously updated data. In addition, the online authentication password and the offline authentication password correspond to the online authentication process and the offline authentication process, wherein the offline authentication process specifically refers to authentication without being in the network range provided by the operator, for example, authentication through a wireless local area network, a hot spot, or the like. In the offline authentication process, the smart card application and the terminal application (corresponding to the service system) do not need to directly interact with the operator. The above is described as an optional example and cannot be understood as a limitation of the present application.

[0037] Next, in step S102, the smart card application performs hash value conversion, encryption calculation, and truncation according to the selected password algorithm and parameter item to generate dynamic passwords corresponding to online authentication and offline authentication in different ways.

[0038] When the applied authentication password is an offline authentication password, the terminal application initiates an offline authentication password request to the smart card application. The smart card application performs hash value conversion, encryption calculation using the selected password algorithm based on the counter, and parameter items (see Table 1 below for details), and then intercepts to generate a dynamic password according to the interception algorithm, and returns the generated dynamic password to the current terminal application and the current user.

[0039] Table 1

[0040]

[0041] It should be noted that in the present example, the terminal application refers to the authentication application in a terminal device such as a mobile phone or a tablet.

[0042] The parameter items in Table 1 can be extended for different terminal applications using default values. It also supports division into multiple configuration parameters according to application direction, such as financial and general verification code.

[0043] For the case where the network is not provided by the operator, the smart card application can determine that the applied authentication password is an offline authentication password, and obtain the dynamic password through a non-direct interaction with the operator. The smart card application is, for example, a short video application or a certain bank application.

[0044] It should be noted that in the present example, the set of asymmetric keys generated by the smart card application is the same as the set of asymmetric keys of the smart card, specifically the first public key (e.g. SimSM2pub) and the first private key (e.g. SimSM2pri). The first public key is uploaded to the operator server. The operator and the terminal smart application (such as a short video application or a certain bank application) have signed a verification service agreement. The above is only an optional example for illustration and cannot be understood as a limitation of the present application.

[0045] In a specific embodiment, the event-based OTP offline authentication (i.e. HOTP) generates offline parameters based on the counter value (specifically the current value of the counter) and the polling key, and further performs multi-step progressive calculation to obtain the dynamic password, i.e. one-time password or OTP password.

[0046] In the present example, the event specifically includes a counter increment event related to the authentication process.

[0047] For example, the "event" generally refers to the "increment of the counter value" or "number of operations of the counter" triggered when the user performs identity verification. The generation of the dynamic password depends on the event of the increment of the counter value, and is synchronized with the counter value, i.e. the user and the authentication server share a counter value, and the counter value is incremented (i.e. the current counter value is increased by one) after each successful authentication, ensuring that each dynamic password is verified only once.

[0048] For the dynamic polling of multiple cryptographic algorithms, the cryptographic algorithm to be used is determined therefrom. For example, the parameter corresponding to the cryptographic algorithm is 0x05, because 0x05 in hexadecimal equals 00000101 in binary, which has 2 bits of 1, so the number of cryptographic algorithms is 2, i.e., F in the following expression (1) is 2.

[0049] The following expression is used to determine the cryptographic algorithm to be used by using the remainder obtained by dividing the current value of the counter by the number of enabled cryptographic algorithms. The parameter corresponding to the cryptographic algorithm is 0x05.

[0050] Y = counter / F (1)

[0051] Wherein, Y represents the remainder obtained by dividing the current value of the counter by the number of enabled cryptographic algorithms, specifically 0 or 1; counter represents the current value of the counter; F represents the number of enabled cryptographic algorithms, which is two in this example, but is not limited thereto, and in other examples, it can also be three or more.

[0052] Specifically, the obtained remainder Y includes 0 and 1. For example, when the obtained remainder is 0, the polling position is determined, and the cryptographic algorithm to be used is determined to be SM4. For example, when the obtained remainder is 1, the cryptographic algorithm to be used is determined to be 3DES.

[0053] In a specific embodiment, for the cryptographic algorithm, the specific algorithm name, the default configuration, and the optional configuration can refer to the following Table 2. For example, the configuration of the algorithm identification (i.e., the algorithm name), the default configuration is 0x07, and the optional configuration is 0x01, etc.

[0054] Table 2

[0055]

[0056] Table 2 is a table showing an example of a cryptographic algorithm.

[0057] For example, Encrypt and Decrypt are used to represent the encryption algorithm and the decryption algorithm in the cryptographic algorithm.

[0058] Specifically, if the parameter is 0x05, the algorithms to be enabled are the 3DES algorithm and the SM4 algorithm. The current count value of the counter is divided by the remainder (the number of enabled is 2) to obtain 0 or 1 to further determine the algorithm to be enabled. When the remainder is 0, it corresponds to the rightmost SM4 in Table 2, and when the remainder is 1, it corresponds to 3DES in Table 2.

[0059] For example, the hash algorithm identifier (see Table 3 below for details), i.e., the algorithm name, is configured by default as 0x07 and optionally as 0x01.

[0060] Table 3

[0061]

[0062] Table 3 is a table showing an example of hash algorithms.

[0063] For example, the hash algorithm is denoted by HASH.

[0064] Specifically, if the parameter is 0x07, three algorithms are to be enabled. The current count value of the counter is divided by the number of algorithms to be enabled (3) to obtain a remainder of 0, 1 or 2, to further determine the algorithm to be enabled. When the remainder is 0, it corresponds to the rightmost SM3 in Table 3, when the remainder is 1, it corresponds to SHA256 in Table 3, and when the remainder is 2, it corresponds to SHA384 in Table 3.

[0065] For asymmetric signature algorithms, for example, the asymmetric signature algorithm identifier, i.e., the algorithm name, is configured by default as 0x01 and optionally as 0x07.

[0066] Table 4

[0067]

[0068] Table 4 is a table showing an example of asymmetric signature algorithms.

[0069] For example, the asymmetric signature algorithm is denoted by SIGN.

[0070] Specifically, if the parameter is 0x03, RSASSA-PSS and SM2 are to be enabled. The current count value of the counter is divided by the number of algorithms to be enabled (2) to obtain a remainder of 0 or 1, to further determine the algorithm to be enabled. When the remainder is 0, it corresponds to the rightmost SM2 in Table 4, and when the remainder is 1, it corresponds to RSASSA-PSS in Table 4.

[0071] For parameter identifiers, the parameter identifier (i.e., the parameter name, see Table 5 below for details) is configured by default as 0x03 and optionally as 0x1F.

[0072] Table 5

[0073]

[0074] Table 5 is a table showing an example of parameters participating in the operation.

[0075] It should be noted that, on the side of the smart card application, the initial value of the counter is, for example, counter = 0x0000, and the maximum value is 0x7FFF, which needs to be reset when the maximum value is reached, and the reset value is 0x0000. The counter value increases by one each time the operation is performed.

[0076] The key Id = (counter modulo D) is selected from the preset D-group key. The D-group key IDs are 0, 1,..., D-1, respectively. Specifically, the authentication mode is selected according to the network state and the request of the application side, and the online authentication is preferred. When the network state is offline or the network signal is poor (specifically, the network service provided by the operator is not provided or the network signal provided by the operator is poor, for example, through a wireless local area network, a hot spot, and the like), the offline authentication is selected.

[0077] Next, the hash value conversion is performed.

[0078] Specifically, the parameter corresponding to the hash algorithm is 0x07, and three hash algorithms can be enabled. Specifically, the same principle as expression (1) is used, that is, the current value of the counter (that is, counter) is divided by the number of enabled hash algorithms (for example, three), and the remainder is obtained. The remainder is 0, 1, or 2. The remainder is 0, which corresponds to SM3. The remainder is 1, which corresponds to SHA256. The remainder is 2, which corresponds to SHA384.

[0079] The hash value corresponding to the offline parameter PARA is calculated using the hash algorithm determined according to the current value of the counter:

[0080] dat1 = HASH(PARA 离线 ).

[0081] Wherein, dat1 represents the hash value corresponding to PARA 离线 calculated using the hash algorithm HASH determined according to the current value of the counter; PARA 离线 represents the offline parameter generated by the current dynamic password acquisition request, wherein PARA 离线 = ICCID + Counter, ICCID represents the serial number of the smart card corresponding to the current dynamic password acquisition request, and Counter represents the current value of the counter.

[0082] For example, PARA 离线 = ICCID + Counter = 8986012281100043644F + 0000

[0083] dat1 = HASH(PARA 离线 )

[0084] = SM3 (8986012281100043644F0000)

[0085] = FBCB4703D068FE9853F45AE824AC458396259E83DA114D967AD31EAB50CD375F.

[0086] For the determination of the signature algorithm, if the parameter corresponding to the signature algorithm is 0x03, RSASSA-PSS and SM2 can be enabled. Specifically, the counter is divided by the number of enabled signature algorithms, and the remainder is 0 or 1. The specific algorithm is determined according to the obtained remainder. For example, the obtained remainder is 0, and the corresponding signature algorithm is SM2. The obtained remainder is 1, and the corresponding signature algorithm is RSASSA-PSS.

[0087] In the first embodiment, when the applied authentication password is an offline authentication password, an offline parameter is generated. The offline parameter includes the serial number of the smart card and the current value of the counter. For example, PARA 离线 = ICCID + counter, wherein PARA 离线 represents the offline parameter corresponding to the current dynamic password acquisition request, ICCID represents the serial number of the smart card corresponding to the current dynamic password acquisition request; counter represents the current value of the counter corresponding to the current dynamic password acquisition request.

[0088] For example, all parameter items are combined to obtain the following offline parameter table: 070701040000010103000000, a total of 12 bytes, the information of the parameter item, the default value, and the current value of the related algorithm for generating the offline parameter, and the like, please refer to Table 1 above.

[0089] The smart card application selects a password algorithm Encrypt according to the counter and the related parameter (such as the polling position parameter), and then selects a quantum key according to the current value of the counter to perform calculation and obtain an encryption result:

[0090] dat2 = Encrypt (key 离线 , dat1)

[0091] , dat1) 离线represents a quantum key selected according to the current value of the counter in offline authentication; dat1 represents a hash value corresponding to PARA 离线 calculated by using a hash algorithm HASH determined according to the current value of the counter. 离线 represents an offline parameter generated by the current dynamic password obtaining request.

[0092] According to the determined interception algorithm (for example, CUT), the decimal OTP password is intercepted. OTP = CUT(dat2).

[0093] The dynamic password, that is, the one-time password (or OTP password), is calculated by using the following expression:

[0094] OTP 离线 = CUT(Encrypt(key 离线 , HASH(PARA 离线 )))

[0095] wherein OTP 离线 represents the one-time password corresponding to the current applied authentication password; CUT() represents an interception algorithm for intercepting the data after encryption calculation to obtain the one-time password corresponding to the current applied authentication password, and the specified number of byte data at the specified position is intercepted, the specified position includes the byte position interval from the first bit to the nth bit, and the specified number includes 4 bytes to 8 bytes, etc.; Encrypt() represents that the hash value obtained by performing hash value calculation on the generated PARA 离线 is subjected to encryption calculation, and the encryption calculation refers to encryption calculation by using the quantum key selected according to the current value of the counter in offline authentication; key 离线 represents the quantum key selected according to the current value of the counter in offline authentication; HASH(PARA 离线 ) represents a hash value corresponding to PARA 离线 calculated by using a hash algorithm HASH determined according to the current value of the counter. 离线 represents an offline parameter generated by the current dynamic password obtaining request.

[0096] Through the above calculation, a four-bit to eight-bit one-time password is obtained.

[0097] Specifically, a four-bit dynamic password, that is, a one-time password (that is, an OTP password or OTP 离线 ), such as the decimal number 3456, is obtained.

[0098] Further, the generated dynamic password is returned to the current user.

[0099] For example, using the truncation algorithm to the data "FBCB4703D068FE9853F45AE824AC4583962

[0100] 59E83DA114D967AD31EAB50CD375F", the truncation algorithm position parameter is 0x00000101, the ninth and first data from the left are obtained, i.e., 96 and 5F, and further 0x965F = 38495 is obtained, and the last four bits are truncated from the end position, and 8495 is obtained.

[0101] For example, the parameters for generating OTP data by truncating a specified byte (e.g., 32 bytes) of data.

[0102] If the 32-byte data before calculation is "0xE9180E184894DAA58BD91E7CF3D76C

[0103] F399941C39C2E3679BCAB624CE233454F1", the bytes in the position corresponding to 0x00000101 of the 32-bit are truncated, i.e., 0x9BF1 is converted to decimal "39921". When there is a space in front of or behind the byte data, 0 or 1 is used for padding. For example, after padding, the above data obtains six digits, i.e., "039921". The last four digits are truncated to obtain the final result "9921".

[0104] For example, 0x00000101 can be adjusted to 0x00000103, 0x9B54F1 is obtained, and the last six bits are truncated from the end position, and the decimal number "179825" is converted.

[0105] In the second embodiment, when the applied authentication password is an online authentication password, the smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, and then truncates to generate a dynamic password according to the truncation algorithm, and returns the generated dynamic password to the current terminal application and the current user.

[0106] When the applied authentication password is an online authentication password, the terminal application initiates an online authentication password request to the smart card application, carrying timestamp information and user input parameters. The smart card application uses the selected password algorithm and other parameter items to perform hash value conversion and encryption calculation, and then truncates to generate a dynamic password according to the truncation algorithm (corresponding to Figure 2 "4. Calculate dynamic password" in the specification), and returns the calculated dynamic password to the terminal application (corresponding to Figure 2The smart card serial number, the generated dynamic password, and the encrypted packaged data are transmitted to the server of the current terminal application (corresponding to Figure 2 The related data are uploaded, and a data verification request is uploaded, and then transmitted to the operator server of the operator service end (corresponding to Figure 2 The data verification request is uploaded, and then transmitted to the operator server of the operator service end (corresponding to Figure 2 The data verification request is uploaded, and then transmitted to the operator server of the operator service end (corresponding to Figure 2 The data verification result is returned to the terminal application (corresponding to Figure 2 The data verification result is returned to the terminal application (corresponding to Figure 3 The data verification result is returned to the terminal application (corresponding to Figure 4 The data verification result is returned to the terminal application (corresponding to

[0107] The online parameter (specifically, the data plaintext) and the data signature are encrypted by using the quantum key, and the packaged data are transmitted to the server of the current terminal application.

[0108] As shown in FIG. 5, for online authentication (when the applied authentication password is an online authentication password), the following steps are specifically performed: Figure 4

[0109] Step S201: According to the terminal application, the current use scenario is judged, and the current user input is selected as the user input parameter. When the user input parameter is not received, a random number is used as the user input parameter.

[0110] Step S202: The terminal application carries the timestamp information and the user input parameter and transmits them to the smart card application.

[0111] Step S203: The smart card application splices the smart card serial number ICCID, the counter, the self-generated random number, the timestamp information, and the user input parameter to generate the online parameter corresponding to the current dynamic password acquisition request.

[0112] Step S204: The dynamic password, that is, the one-time password (or OTP password), is calculated.

[0113] Step S205: The first private key of the smart card application is used to sign the online parameter to obtain a signature value (for example, SignDat).

[0114] ​Step S206: The OTP package data is calculated by using the quantum key, the online parameter and its signature value according to the following expression.

[0115] Step S207: The calculated dynamic password and the OTP package data are returned to the user, wherein the generated OTP 在线 and the OTP package data are generated simultaneously in the smart card application.

[0116] In a specific embodiment, the online parameter corresponding to the current dynamic password acquisition request is generated according to the current dynamic password acquisition request and the current value of the counter corresponding to the current dynamic password acquisition request according to the following expression:

[0117] PARA 在线 = ICCID+Counter+Random+Input+Timestamp

[0118] wherein PARA 在线 represents the online parameter corresponding to the current dynamic password acquisition request generated according to the current dynamic password acquisition request and the current value of the counter corresponding to the current dynamic password acquisition request; ICCID represents the smart card serial number of the smart card corresponding to the current dynamic password acquisition request; Counter represents the current value of the counter corresponding to the current dynamic password acquisition request; Random represents a random number randomly generated by the smart card itself, for example, a random number of 4-10 digits, including numbers, letters, symbols, etc.; Input represents the input data of the current user; and Timestamp represents the current timestamp returned by the terminal application or service system of the smart card application to the smart card when the applied authentication password is an online authentication password, that is, when the smart card application receives an online authentication password acquisition request (corresponding to an online authentication request), the current timestamp (for example, represented by Unix seconds) transmitted or returned by the terminal application or service system of the smart card application to the smart card.

[0119] For example, all parameter items are combined to obtain the following online parameter table: 07070104000001011F000000, a total of twelve bytes.

[0120] Specifically, for example, the smart card application can pop up a dialog box to request the current user to input the parameter (i.e., input, for example, 4-8 digits of numbers and letters). When no user input data is input, the input is replaced by a specified number of 0 or 1 (for example, 0000).

[0121] For the generation of the online parameter, the smart card application selects an asymmetric algorithm (for example, SIGN) according to the current value of the counter (i.e., counter), calculates PARA在线 SignDat represents the signature value of PARA 在线 .

[0122] The smart card application packs and encrypts the data, specifically selects a cryptographic algorithm (e.g., Encrypt) according to the current value of the counter and the related parameters (e.g., polling position parameters), selects a quantum secret key according to the current value of the counter, and uses the following expression to perform an encryption calculation on the online parameters and their signature values to obtain the OTP packed data.

[0123] OTP packed data = Encrypt (key 在线 , PARA 在线 + SignDat)

[0124] wherein OTP packed data represents the OTP packed data obtained by selecting a cryptographic algorithm Encrypt according to the current value of the counter and the related parameters (e.g., polling position parameters), and performing an encryption calculation on the online parameters and their signature values according to the current value of the counter; PARA 在线 represents the online parameters generated according to the current dynamic password acquisition request and the current value of the counter corresponding to the current dynamic password acquisition request; SignDat represents the signature value of PARA 在线 calculated using the first private key (e.g., SimSM2pri) of the smart card application; and key 在线 represents the quantum secret key selected according to the current value of the counter in the online authentication.

[0125] For the applied authentication password being an online authentication password, the method further includes generating a dynamic password, i.e., a one-time password (or OTP password).

[0126] The smart card application selects a hash algorithm HASH according to the current value of the counter and the related parameters (e.g., polling position parameters), and calculates the hash value of PARA 在线 generated in step S201, specifically as follows:

[0127] dat1' = HASH (PARA 在线 )

[0128] wherein dat1' represents the hash value of PARA 在线 calculated by selecting a hash algorithm HASH according to the current value of the counter and the related parameters (e.g., polling position parameters); and PARA 在线 represents the online parameters generated according to the current dynamic password acquisition request and the current value of the counter corresponding to the current dynamic password acquisition request.

[0129] Next, the smart card application selects the Encrypt cryptographic algorithm based on the current value of the counter and relevant parameters (such as polling position parameters), and then selects the quantum key based on the current value of the counter (i.e., the current count value) for PARA. 在线 The hash value is used for encrypted calculation:

[0130] dat2'=Encrypt(key 在线 ,dat1')

[0131] Where dat2' represents selecting a cryptographic algorithm based on the current value of the counter and relevant parameters (such as polling position parameters), and then selecting a quantum key based on the current value of the counter for PARA. 在线 The encrypted data is obtained by encrypting the hash value; Encrypt() indicates that the cryptographic algorithm is selected based on the current value of the counter and related parameters (such as the polling position parameter); key 在线 This indicates that the quantum key is selected based on the current value of the counter during online authentication; 'dat1' indicates that the hash algorithm HASH is selected based on the current value of the counter and related parameters (such as polling position parameters), and the calculated PARA... 在线 hash value; PARA 在线 This indicates that the online parameters corresponding to the current dynamic password retrieval request are generated based on the current dynamic password retrieval request and the current value of its corresponding counter.

[0132] Next, the smart card application selects the interception algorithm CUT based on the current value of the counter and relevant parameters (such as polling position parameters) to intercept the dynamic password, i.e., the one-time password.

[0133] The following expression is used to represent:

[0134] OTP 在线 = CUT(Encrypt(key) 在线 HASH (PARA) 在线 )))

[0135] Among them, OTP 在线 This indicates the one-time password corresponding to the currently requested authentication password; CUT() represents a truncation algorithm that truncates the encrypted data to obtain the one-time password corresponding to the currently requested authentication password. Specifically, it truncates a specified number of bytes at a specified position, which can be from the first byte to a specified number of bytes, and the specified number can be 4 to 8 bytes, etc.; Encrypt() represents the algorithm that will truncate the generated PARA... 在线 The hash value obtained from hash value calculation is then encrypted using the key. 在线 This indicates that the quantum key is selected based on the current value of the counter during online authentication; HASH (PARA)离线 represents the online parameter generated by the current dynamic password acquisition request. In addition, the quantum key is also used in the calculation of the OTP packaging data. 在线 represents the corresponding hash value of PARA 在线 represents the online parameter generated by the current dynamic password acquisition request. In addition, the quantum key is also used in the calculation of the OTP packaging data.

[0136] Specifically, the smart card application returns the generated OTP 在线 and the OTP packaging data to the user, wherein the generated OTP 在线 and the OTP packaging data are generated simultaneously in the smart card application.

[0137] It should be noted that the above is described as an optional example and cannot be understood as a limitation of the present application.

[0138] In the third embodiment, the smart card application selects each password algorithm using the current value of the counter, and determines the position parameter corresponding to each password algorithm through dynamic polling, wherein the dynamic polling introduces a security level, and the security level includes offline verification code, take-out verification code, office verification code, financial verification code, government verification code, to-be-expanded item, and the corresponding security level of each.

[0139] Specifically, the offline verification code preferably uses the SM1 algorithm to improve security. For example, the SM1 algorithm exists in the chip of the smart card in the form of IP.

[0140] For algorithm selection corresponding to the security level, refer to Table 6 below.

[0141] Table 6

[0142]

[0143] Table 6 is a table showing an example of algorithms corresponding to the security level.

[0144] Table 7

[0145]

[0146] Table 7 is a table showing an example of a summary of related algorithms.

[0147] For increasing the security level, the following expression is used to calculate the online parameter:

[0148] PARA’ 在线 = ICCID+Counter+Random+Input+Timestamp+SecureLevel.

[0149] For the determination of the security level (i.e. SecureLevel), it is determined whether to upgrade.

[0150] When the user input parameter (i.e. Input) is detected, and the identification corresponding to the security level is the first identification (e.g. 00) or the second identification (e.g. 01), the current security level is kept unchanged.

[0151] When the user input parameter (i.e. Input) is detected, and the identification corresponding to the security level is greater than the second identification (e.g. 01), the user input is subjected to security detection, and when it is determined to be a risky input, the current security level is automatically upgraded, i.e. increased by one. Specifically, when the current security level is increased to the maximum value (corresponding to the identification 05), the corresponding security level is automatically determined. The security detection includes whether the input length of the user input is greater than a specified number of bits, and whether the user input contains numbers, letters, and symbols. The specified number of bits is five to eight, preferably six.

[0152] For the security level, the transmitted data is increased in security level, and specifically, the terminal application transmits the user input, the timestamp information, and the optional security level (i.e. Input+Timestamp+SecureLevel) to the smart card application. For different security levels, specifically including offline type verification code, takeout type verification code, office type verification code, financial type verification code, government type verification code, and to-be-expanded item, which specifically correspond to the identifications 00, 01, 02, 03, 04, and 05, respectively.

[0153] The to-be-enabled algorithm or the algorithm to be used is determined by dynamic polling, and the combination of the multiple algorithms determined dynamically is used, which can greatly increase the cracking difficulty and thus improve the security of data transmission.

[0154] It should be noted that in the present embodiment, the calculation method of the dynamic password is substantially the same as that in the second embodiment, and only PARA 在线 is replaced by PARA' 在线 Therefore, the description of the same part is omitted.

[0155] In yet another embodiment, under the authorization of the user and the terminal application, the operator server can perform big data model training. There are two training directions: on the one hand, under certain conditions, the optimal algorithm combination is predicted; on the other hand, under the condition of existing condition expansion (e.g. expanding the algorithms in Table 7), a more optimal algorithm combination is found. When the prediction model reaches a certain accuracy value, the algorithm model and the smart card application can be updated to the user's smart card periodically. This makes the entire dynamic password system efficient and secure, and the user can use it conveniently and confidently.

[0156] For the case that the data model needs to be updated in time, a dynamic secret key SDK can be embedded in the terminal application, which is a closed source code library provided by the operator for the terminal application to provide dynamic password service. The dynamic secret key SDK plays the role of communication between the smart card application and the terminal application, and receives the updated model from the operator. It can also accurately predict the algorithm combination and security level required by the user in the current time period. The SDK agent terminal application provides dynamic password service for the user and provides a security verification display page. The SDK agent terminal application interacts with the smart card application and uses smart card commands for interaction.

[0157] The big data model training can be based on the verification type, the terminal application type (such as the package name of the terminal application and the specific scene application direction of the terminal application), the smart card serial number corresponding to the mobile phone number, the counter value, the user input parameter, the timestamp information, the security level, and the polling position parameter to label the algorithm combination (a set of multiple combined algorithms), establish a training data set, and let the neural network model learn the association between the above data and the algorithm combination. At the same time, new algorithms can be added during model training and filled into the RFU (reserved part) in the table to find a better algorithm combination through continuous deduction.

[0158] When the model accuracy reaches 95% or more, the trained prediction model in the algorithm combination is added to the smart card application in real time, and is updated to the user's smart card through remote update.

[0159] Further, an example is as follows:

[0160] For example, when the user initiates a request for obtaining a dynamic password at 11 am without inputting a user input parameter in the terminal application, the dynamic secret key SDK outputs the best algorithm combination.

[0161] For example, when the user initiates a request for obtaining a dynamic password at 9 am in a financial application after inputting a verification code, the dynamic secret key SDK outputs the best algorithm combination and the security level.

[0162] For example, when the timestamp is at lunch time and dinner time at night, the weight of the takeout algorithm in the algorithm model is increased.

[0163] It should be noted that the above is only an optional example for illustration and cannot be understood as a limitation of the present application.

[0164] Next, in step S103, after the terminal application receives the dynamic password input by the current user, the terminal application transmits the smart card serial number, the generated dynamic password, and related data to the server of the current terminal application, and then to the operator server.

[0165] For the offline authentication process, after the terminal application receives the dynamic password, the terminal application transmits the smart card serial number (for example, represented by ICCID), the generated dynamic password to the server of the terminal application.

[0166] For the online authentication process, after the terminal application receives the dynamic password, the terminal application transmits the smart card serial number (for example, represented by ICCID), the generated dynamic password, and the packaged data encrypted by the quantum key to the server of the terminal application. The smart card application packages the data encrypted by the quantum key to obtain the packaged data.

[0167] Specifically, the user inputs the mobile phone number and the received dynamic password. After the smart card application receives the dynamic password input by the current user, the smart card application transmits the smart card serial number corresponding to the mobile phone number, the generated dynamic password, and the packaged data (i.e., OTP packaged data, for offline authentication, the OTP packaged data is the OTP password; for online authentication, the OTP packaged data includes the OTP password and the smart card packaged data, and the smart card packaged data includes the parameters related to the generation of the OTP and the signature data of the smart card) encrypted by the quantum key to the terminal application (or service system) and uploads to the server of the terminal application (or service system) through the terminal application (or service system).

[0168] For example, the user opens the mobile terminal and views the OTP password through the APP or STK (for example, supports PIN verification and other biological verification, and can select offline authentication in the case of no network or poor signal). The user fills in the OTP password (or fills in the mobile phone number and the OTP password) on the PC or mobile phone, and clicks to log in for verification. The mobile phone number can be obtained through an interface on the PC or mobile phone.

[0169] It should be noted that the above description is an optional example and should not be construed as a limitation of the present application.

[0170] Next, in step S104, when receiving the data verification request from the operator service end, the authentication type is automatically identified, the dynamic password is calculated for data verification, and the data verification result is returned to the service end of the service system. The authentication type includes offline authentication and online authentication.

[0171] Specifically, the server of the terminal application transmits the data verification request to the operator service end. The operator service end automatically identifies the authentication type, calculates the dynamic password for data verification, and returns the data verification result. The authentication type includes online authentication (i.e., the online authentication process) and offline authentication (i.e., the offline authentication process).

[0172] In one embodiment, the server of the terminal application (or service system) sends a data verification request (containing the OTP packaged data obtained in step S103, the smart card serial number corresponding to the mobile phone number, and the OTP password) to the operator server (i.e., the operator server), and when the data verification request is received from the operator server, the authentication type is automatically identified, for example, offline authentication. The operator server independently calculates the OTP password and compares the calculated OTP password with the received OTP password.

[0173] When the calculated OTP password is the same as the received OTP password, it indicates that the verification is passed, and the data verification result is returned to the server of the terminal application (or service system), and then transmitted to the terminal application (or service system) through the server of the terminal application (or service system), and further, the corresponding interface is jumped to according to the data verification result.

[0174] For example, when the data verification is successful, the relevant main interface is entered, and the user data is buffered. When the data verification fails, the retry interface or the login failure interface is entered.

[0175] In another embodiment, the server of the terminal application (or service system) sends a data verification request (containing the OTP packaged data obtained in step S103, the smart card serial number corresponding to the mobile phone number, and the OTP password and smart card packaged data, and the smart card packaged data containing the parameters related to the generation of the OTP and the signature data of the smart card) to the operator server (i.e., the operator server), and when the data verification request is received from the operator server, the authentication type is automatically identified, for example, online authentication. The operator server independently calculates the OTP password and compares the calculated OTP password with the OTP password in the received OTP packaged data.

[0176] When the calculated OTP password is the same as the OTP password in the received OTP packaged data, it indicates that the verification is passed, and the data verification result is returned to the server of the terminal application (or service system), and then transmitted to the terminal application (or service system) through the server of the terminal application (or service system), and further, the corresponding interface is jumped to according to the data verification result.

[0177] For example, when the data verification is successful, the relevant main interface is entered, and the user data is buffered, i.e., the login verification is successful. When the data verification fails, the retry interface or the login failure interface is entered, i.e., the login verification fails.

[0178] It should be noted that in the present application, the smart card and the operator server respectively generate independent OTP passwords to complete data verification.

[0179] Optionally, the operator server can query the ICCID (smart card serial number) and configuration parameters according to the user's mobile phone number.

[0180] Preferably, when the operator server receives the data verification request, it first verifies whether the mobile phone number is in the stop state or whether it is in the violation state. If it is in the stop state or in the violation state, the data verification is terminated, and the terminal application (or service system) server is returned with a verification failure and a failure reason.

[0181] When the data verification fails, the operator server simultaneously issues a reset counter (i.e., counter) command. Other parameters can be optionally reset. The reset interval needs to be greater than 10 minutes to prevent repeated attacks.

[0182] In an optional implementation, the operator server determines the authentication type according to the interception reserved length (e.g., four digits) in the interception algorithm and the OTP packed data length. Specifically, the operator server determines whether the interception reserved length (e.g., four digits) and the OTP packed data length in the interception algorithm calculated by itself match the interception reserved length and the OTP packed data length corresponding to the received OTP password. When it is determined that the interception reserved length (e.g., four digits) and the OTP packed data length in the interception algorithm calculated by itself match the interception reserved length and the OTP packed data length corresponding to the received OTP password, it is determined to be online authentication.

[0183] When it is determined that the interception reserved length (e.g., four digits) and the OTP packed data length in the interception algorithm calculated by itself do not match the interception reserved length and the OTP packed data length corresponding to the received OTP password, it is determined to be offline authentication.

[0184] If it is online authentication, the operator server selects an encryption algorithm Encrypt according to the current value of the counter and related parameters (LiYun polling position parameters), and then selects a quantum key according to the current value of the counter.

[0185] The following expression is used to calculate the decrypted data:

[0186] dat3 = decrypt (key 在线 , OTP packed data)

[0187] wherein dat3 represents the decrypted PARA 在线 , PARA 在线 = ICCID + Counter + Input + Timestamp + Random + SignDat, wherein PARA 在线The online parameter corresponding to the current dynamic password obtaining request generated according to the current dynamic password obtaining request and the current value of the corresponding counter is represented; the ICCID represents the smart card serial number of the smart card corresponding to the current dynamic password obtaining request; the Input represents the input data of the current user; the Timestamp represents the time stamp returned by the terminal application or service system of the smart card application to the smart card when the applied authentication password is an online authentication password, that is, the time stamp received by the smart card application when the online authentication password obtaining request is received, that is, the current Unix second number represented by the terminal application or service system of the smart card application transmitted to the smart card; the Random represents a random number randomly generated by the smart card itself, for example, a random number of 4-10 digits, including numbers, letters, symbols, etc.; and the Counter represents the current value of the counter corresponding to the current dynamic password obtaining request.

[0188] For example, the data is decrypted using the Decrypt algorithm to obtain the plaintext of the following data: ICCID+Counter+Random+Input+Timestamp+SignDat.

[0189] The data verification includes verifying the ICCID, verifying the Counter, and checking whether the time stamp Timestamp is within a 10-minute time window. The SignDat signature is also verified using the first public key (for example, SimSM2pub) pre-prepared by the smart card.

[0190] Optionally, if the smart card is in a shutdown or other violation state, the one-time password service is suspended according to the relevant rules. The operator server returns the smart card state abnormality verification result to the server of the terminal application.

[0191] It should be noted that in the present example, the operator server generates a set of asymmetric keys for the one-time password service for the user, specifically a second public key (for example, MNOSM2pub) and a second private key (for example, MNOSM2pri). The operator server saves the second public key and the second private key, and distributes the generated second public key to the smart card application. The above is only described as an optional example and cannot be understood as a limitation of the present application.

[0192] Compared with the prior art, when the front end of the service system receives a dynamic password acquisition request, the front end of the service system applies for the following authentication passwords according to network status and security requirements: an online authentication password and an offline authentication password; the smart card application generates dynamic passwords corresponding to the offline authentication password request or the online authentication password request in different ways by using selected password algorithms and parameter items, performing hash value conversion and encryption calculation, and intercepting according to an intercepting algorithm, and returns the generated dynamic passwords to the current terminal application and the current user; after the current terminal application receives the dynamic passwords, the smart card serial number, the generated dynamic passwords, and packaged data encrypted by using a quantum key are transmitted to the server of the current terminal application, and then transmitted to the operator service end; when the operator service end receives a data verification request, the authentication type is automatically identified, dynamic password calculation is performed for data verification, and a data verification result is returned to the service end of the service system. Wherein, the smart card and the operator service end generate dynamic passwords according to the same algorithm and related parameters, the user fills in parameters in the smart card application, the smart card application transmits the parameters to the server of the smart card application, and then transmits the parameters to the operator service end through the server of the smart card application for data verification, the operator service end can independently generate dynamic passwords for comparison and verification, thereby completing data verification, realizing offline authentication, and effectively solving the problem that the one-key login cannot be authenticated when there is no network provided by the operator.

[0193] In addition, the quantum key improves the transmission security of system data and increases the cracking difficulty.

[0194] In addition, the application can realize flexible verification mode and OTP generation mode, support offline authentication, as a supplement to the operator one-key login scheme, improve the verification success rate, and the login verification mode of the application can improve the security level and optimize the one-time password generation method.

[0195] Embodiment 2

[0196] The following is an embodiment of the system of the application, which can be used to execute the method embodiment of the application. For details not disclosed in the system embodiment of the application, please refer to the method embodiment of the application.

[0197] Figure 4 is a structural schematic diagram of an example of a login verification system based on dynamic passwords according to the application. The following will be described with reference to Figure 1 The login verification system 400 will be described below, which executes the login verification system method described in embodiment 1 of the application.

[0198] The login verification system 400 includes a request processing module 410, a calculation processing module 420, a data transmission module 430, and a data verification module 440.

[0199] In one specific implementation, the request processing module 410 is used to, when the front end of the service system receives a dynamic password retrieval request, apply to the smart card application for the following authentication passwords based on network status and security requirements: online authentication password and offline authentication password. The calculation processing module 420 is used by the smart card application to perform hash value conversion and encryption calculation using the selected password algorithm and parameters, truncate the password according to the truncation algorithm, generate a dynamic password corresponding to the offline or online authentication password request in different ways, and return the generated dynamic password to the current terminal application and the current user. The data transmission module 430 is used to, after the current terminal application receives the dynamic password, transmit the smart card serial number, the generated dynamic password, and related data to the server of the current terminal application, and then transmit it to the operator's server in the smart card application. The data verification module 440 is used to, when the operator's server receives a data verification request, automatically identify the authentication type, perform dynamic password calculation for data verification, and return the data verification result to the server of the service system. The authentication types include offline authentication and online authentication.

[0200] According to the optional implementation method, when the requested authentication password is an offline authentication password, the smart card application uses the password algorithm and parameter items selected based on the counter to perform hash value conversion and encryption calculation, and then uses the interception algorithm to intercept to generate a dynamic password, and returns the generated dynamic password to the current user.

[0201] Calculate the dynamic password, also known as a one-time password or OTP password, using the following expression:

[0202] OTP 离线 = CUT(Encrypt(key) 离线 HASH (PARA) 离线 )))

[0203] Among them, OTP 离线 This indicates the offline one-time authentication password corresponding to the currently requested authentication password; CUT() represents the truncation algorithm for the encrypted data to obtain the one-time password corresponding to the currently requested authentication password, specifically truncating a specified number of bytes at a specified position, where the specified position includes the byte position or byte position range, and the specified number includes 4 to 8 bytes; Encrypt() represents the algorithm that will truncate the generated PARA... 离线 The hash value obtained from hash value calculation is then used for encryption calculation. This encryption calculation refers to performing encryption calculations using a quantum key selected based on the current value of a counter during offline authentication; key 离线 This represents the quantum key selected based on the current value of the counter during offline authentication; HASH (PARA)离线 represents the online parameter corresponding to the current dynamic password obtaining request determined by the hash algorithm HASH according to the current value of the counter. 离线 represents the hash value corresponding to PARA 离线 represents the offline parameter generated by the current dynamic password obtaining request.

[0204] The following expression is used to generate the offline parameter corresponding to the current dynamic password obtaining request according to the current dynamic password obtaining request and the current value of the counter corresponding thereto:

[0205] PARA 离线 = ICCID + Counter

[0206] wherein PARA 离线 represents the offline parameter corresponding to the current dynamic password obtaining request generated according to the current dynamic password obtaining request and the current value of the counter corresponding thereto; ICCID represents the smart card serial number of the smart card corresponding to the current dynamic password obtaining request; and Counter represents the current value of the counter corresponding to the current dynamic password obtaining request, which is increased by one after each calculation.

[0207] According to an optional embodiment, when the authentication password applied for is an online authentication password, the following steps are specifically executed:

[0208] Step S201: According to the terminal application, the current use scenario is judged, and the current user input is selected as the user input parameter, and when the user input parameter is not received, a random number is used as the user input parameter.

[0209] Step S202: The terminal application carries the timestamp information and the user input parameter to the smart card application.

[0210] Step S203: The smart card application splices the smart card serial number, the counter, the random number generated by itself, the timestamp information and the user input parameter to generate the online parameter corresponding to the current dynamic password obtaining request.

[0211] Step S204: The dynamic password, i.e. the one-time password or OTP password, is calculated.

[0212] Step S205: The first private key of the smart card application is used to sign the online parameter to obtain a signature value.

[0213] Step S206: The following expression is used to perform an encryption calculation on the online parameter and the signature value by using the quantum key to obtain the OTP packaged data:

[0214] OTP packaged data = Encrypt (key 在线 , PARA 在线 + SignDat)

[0215] wherein, OTP package data represents the OTP package data obtained by encrypting the online parameter and its signature value according to the current value of the counter and the related parameters, and then selecting a quantum key according to the current value of the counter, and selecting a cryptographic algorithm according to the current value of the counter; PARA 在线 represents generating the online parameter corresponding to the current dynamic password obtaining request according to the current dynamic password obtaining request and the current value of the counter corresponding thereto; SignDat represents the signature value of PARA 在线 calculated using the first private key of the smart card application; key 在线 represents the quantum key selected according to the current value of the counter in the online authentication.

[0216] Step S207: returning the calculated dynamic password and OTP package data to the user; wherein, the generated OTP 在线 and OTP package data are generated simultaneously in the smart card application.

[0217] According to an optional embodiment, the smart card application selects a truncation algorithm according to the current value of the counter and the related parameters, and truncates to obtain the dynamic password, i.e. the one-time password, which is expressed as follows:

[0218] OTP 在线 = CUT(Encrypt(key 在线 , HASH(PARA 在线 )))

[0219] wherein, OTP 在线 represents the one-time password corresponding to the currently applied authentication password; CUT() represents a truncation algorithm for truncating the data after the encryption calculation to obtain the one-time password corresponding to the currently applied authentication password, and the specific truncation is to specify the number of bytes of data at a specified position, and the specified position includes the byte position interval from the first bit to the nth bit, and the specified number includes 4-8 bytes; Encrypt() represents that the hash value obtained by performing the hash value calculation on the generated PARA 在线 is encrypted, and the encryption is specifically performed using the quantum key selected according to the current value of the counter; key 在线 represents the quantum key selected according to the current value of the counter in the online authentication; HASH(PARA 在线 ) represents calculating the hash value corresponding to PARA 在线 using the hash algorithm HASH determined according to the current value of the counter; PARA 在线 represents the online parameter generated by the current dynamic password obtaining request.

[0220] According to an optional embodiment, the following expression is used to generate the online parameter corresponding to the current dynamic password acquisition request according to the current dynamic password acquisition request and the current value of the corresponding counter:

[0221] PARA 在线 = ICCID + Counter + Random + Input + Timestamp

[0222] wherein PARA 在线 represents the online parameter corresponding to the current dynamic password acquisition request generated according to the current dynamic password acquisition request and the current value of the corresponding counter; ICCID represents the smart card serial number of the smart card corresponding to the current dynamic password acquisition request; Counter represents the current value of the counter corresponding to the current dynamic password acquisition request, which is increased by one after each calculation; Random represents a random number generated by the smart card itself, including numbers, letters and symbols; Input represents the user input parameter of the current user, and a random number is used as the user input parameter when no user input parameter is received; the terminal application uses a random number generated by itself to fill in as the user input parameter, and the random number includes numbers, letters and symbols; and Timestamp represents the current timestamp returned by the terminal application or the service system to the smart card application when the requested authentication password is an authentication password.

[0223] According to an optional embodiment, the smart card application selects each password algorithm using the current value of the counter and determines the position parameter corresponding to each password algorithm through dynamic polling, wherein the dynamic polling introduces a security level, and the security level includes offline verification code, take-out verification code, office verification code, financial verification code, government verification code, to-be-expanded item and the corresponding security level of each; when the user input parameter is detected and the identifier corresponding to the security level is the first identifier or the second identifier, the current security level remains unchanged; when the user input parameter is detected and the identifier corresponding to the security level is greater than the second identifier, the user input is detected for security, and when it is determined to be a risk input, the current security level is automatically upgraded, i.e., the current security level is increased by one, and the security detection includes whether the input length of the user input is greater than a specified number of digits, and whether the user input contains numbers, letters and symbols.

[0224] According to an optional embodiment, when the operator server receives a data verification request, the operator server automatically identifies the authentication type; when the operator server receives OTP packaged data, the operator server automatically calculates the OTP using the online authentication algorithm according to the automatically identified authentication type, i.e., the operator server independently calculates the OTP password, and compares the calculated OTP password with the received OTP password.

[0225] According to an optional embodiment, when the OTP password calculated by the operator server is the same as the received OTP password, it indicates that the data verification is passed, and the data verification result is returned to the server of the terminal application or service system, and then transmitted to the terminal application or service system through the server of the terminal application or service system, and further jumping to the corresponding interface according to the data verification result.

[0226] It should be noted that, since Figure 5 The dynamic password-based login verification method performed by the dynamic password-based login verification system of Figure 5 The dynamic password-based login verification method in the example of the dynamic password-based login verification system of

[0227] Compared with the prior art, in the present application, when the front end of the service system receives a dynamic password acquisition request, the front end of the service system applies for the following authentication passwords according to the network state and security requirements: online authentication password, offline authentication password; the smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, and intercepts according to the interception algorithm to generate dynamic passwords corresponding to the offline authentication password request or the online authentication password request in different ways, and returns the generated dynamic passwords to the current terminal application and the current user; after the current terminal application receives the dynamic password, the smart card serial number, the generated dynamic password, and the related data are transmitted to the server of the current terminal application, and then transmitted to the operator server; when the operator server receives the data verification request, it automatically identifies the authentication type, performs dynamic password calculation for data verification, and returns the data verification result to the server of the service system. Among them, the smart card and the operator server generate dynamic passwords according to the same algorithm and related parameters, the user fills in the parameters in the smart card application, the smart card application transmits the parameters to the server of the smart card application, and then transmits the parameters to the operator server through the server of the smart card application for data verification. The operator server can independently generate dynamic passwords for comparison and verification, thereby completing data verification, realizing offline authentication, and effectively solving the problem that "one-click login" cannot be authenticated when there is no network provided by the operator.

[0228] In addition, the use of quantum keys improves the transmission security of system data and increases the difficulty of cracking.

[0229] In addition, the present application can realize flexible verification mode and OTP generation mode, support offline authentication, as a supplement to the operator "one-click login" scheme, improve the verification success rate, and the login verification mode of the present application can improve the security level and optimize the one-time password generation method.

[0230] Figure 5 is a structural schematic diagram of an electronic equipment embodiment according to the present application.

[0231] As Figure 6 shown, the electronic device is in the form of a general computing device. The processor can be one or multiple and work cooperatively. The present application does not exclude distributed processing, i.e. the processor can be dispersed in different physical devices. The electronic device of the present application is not limited to a single physical device, but can also be the sum of multiple physical devices.

[0232] The memory stores computer executable programs, usually machine readable codes. The computer readable programs can be executed by the processor to enable the electronic device to perform the method of the present application, or at least part of the steps in the method.

[0233] The memory includes volatile memory, such as random access memory (RAM) and / or cache memory, and / or non-volatile memory, such as read only memory (ROM).

[0234] Optionally, the electronic device further comprises an I / O interface for data exchange between the electronic device and external devices. The I / O interface can be one or more of several types of bus structures, including memory bus or memory bus controller, peripheral bus, graphics acceleration port, processing unit, or local bus using any of the bus structures.

[0235] It should be understood that ​ The electronic device shown is only an example of the present application, and the electronic device of the present application can also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons and keyboards. As long as the electronic device can execute the computer readable programs in the memory to implement the method of the present application or at least part of the steps of the method, it can be considered as an electronic device covered by the present application.

[0236] From the above description of the embodiments, those skilled in the art will readily understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, as ​ shown, the technical solutions according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or network, and includes a number of commands to make a computing device (which can be a personal computer, server, or network device, etc.) execute the above method according to the embodiments of the present application.

[0237] The software product can employ any combination of one or more readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0238] The computer readable storage medium can include a data signal transported over a carrier wave and can be baseband or propagated along with carriers. The propagated carrier can take any suitable form, including but not limited to electro-magnetic, optical, or any suitable combination thereof. A computer readable storage medium can be any medium (tangible or non-tangible) that can store data for use by or in connection with the computer system or device. The program code embodied on the computer readable storage medium can be transmitted using any carrier wave appropriate to the communication context, including but not limited to wireless, wire line, optical, radio frequency (RF), or any suitable combination thereof.

[0239] The program code can be executed by one or more programmable processors, which can be implemented as one or more microprocessors, microcontrollers, digital signal processors, application specific integrated circuits, field programmable gate arrays, processors of embedded systems, or the like. The program code can be downloaded from an external source, such as a website, via a network, such as the Internet, or via any other external source. The program code can be downloaded via a wired medium or a wireless medium. The program code can be downloaded from a removable storage medium, such as a CD-ROM, a DVD, a memory stick, or the like.

[0240] The computer readable medium described above can bear one or more programs, which, when executed by the device, cause the computer readable medium to implement the data interaction method of the present disclosure.

[0241] Those skilled in the art can understand that the above-mentioned modules can be distributed in the device according to the description of the embodiments, and can also be changed in one or more devices different from the embodiments. The modules of the above-mentioned embodiments can be combined into one module, or can be further split into a plurality of sub-modules.

[0242] Through the above description of the embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solutions according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a plurality of commands to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiments of the present application.

[0243] It should be noted that the above detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs.

[0244] In the above detailed description, reference is made to the accompanying drawings, which form a part hereof. In the drawings, similar symbols typically identify similar components, unless context dictates otherwise. The illustrative embodiments described in the detailed description, drawings, and claims are not meant to be limiting. Other embodiments can be used, and other changes can be made, without departing from the spirit or scope of the subject matter presented herein.

[0245] The above only describes the preferred embodiments of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A dynamic password-based login verification method, characterized in that, The application comprises the following steps: When the terminal application receives the dynamic password acquisition request, the terminal application applies the following authentication passwords to the smart card application according to the network state and security requirements: online authentication password and offline authentication password; The smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, and then intercepts the dynamic password corresponding to the offline authentication password request or the online authentication password request in different ways, and returns the generated dynamic password to the current terminal application and the current user; After the current terminal application receives the dynamic password, the smart card serial number, the generated dynamic password, and related data are transmitted to the server of the current terminal application, and then to the operator server; When the operator server receives the data verification request, the authentication type is automatically identified, the dynamic password is calculated for data verification, and the data verification result is returned to the server of the terminal application, and the authentication type includes offline authentication and online authentication; When the applied authentication password is the offline authentication password, the smart card application uses the selected password algorithm and parameter item based on the counter to perform hash value conversion and encryption calculation, and then intercepts the dynamic password to generate the dynamic password, and returns the generated dynamic password to the current user; When the applied authentication password is the online authentication password, the following steps are specifically performed: Step S201: According to the judgment of the terminal application on the current use scenario, the current user input is selected as the user input parameter, and when no user input parameter is received, a random number is used as the user input parameter; Step S202: The terminal application carries the timestamp information and the user input parameter to the smart card application; Step S203: The smart card application splices the smart card serial number, the counter, the randomly generated number, the timestamp information, and the user input parameter to generate the online parameter corresponding to the current dynamic password acquisition request; Step S204: Calculate the dynamic password OTP 在线 , i.e. one-time password or OTP password; Step S205: The first private key of the smart card application is used to sign the online parameter to obtain a signature value; Step S206: The quantum key is used to perform encryption calculation on the online parameter and the signature value to obtain OTP packaged data; Step S207: returning the generated OTP 在线 and OTP packed data to the user; wherein the generated OTP 在线 and OTP packed data are generated simultaneously in the smart card application; Further comprising: When the operator server receives the data verification request, the operator server automatically identifies the authentication type; When the operator server receives the OTP packaged data, the online authentication algorithm is automatically used to calculate the OTP according to the automatically identified authentication type, that is, the operator server independently calculates the OTP password, and compares the calculated OTP password with the received OTP password; When the calculated OTP password of the operator server is the same as the received OTP password, it indicates that the data verification is passed, and the data verification result is returned to the server of the terminal application, and then transmitted to the terminal application through the server of the terminal application, and further jumps to the corresponding interface according to the data verification result. 2.The dynamic password-based login verification method of claim 1, wherein, When the applied authentication password is the offline authentication password, the following expression is used to calculate the dynamic password, that is, the one-time password or OTP password: OTP 离线 = CUT(Encrypt(key 离线 ,HASH(PARA 离线 ))) wherein, OTP 离线 represents the one-time password corresponding to the current applied authentication password in offline authentication; CUT() represents a cutting algorithm for cutting the data after encryption calculation to obtain the one-time password corresponding to the current applied authentication password, and the cutting algorithm specifically cuts a specified number of byte data at a specified position, the specified position includes a byte position or a byte position interval of a specified byte, and the specified number includes 4-8 bytes; Encrypt() represents an encryption calculation on the hash value obtained by performing a hash value calculation on the generated PARA 离线 , and the encryption calculation specifically uses a quantum key selected according to the current value of the counter in offline authentication; key 离线 represents the quantum key selected according to the current value of the counter in offline authentication; HASH(PARA 离线 ) represents a hash value calculation on the generated PARA 离线 , and the hash value calculation specifically uses a hash algorithm HASH determined according to the current value of the counter to calculate the hash value corresponding to PARA 离线 ; PARA 离线 represents the offline parameter generated by the current dynamic password acquisition request. 3.The dynamic password-based login verification method of claim 1, wherein, The OTP packaged data is obtained by performing encryption calculation on the online parameter and the signature value, specifically: OTP packed data = Encrypt (key 在线 , PARA 在线 + SignDat) wherein OTPPackData represents the OTP packing data obtained by selecting a cryptographic algorithm according to the current value of the counter and the related parameters, and selecting a quantum key according to the current value of the counter, and performing an encryption calculation on the online parameter and the signature value thereof; PARA 在线 represents the online parameter corresponding to the current dynamic password acquisition request generated according to the current dynamic password acquisition request and the current value of the counter corresponding thereto; SignDat represents the signature value of PARA 在线 calculated using the first private key of the smart card application; key 在线 represents the quantum key selected according to the current value of the counter in the online authentication. 4.The dynamic password-based login verification method of claim 1, wherein, The dynamic password OTP is calculated using the following expression 在线 : OTP 在线 = CUT(Encrypt(key 在线 ,HASH(PARA 在线 ))) wherein OTP 在线 represents a one-time password corresponding to the currently applied authentication password; CUT() represents a cutting algorithm for cutting the data after the encryption calculation to obtain the one-time password corresponding to the currently applied authentication password, and specifically cuts a specified number of byte data at a specified position, wherein the specified position includes a byte position interval starting from the first position, and the specified number includes 4-8 bytes; Encrypt() represents an encryption calculation on the hash value obtained by performing a hash value calculation on the generated PARA 在线 , and specifically performs the encryption calculation by using a quantum key selected according to the current value of the counter; key 在线 represents a quantum key selected according to the current value of the counter in online authentication; HASH(PARA 在线 ) represents a hash value calculation on the generated PARA 在线 , and specifically performs the hash value calculation by using a hash algorithm HASH determined according to the current value of the counter to calculate the hash value corresponding to PARA 在线 ; PARA 在线 represents an online parameter generated by the current dynamic password acquisition request. 5.The dynamic password-based login verification method of claim 3, wherein, Further comprising: According to the current dynamic password acquisition request and the current value of the corresponding counter, the online parameter corresponding to the current dynamic password acquisition request is generated by using the following expression: PARA 在线 = ICCID + Counter + Random + Input + Timestamp wherein, PARA 在线 represents the online parameter corresponding to the current dynamic password acquisition request generated according to the current dynamic password acquisition request and the current value of the corresponding counter; ICCID represents the smart card serial number of the smart card corresponding to the current dynamic password acquisition request; Counter represents the current value of the counter corresponding to the current dynamic password acquisition request, which is increased by one after each calculation; Random represents a random number randomly generated by the smart card itself, including numbers, letters and symbols; Input represents the user input parameter of the current user, and when the user input parameter is not received, a random number is used as the user input parameter; the terminal application uses a randomly generated random number to fill in as the user input parameter, and the random number includes numbers, letters and symbols; Timestamp represents the current timestamp returned by the terminal application to the smart card application when the applied authentication password is an online authentication password. 6.The dynamic password-based login verification method of claim 1, wherein, Further comprising: The smart card application selects each password algorithm by using the current value of the counter, and determines the position parameter corresponding to each password algorithm through dynamic polling, wherein the dynamic polling introduces a security level, and the security level includes offline verification code, take-out verification code, office verification code, financial verification code, government verification code, to-be-expanded item, and respective corresponding security levels; When it is detected that the user input parameter and the identification corresponding to the security level are the first identification or the second identification, the current security level is kept unchanged; When it is detected that the user input parameter and the identification corresponding to the security level are greater than the second identification, the security detection is performed on the user input, and when it is determined that the input is risky, the current security level is automatically upgraded, that is, the current security level is increased by one, and the security detection includes whether the input length of the user input is greater than a specified bit number, and whether the user input contains numbers, letters, and symbols.

7. A dynamic password-based login verification system, characterized by, The execution right of the dynamic password-based login verification method in any one of claims 1 to 6, and the login verification system comprises: The request processing module is configured to, when the terminal application receives the dynamic password acquisition request, the terminal application applies the following authentication passwords to the smart card application according to the network state and security requirements: online authentication password and offline authentication password; The calculation processing module is configured to, the smart card application uses the selected password algorithm and parameter item to perform hash value conversion and encryption calculation, and generates the dynamic password corresponding to the offline authentication password request or the online authentication password request in different ways by intercepting according to the intercepting algorithm, and returns the generated dynamic password to the current terminal application and the current user; The data transmission module is configured to, after the current terminal application receives the dynamic password, transmit the smart card serial number, the generated dynamic password, and related data to the server of the current terminal application, and then to the operator server; The data verification module is configured to, when the operator server receives the data verification request, automatically identify the authentication type, perform dynamic password calculation for data verification, and return the data verification result to the server of the terminal application, and the authentication type includes offline authentication and online authentication.

8. The dynamic password-based login verification system of claim 7, wherein, Further comprising: When the applied authentication password is the offline authentication password, the smart card application uses the selected password algorithm and parameter item based on the counter to perform hash value conversion and encryption calculation, and then generates the dynamic password by intercepting according to the intercepting algorithm, and returns the generated dynamic password to the current user, wherein The following expression is used to calculate the dynamic password, that is, the one-time password or OTP password: OTP 离线 = CUT(Encrypt(key 离线 ,HASH(PARA 离线 ))) wherein, OTP 离线 represents the one-time password corresponding to the currently applied authentication password in offline authentication; CUT() represents a cutting algorithm for cutting the data after encryption calculation to obtain the one-time password corresponding to the currently applied authentication password, and the cutting algorithm specifically cuts a specified number of byte data at a specified position, the specified position includes a byte position or a byte position interval of a specified byte, and the specified number includes 4-8 bytes; Encrypt() represents an encryption calculation on the hash value obtained by performing a hash value calculation on the generated PARA 离线 , and the encryption calculation specifically uses a quantum key selected according to the current value of the counter in offline authentication; key 离线 represents the quantum key selected according to the current value of the counter in offline authentication; HASH(PARA 离线 ) represents a hash value calculation on the generated PARA 离线 , and the hash value calculation specifically uses a hash algorithm HASH determined according to the current value of the counter to calculate the hash value corresponding to PARA 离线 ; and PARA 离线 represents the offline parameter generated by the current dynamic password acquisition request. The following expression is used to generate the offline parameter corresponding to the current dynamic password acquisition request according to the current dynamic password acquisition request and the current value of the corresponding counter: PARA 离线 =ICCID+Counter wherein PARA 离线 represents an offline parameter corresponding to the current dynamic password acquisition request generated according to the current dynamic password acquisition request and the current value of the counter corresponding thereto; ICCID represents a smart card serial number of a smart card corresponding to the current dynamic password acquisition request; Counter represents a current value of the counter corresponding to the current dynamic password acquisition request, which is increased by one after each calculation.

Images