CN101533539B - Method for inputting password and device thereof - Google Patents

Abstract

The invention discloses a password input method and equipment, relates to the field of information security, and solves the problem that passwords input by users are easily intercepted. Receive the operation instruction sent by the card reader, detect whether the operation instruction is a password verification instruction, if the operation instruction is not a password verification instruction, then send the operation instruction to the smart card; if the operation instruction is the The password verification instruction receives the password input by the user, encapsulates the password input by the user into the password verification instruction, and sends the password verification instruction encapsulated with the user input password to the smart card. The invention is mainly used in the password input process to improve the security of the password input and make the password difficult to be intercepted during the input process.

Description

Password input method and equipment

technical field

The invention relates to the field of information security, in particular to a password input method and equipment. the

Background technique

In recent years, with the rapid development of e-commerce and the deepening of my country's commercialization process, more and more people choose electronic payment in financial transactions. The so-called electronic payment refers to the parties engaged in e-commerce transactions, including consumers, manufacturers, etc. And financial institutions, through the information network, use safe means of information transmission, and use digital methods for currency payment or capital transfer. Compared with the traditional payment method, this payment method has the advantages of convenience, speed, efficiency and economy, so that people can complete the payment process in a relatively short period of time. the

At present, the payment methods of automatic teller machines used by users and POS machines used in shopping malls are all electronic payment methods. When using this payment method, the password entered by the user is generally received directly by the consumer terminal (such as a computer), and the consumer terminal sends the password entered by the user to the bank service center through the Internet, and the bank service center accepts the password entered by the user. Verify. Since the consumption terminal is connected to the Internet, when the user enters the password into the consumption terminal, the input password is easily monitored and intercepted by illegal users, and the password entered by the user is passed through the Internet at the consumption terminal. During the process of sending the network to the bank service center, the password input by the user is more likely to be intercepted by illegal users, which makes the password input by the user less secure. the

Contents of the invention

The invention provides a password input method and equipment, which make the password difficult to be intercepted during the input process and improve the security of the password input. the

To achieve the above object, the present invention adopts the following technical solutions:

A password input method, including:

Receive the operation instruction sent by the card reader;

Detecting whether the operation instruction is a password verification instruction;

If the operation instruction is not the password verification instruction, then send the operation instruction to the smart card;

If the operation instruction is the password verification instruction, then receive the password input by the user;

Encapsulating the password input by the user into the password verification instruction;

Send the password verification instruction encapsulated with the password input by the user to the smart card;

Receive the execution result of the password verification instruction returned by the smart card;

Send the execution result of the password verification instruction to the card reader. the

A password input device, comprising:

The first communication module is used to receive the operation instruction sent by the card reader, and is also used to send the execution result of the password verification instruction to the card reader;

An instruction monitoring module is used to detect whether the operation instruction is a password verification instruction;

The input module is used to receive the password input by the user when detecting that the operation instruction is a password verification instruction;

An instruction modification module, configured to encapsulate the password input by the user into the password verification instruction;

The second communication module is used to send the password verification instruction encapsulated with the password input by the user to the smart card, and is also used to receive the execution result of the password verification instruction returned by the smart card;

The second communication module is further configured to send the operation instruction to the smart card when detecting that the operation instruction is not a password verification instruction. the

After adopting the above scheme, when making electronic payment, the password input by the user is directly received by the password input device, and then the password input by the user is sent to the smart card, and the smart card completes the authentication of the password input by the user. In the process of password input and transmission, the password input by the user is not in contact with the consumption terminal (such as: computer) connected to the Internet, which prevents illegal users from monitoring the user input password through the consumption terminal, and reduces the cost of interception. The possibility of the user inputting the password is described, and the security of the user password input process is improved. the

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort. the

Fig. 1 is the flowchart of the password input method of embodiment 1 of the present invention;

Fig. 2 is the composition block diagram of the password input device of embodiment 1 of the present invention;

Fig. 3 is the flowchart of the password input method of embodiment 2 of the present invention;

FIG. 4 is a block diagram of a password input device according to Embodiment 2 of the present invention. the

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention. the

Example 1

The embodiment of the present invention provides a password input method, as shown in Figure 1, the method includes:

101. The password input device receives the operation instruction sent by the card reader. The format of the operation instruction conforms to the 7816 specification (this specification is the international smart card specification), and it includes the following parts: CLA, INS, P1, P2, LC, DATA;

Among them, the CLA (ClAss, class) byte indicates the instruction type, and its length is one byte; the INS (INStructic, command) byte, its length is one byte, and an INS field indicates a specific instruction, that is, the instruction name ; P1 and P2 (Parameters 1 and 2, two parameters) bytes, the length of P1 and P2 is one byte respectively, used to check the INS field, or used to input data; LC (Length of Command parameters, optional field instructions parameters), LC is the number of bytes in the command data field; DATA, the data field is the command data, and its length is the value of LC; in general, CLA, INS, P1, and P2 can be called command headers, LC is the command parameter, and DATA Part of it is instruction data;

102. After the password input device receives the operation instruction sent by the card reader, it detects the operation instruction, and judges whether the operation instruction is a password verification according to the instruction type in the instruction header of the operation instruction. verification instruction; if the operation instruction is not a password verification instruction, then execute step 103; if the operation password is a password verification instruction, then execute step 104;

103. The password input device sends the operation instruction to the smart card, so that the smart card performs corresponding operations according to the operation instruction, and ends the execution of the steps;

104. The password input device receives the password input by the user. There are two ways for the password input by the user. The first method is that within a certain time range, when the user enters the password through the keyboard that comes with the password input device, the password input device Receive the data input by the keyboard and use the data as the password input by the user; second, after a period of time, if the user does not enter the password through the keyboard, the password input device automatically generates a string of random numbers, and The above random number is used as the password entered by the user;

105. After the password input device receives the password input by the user, encapsulate the password input by the user into the password verification instruction;

106. The password input device sends a password verification instruction encapsulated with the password input by the user to the smart card, so that the smart card authenticates the input password. the

The embodiment of the present invention also provides a password input device, as shown in Figure 2, the device includes:

A first communication module 21 , an instruction detection module 22 , an input module 23 , an instruction modification module 24 , and a second communication module 25 . the

The password input device receives the operation instruction sent by the card reader through the first communication module 21, the operation instruction includes an instruction header, instruction parameters and instruction data, the information carried by the instruction header is instruction type and instruction name, etc., the instruction The parameter is the number of bytes of the instruction data; after the password input device receives the operation instruction sent by the card reader, utilizes the instruction detection module 22 to detect whether the instruction type in the instruction header of the operation instruction is password verification instruction; if the operation instruction is not a password verification instruction, then the operation instruction is sent to the smart card by the second communication module 25; if the operation instruction is a password verification instruction, then the password input by the user is received by the input module 23 ; After the input module 23 has received the password of the user's input, utilize the instruction modification module 24 to encapsulate the input password into the password verification instruction; The verification command is sent to the smart card. the

Wherein, the password input by the user received by the input module 24 has two forms. The first type is that within a certain time range, when the user inputs the password through the keyboard provided by the password input device, the password input device uses the data entered by the keyboard as The password input by the user; the second type, after a period of time, if the user does not input the password through the keyboard, the password input device automatically generates a string of random numbers, and uses the random number as the password input by the user. the

In the embodiment of the present invention, the password input by the user is received by the password input device instead of the consumption terminal connected to the Internet, which avoids the possibility that the password input by the user is intercepted by an illegal user monitoring the consumption terminal through the Internet. Possibility, improve the security of the password input by the user; and the password input device sends the password input by the user to the smart card after encapsulation, instead of being sent to the smart card by the consumer terminal connected to the Internet, preventing The password input by the user is intercepted by an illegal user during transmission, which improves the security of the password input by the user. the

Example 2

The embodiment of the present invention provides a password input method, as shown in Figure 3, the method includes:

301. Before the password input device receives the operation instruction sent by the card reader, it needs to establish a data communication connection with the card reader and the smart card respectively. The specific steps of the connection are:

The password input device receives the reset signal sent by the card reader and sends the reset signal to the smart card. After sending the reset signal to the smart card, the password input device receives the reset response information sent by the smart card and sends the reset signal to the smart card. The reset response signal is sent to the card reader, and after the password input device sends the reset response information to the card reader, the password input device receives the protocol and parameter selection sent by the card reader instruction and send the protocol and parameter selection instructions to the smart card, after performing the above steps, the password input device respectively establishes a data communication connection with the card reader and the smart card;

302. After the data communication connection is established between the password input device and the card reader respectively, the password input device receives the operation instruction sent by the card reader, and the format of the operation instruction conforms to the 7816 specification (this specification It is an international smart card specification), which includes the following parts: CLA, INS, P1, P2, LC, DATA;

Among them, the CLA (ClAss, class) byte indicates the instruction type, and its length is one byte; the INS (INStructic, command) byte, its length is one byte, and an INS field indicates a specific instruction, that is, the instruction name ; P1 and P2 (Parameters 1 and 2, two parameters) bytes, the length of P1 and P2 is one byte respectively, used to check the INS field, or to input data; LC (Length of Command parameters, optional field command parameters), LC is the number of bytes in the command data field; DATA, the data field is the command data, and its length is the value of LC; in general, CLA, INS, P1, and P2 can be called command headers, LC is the command parameter, and DATA Part of it is instruction data;

303. After the password input device receives the operation instruction sent by the card reader, it needs to detect whether the instruction type carried in the instruction header of the operation instruction is a password verification instruction; if the operation instruction is not the password verification instruction, then execute step 304; if the operation instruction is the password verification instruction, then execute step 305;

304. The password input device sends the operation instruction to the smart card, so that the smart card performs corresponding operations according to the operation instruction, and executes step 309;

305. The password input device plays password input prompt information to prompt the user to enter the password. The password input prompt information can be voice playback or screen playback or a combination of voice playback and screen playback;

306. After the user receives the password input prompt information played by the password input device, if the user enters the password through the keyboard provided by the password input device within a certain time range, the password input device receives the user's input through the keyboard. If the password is not input through the keyboard within a certain time frame, the password input device will automatically generate a string of random data, and use the random number as the password input by the user;

307. The password input device encapsulates the received password input by the user into the password verification instruction, and at the same time, the password input device prompts status information, if it is being processed, please wait a moment;

Wherein, the process of encapsulating the password input by the user in the password verification instruction is illustrated by taking the operation instruction sent by the card reader as 00200000021234 as an example: the instruction header of the operation instruction is 00200000, where CLA is 00 and INS is 20. P1 is 00 and P2 is 00, indicating that the operation instruction is a password verification instruction; the instruction parameter LC is 02, indicating that the instruction data of the operation instruction is 2 bytes, and 1234 is the instruction data DATA of the operation instruction, specifically The encapsulation process is as follows:

The password input device deletes the instruction parameter 02 and the instruction data 1234 of the password verification instruction sent by the card reader, and the password input device supplements the password input by the user to the instruction data part of the password verification instruction, and uses the user input The password is 112233 as an example. After the instruction data is supplemented, the corresponding parameters of the password input by the current user are added to the instruction parameter part of the password verification instruction to realize the update of the password verification instruction parameters, and the user input The content of the password verification instruction encapsulated into the password verification instruction is 0020000003112233;

Further, before the password input by the user is encapsulated into the password verification instruction, the password input by the user can also be transformed into an algorithm, and then the password entered by the user after the algorithm transformation is encapsulated into the password verification instruction; Any encryption algorithm or hash algorithm in the prior art can perform an algorithm transformation operation on the password input by the user. For example, the password input by the user input device is 4321, using the SHA1 algorithm (Secure Hash Algorithm 1, Secure Hash Algorithm) is encrypted and calculated to obtain the operation result abcd5678, then the instruction parameter is 04, the instruction data is abcd5678, and the content of the generated password verification instruction is 0020000004abcd5678. the

308. After the encapsulation of the password input by the user is completed, the password input device sends a verification instruction encapsulated with the password input by the user to the smart card, so that the smart card can authenticate the password input by the user;

309. The password input device receives the execution result of the instruction returned by the smart card. When the smart card receives a password verification instruction, it returns the authentication result of the password input by the user, and the result includes that the password input by the user is correct. and the password entered by the user is incorrect; when the smart card receives a non-password verification command, what is returned is the execution result of the operation command;

310. The password input device sends the received execution result of the instruction sent by the smart card to the card reader, so that the card reader performs the next operation according to the instruction execution result. the

The embodiment of the present invention also provides a password input device, as shown in Figure 4, the device includes: a first communication module 41, a second communication module 42, an instruction detection module 43, a playback module 44, an input module 45, an instruction modification module 46. Algorithm transformation module 47;

Before the password input device receives the operation instruction sent by the card reader, the card reader and the smart card need to respectively establish a data communication connection with the password input device. The first communication module 41 is used to realize the data communication connection between the card reader and the password input device; the second communication module 42 is used to realize the data communication connection between the smart card and the password input device; After the card reader and the smart card respectively establish a data communication connection with the password input device, the first communication module 41 is also used to receive the operation instruction sent by the card reader, and the operation instruction includes an instruction header, command parameters and command data;

After receiving the operation instruction sent by the card reader, the password input device detects whether the instruction type carried in the instruction header of the operation instruction sent by the card reader through the instruction detection module 43 is a password verification instruction; When the operation instruction is a password verification instruction, the password input device plays the prompt information that prompts the user to input the password through the playback module 44, and the prompt information can be voice playback or screen display or voice playback and screen display combined; when the playback module 44 After playing the password information that prompts the user to input, the password input device utilizes the input module 45 to receive the password input by the user; and the password received by the input module is encapsulated into the password verification instruction through the instruction modification module 46; While the password input by the user is encapsulated, the playback module 44 plays the password processing status information such as: processing, please wait; when the user input password is encapsulated, the password input device passes through the second communication module 42. Send the password verification instruction encapsulated with the input password to the smart card;

The smart card authenticates the received user input password, and returns the authenticated result to the password input device, and the password input device uses the second communication module 42 to receive the password verification instruction returned by the smart card and send the execution result of the password verification instruction to the card reader through the first communication module 41, so that the card reader can perform the next operation according to the result of the password verification. the

When the operation instruction is not a password verification instruction, the password input device sends the operation instruction to the smart card through the second communication module 42, so that the smart card performs corresponding operations according to the operation instruction; After the operation instruction is finished, when sending the execution result of the operation instruction to the password input device, the password input device receives the execution result of the operation instruction through the second communication module 42; A communication module 41 sends the result of the execution of the operation instruction to the card reader, so that the card reader performs the next operation according to the result of the execution of the operation instruction. the

Wherein, the password input by the user has two forms, the first one, after the user receives the password input prompt information played by the password input device, enters the password through the keyboard of the password input device within a certain period of time, The input module 45 receives the data input by the keyboard and uses the data input by the keyboard as the password input by the user; the second type, when the user receives the password input prompt information played by the password input device, within a certain period of time If there is no password input through the keyboard within the scope, the password input device will automatically generate a string of random numbers, and the input module receives the random numbers and uses the random numbers as the password input by the user;

Wherein, when establishing a data communication connection between the card reader and the smart card and the password input device respectively includes: the password input device uses the first communication module 41 to receive the reset signal sent by the card reader, And send the reset signal to the smart card through the second communication module 42; when the reset signal sent by the card reader is sent to the smart card, the password input device uses the second communication module 42 to receive the smart card to send reset response information, and send the reset response signal to the card reader through the first communication module 41; when the reset response information sent by the smart card is sent to the card reader, the password input device uses the first communication Module 41 receives the protocol and parameter selection instructions sent by the card reader, and sends the protocol and parameter selection instructions to the smart card through the second communication module 42; when the protocol and parameter selection instructions are sent to the After the smart card, a data communication connection is established between the card reader and the smart card and the password input device respectively;

Wherein, when the instruction modification module 46 is used to encapsulate the input password into the password verification instruction, it includes: the password input device uses the instruction modification module 46 to verify the password sent by the card reader. Delete the command parameters and command data of the command; after deleting the command parameters and command data of the password verification command, the command modification module 46 is also used to supplement the password entered by the user to the command data part; when the After the password input by the user is added to the instruction data part, the instruction modification module 46 is also used to update the instruction parameter to the parameter corresponding to the password input by the user. the

Wherein, before the instruction modification module 46 encapsulates the user input password into the password verification instruction, the password input by the user may also be algorithmically transformed, as shown in the dotted line in Figure 4, the algorithm transformation module 47, For carrying out algorithm transformation to the password input by the user, the method for carrying out algorithm transformation to the password input by the user includes encryption and hashing; after the algorithm transformation module 47 performs the algorithm transformation operation on the data input by the user, the instruction modification module 46 delete the instruction parameter and instruction data of the password verification instruction sent by the card reader; after deleting the instruction parameter and instruction data of the password verification instruction, the instruction modification module 46 is also used to transform the algorithm After the password input by the user is added to the instruction data part; when the algorithm-transformed user input password is added to the instruction data part, the instruction modification module 46 is also used to update the instruction parameter to The parameter corresponding to the password input by the user after the algorithm transformation. the

In the embodiment of the present invention, before the password input device receives the operation command sent by the card reader, the data communication connection between the password input device and the card reader and the smart card is respectively realized, so as to ensure that the input password can be timely and accurately stored in the card reader. to and from the smart card. The password input by the user is directly received by the password input device, rather than by the consumption terminal connected to the Internet, which prevents illegal users from monitoring the consumption terminal and intercepting the password input by the user, and improves the password input by the user. security; and the password entered by the user is forwarded to the smart card by the password input device instead of being sent to the smart card by the consumer terminal connected to the Internet, preventing illegal users from sending the user's password through the Internet The password input is intercepted, which improves the security of the password input by the user; and the password input by the user is authenticated by the smart card, and the authentication result of the password input by the user is forwarded to the card reader, and the card reader according to the The execution result is communicated with the consumption terminal connected to the Internet, which prevents illegal users from intercepting the password input by the user by monitoring the consumption terminal, and improves the security of the password input by the user. the

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general-purpose hardware, and of course also by hardware, but in many cases the former is a better implementation mode . Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, such as a floppy disk of a computer , a hard disk or an optical disk, etc., including several instructions for enabling a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments of the present invention. the

The above is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Anyone skilled in the art can easily think of changes or substitutions within the technical scope disclosed in the present invention. Should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. the

Claims (10)

1. A password input method, characterized in that, comprising: Receive the operation instruction sent by the card reader; Detecting whether the operation instruction is a password verification instruction; If the operation instruction is not a password verification instruction, then send the operation instruction to the smart card; If the operation instruction is the password verification instruction, receiving the password input by the user; encapsulating the password input by the user into the password verification instruction; Sending the password verification instruction encapsulated with the password input by the user to the smart card; receiving the execution result of the password verification instruction returned by the smart card; Send the execution result of the password verification instruction to the card reader. 2. The password input method according to claim 1, wherein when the operation instruction is a password verification instruction, the method further comprises: playing prompt information or status information for password input. 3. The password input method according to claim 1, characterized in that, before encapsulating the password input by the user into the password verification instruction, the method further comprises: performing algorithm transformation on the password input by the user; 4. The password input method according to claim 1, wherein encapsulating the input password into the password verification instruction comprises: Deleting the command parameters and command data of the password verification command; Supplementing the input password to the instruction data part of the password verification instruction; The instruction parameter of the password verification instruction is updated to a parameter corresponding to the current instruction data. 5. The password input method according to claim 1, characterized in that, before receiving the operation instruction sent by the card reader, the method further comprises: receiving a reset signal sent by the card reader; sending the reset signal to the smart card; receiving reset response information sent by the smart card; sending the reset response signal to the card reader; Receive the protocol and parameter selection instructions sent by the card reader; Sending the protocol and parameter selection instructions to the smart card. 6. A password input device, characterized in that, comprising: The first communication module is used to receive the operation instruction sent by the card reader; it is also used to send the execution result of the password verification instruction to the card reader; An instruction monitoring module, configured to detect whether the operation instruction is a password verification instruction; An input module, configured to receive a password input by a user when detecting that the operation instruction is a password verification instruction; An instruction modification module, configured to encapsulate the password input by the user into the password verification instruction; The second communication module is used to send the password verification instruction encapsulated with the password input by the user to the smart card; and is also used to receive the execution result of the password verification instruction returned by the smart card; The second communication module is further configured to send the operation instruction to the smart card when detecting that the operation instruction is not a password verification instruction. 7. The password input device according to claim 6, further comprising: The playing module is used to play prompt information or status information of password input when the operation instruction is a password verification instruction. 8. The password input device according to claim 6, further comprising: The algorithm conversion module is configured to perform algorithm conversion on the password input by the user before encapsulating the password input by the user into the password verification instruction. 9. The password input device according to claim 6, characterized in that, The instruction modification module is also used to delete the instruction parameters and instruction data of the password verification instruction; The instruction modification module is also used to supplement the input password to the instruction data part of the password verification instruction; The instruction modifying module is further configured to update the instruction parameters of the password verification instruction to parameters corresponding to the current instruction data. 10. The password input device according to claim 6, characterized in that, The first communication module is also used to receive a reset signal sent by the card reader; The second communication module is further configured to send the reset signal to the smart card; The second communication module is also used to receive reset response information sent by the smart card; The first communication module is further configured to send the reset response signal to the card reader; The first communication module is also used to receive protocol and parameter selection instructions sent by the card reader; The second communication module is further configured to send the protocol and parameter selection instructions to the smart card.

Images