CN1323538C - A method and system for dynamic identity authentication - Google Patents

Abstract

The invention discloses a dynamic identity authentication method and system. The steps are as follows: ① input user information, and send an authentication request to an authentication server; ③The user generates the client password through the mobile phone token; ④The user inputs the above-mentioned client password through the user terminal and sends it to the authentication server; ⑤If the password received by the authentication server is consistent with the one generated, the identity authentication is passed; otherwise Fail. Its system includes user terminal, user information server, authentication server and mobile phone token. The authentication server is responsible for receiving and completing the user's service request, and the mobile phone token is used to generate a synchronized current identity authentication password. The invention can not only effectively prevent illegal login through peeping or guessing authentication password, but also effectively prevent illegal login through intercepting transmission information, thus greatly improving the security of the system.

Description

A method and system for dynamic identity authentication

technical field

The invention belongs to information security authentication technology, which is realized by comprehensive utilization of electronic computer, information coding and mobile communication technology, and can be applied to many systems and fields requiring identity authentication such as banks and securities.

Background technique

Identity authentication is one of the important mechanisms to achieve network security. In secure network communication, all parties involved in the communication must pass some form of identity authentication mechanism to verify whether their identities are consistent with what they claim, and then they can achieve different User access control and logging. As early as the early 1970s, the International Bank Card Association encountered the problem of how to authenticate users to ensure system security. With the rapid development of information technology, eavesdroppers can use low-level peeping methods to obtain passwords; use the "Password file" system to guess passwords, analyze protocols and filter passwords (using sniffing programs); use TSR (terminal resident program) Monitor and obtain passwords; use Trojan horse programs to intercept passwords and other methods to break through computer security mechanisms for illegal access; use computer viruses (such as: bugbear virus) to steal credit card numbers, online banking information and bank passwords from computers. A more effective preventive method is to use dynamic electronic password technology. Its essence is to change the password regularly according to a certain rule or after each use, and the password entered by the user every time it visits is different, which increases the difficulty for electronic theft.

The method and system utilizing the above technology have been proposed in two invention patents of "Dynamic Electronic Password Formation Method" (99116451.2) and "Dynamic Electronic Password System" (00114328.X). However, because the synchronization between the user password card and the host system mainly adopts non-contact clock synchronization technology, which may cause the accumulation of time errors, it is necessary to correct the clocks of both parties after a period of time; in addition, the use of the user password card Increased user's use burden; And this user code card with keyboard and liquid crystal display also can be damaged because of using carelessly. In order to overcome the above-mentioned shortcoming, we proposed the invention patent of "dynamic password wireless transmission method" (99116517.9) again. However, since the dynamic password is transmitted in clear text in this method, an eavesdropper can easily intercept the identity authentication password. Moreover, this method cannot guarantee the real-time performance of the authentication when the wireless network communication is crowded.

Contents of the invention

The purpose of the present invention is to overcome the above defects and provide a dynamic identity authentication method, which uses widely used mobile phones as identity tokens, which can effectively prevent illegal logins by peeping or guessing authentication passwords, and effectively Preventing illegal login through interception of transmitted data can greatly improve the security of the system, and the dynamic password in the authentication process does not need to use wireless network transmission, which ensures the real-time authentication. The object of the present invention is also to provide a system for realizing the above method.

A kind of mobile phone token dynamic identity authentication method of the present invention, utilizes computer technology and mobile communication technology to realize, and its steps are:

(1). The user inputs user information on the user terminal and sends an identity authentication request to the identity authentication server;

(2). After receiving the authentication request, the identity authentication server first verifies the legitimacy of the user information. If the user is a legitimate user, the identity authentication server generates the server-side dynamic identity authentication password and stores it temporarily, and prompts the user to input the user-side dynamic identity authentication password at the user terminal;

(3). The user enters the application module startup password in the mobile phone token, and passes the identity verification of the mobile phone token terminal;

(4). The user generates the user-side dynamic identity authentication password through the mobile phone token, and informs the user through the mobile phone;

(5). The user inputs and transmits the dynamic identity authentication password of the user terminal notified to the identity authentication server through the user terminal, and waits for identity authentication;

(6). If the user end dynamic identity authentication password received by the identity authentication server is consistent with the server end dynamic identity authentication password, the identity authentication is passed; otherwise, the authentication fails.

When carrying out the above step (2), if the legal user finds that his account is locked, he can apply for unlocking through the mobile phone token, and the steps are as follows:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the "Account Unlock Request" message to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the "request for unlocking the account";

4) The authentication server sets the user's "user status" field as unlocked in the user information database, and then sends the user a message of "response to apply for account unlocking";

5) The mobile phone token receives the message of "apply for account unlocking response" and prompts the user that the unlocking is successful.

When performing the above step (3), if the user finds that the dynamic identity authentication service has not been turned on, the dynamic identity authentication service should be turned on, and the steps are:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends a "request for enabling dynamic identity authentication service" message to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the "request to enable dynamic identity authentication service";

4) The authentication server marks the user's authentication method as a dynamic identity authentication method in the user database, and then sends the "open dynamic identity authentication service response" message to the mobile phone token;

5) The mobile phone token receives the message "Enable Dynamic Identity Authentication Service Response", prompting that the dynamic identity authentication service has been enabled.

During the identity authentication process, if the legitimate user finds that the authentication cannot be passed after correct operation, the user can use the mobile phone token to request system synchronization, and the steps are as follows:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the "application system synchronization request" message to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the "application system synchronization request" information;

4) The authentication server takes out the current working password of the server from the user database;

5) The authentication server generates the "application system synchronous response" message, writes the current working password of the server into the "server information" field in the message, and then sends a response message to the user;

6) The mobile phone token extracts the current work password in the information after receiving the "application system synchronization response" information, and sets the current work password on the mobile phone token end as the current work password extracted in the information to complete the system synchronization.

During the identity authentication process, if you want to cancel the dynamic identity authentication service, the steps are:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the message "cancel dynamic identity authentication service request" to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the "request to cancel the dynamic identity authentication service";

4) The authentication server marks the user's authentication method as a fixed password identity authentication method in the user information database, and then sends a "cancel dynamic identity authentication service response" message to the mobile phone token;

5) The mobile phone token receives the message of "cancellation of dynamic identity authentication service response", prompting that the dynamic identity authentication service has been cancelled.

During the identity authentication process, if you want to terminate the dynamic identity authentication process, the steps are:

1) The user inputs the pre-determined termination instruction of the mobile phone token, and the token system terminates the authentication process;

2) The user inputs and transmits the "suspend dynamic identity authentication service request" to the identity authentication server through the user terminal;

3) The authentication server terminates the authentication process on the server side after receiving the "request to terminate the dynamic identity authentication service".

When carrying out the above step (3), if the legal user finds that his mobile phone token is locked, he can apply for unlocking through the mobile phone token, and the steps are:

1) The user enters the mobile phone token registration password and passes the authorized identity verification of the mobile phone token terminal;

2) The mobile phone token sets the "user status" field in it to the unlocked status, and then notifies the user of the "unlock response" information through the mobile phone.

A system for realizing the above method, including a user terminal, a user information server, an authentication server and a mobile phone token; wherein,

The user terminal is used to input user information, and it communicates with the identity authentication server through the network;

The user information server is used to store the form set according to the identity authentication protocol, provide each user information required in the authentication process, and receive the operation of the authentication server;

The authentication server is responsible for receiving and completing the user's service request, which is equipped with an authentication server-side service module, a password generation module and a communication module; the authentication server-side service module is used for network transmission control, authentication system security protocol processing, and encryption and decryption of information transmission , user information access and dynamic password acquisition and temporary storage; the password generation module is responsible for generating the server-side dynamic identity authentication password, which communicates with the authentication server through the server bus; Intermediary of communication between authentication servers;

The mobile phone token is a user's mobile phone provided with a dynamic identity authentication client application module in the SIM card of the mobile phone, and the password generation module in the dynamic identity authentication client application module and the authentication server uses the same dynamic password generation algorithm and the same current work Password, and independently generate a synchronous dynamic identity authentication password.

The authentication server-side service module includes a user information management module, a dynamic password access module, a protocol processing module, a core management module, an encryption module and a network transmission module;

The user information management module is responsible for completing the user information management commands of the core management module, including creating new accounts, modifying existing account information, deleting expired account information, locking or unlocking user accounts, and controlling user access rights;

The dynamic password access module is the access module of the above-mentioned password generation module, which receives the user key information provided by the core management module, generates the dynamic password in the authentication process, and gives the dynamic password to the core management module for temporary storage;

The protocol processing module is the service processing end of the security protocol of the dynamic identity authentication system, which is used to receive the security protocol information provided by the core management module, and return the processing result to the core management module;

The encryption module is used to complete the information encryption and decryption request of the core management module;

The network transmission module is used to complete the information transmission and reception tasks on the server side, and process the information transmission request of the core management module, and send different types of information to different communication networks;

The core management module is responsible for coordinating the interrelationships and information transmission among the above modules.

The dynamic identity authentication client application module in the above-mentioned mobile phone token includes a dynamic password generator, a memory, a password comparator and a controller;

The memory is used to store user ID, user ID number, registration password Pr, encryption key Ke, and is responsible for storing the current working password Ks for generating the dynamic identity authentication password, the startup password (or mobile phone token password) of the customer application module Pt and the number of times Nt of consecutively incorrectly inputting the token access password on the token; it is connected with the dynamic password generator, the password comparator and the controller;

The dynamic password generator is used to generate the user's current authentication password by the current working password Ks, which corresponds to the server authentication password, and informs the user of the authentication password through the output device of the mobile phone;

The password comparator is used to judge whether the mobile phone user is legal;

The controller is used to control the coordinated work of the above modules.

The present invention differs from the invention patents "Adding Paging System on the Internet to Ensure Money Payment Security Method and Response System" (99123882.6) and "Dynamic Password Wireless Transmission Method" (99116517.9) in that the user terminal of the present invention adopts a widely used mobile phone as an order The dynamic identity authentication password is independently generated on the mobile phone token side and the identity authentication server side, without relying on wireless network transmission, which ensures the real-time authentication and the password cannot be intercepted by the outside world, greatly improving the security of the system. In addition, the user is not required to pay additional communication fees during the authentication process, so that compared with the above two inventions, the cost of using the dynamic identity authentication service is greatly reduced.

Description of drawings

Figure 1 is an overall structural diagram of the authentication system;

Figure 2 is a structural diagram of the authentication server software;

Fig. 3 is the realization figure of mobile phone token;

Figure 4 is a diagram of the dynamic identity authentication process, in which Figure 4.1 is the execution process of the mobile phone token end, and Figure 4.2 is the execution process of the authentication server end;

Figure 5 is a diagram of the process of starting the dynamic identity authentication service, in which Figure 5.1 is the execution process of the mobile phone token end, and Figure 5.2 is the execution process of the authentication server end;

Figure 6 is a diagram of the synchronization process of the application system, in which Figure 6.1 is the execution process of the mobile phone token side, and Figure 6.2 is the execution process of the authentication server side;

Figure 7 is a diagram of the process of applying for user account unlocking, in which Figure 7.1 is the execution process of the mobile phone token end, and Figure 7.2 is the execution process of the authentication server end;

Figure 8 is a process diagram of canceling the dynamic identity authentication service, in which Figure 8.1 is the execution process of the mobile phone token end, and Figure 8.2 is the execution process of the authentication server end;

Figure 9 is an explanatory diagram of the security protocol information format, in which Figure 9.1 is the format of the protocol information header, Figure 9.2 is the format of the service request information body, and Figure 9.3 is the format of the service response information body.

Detailed ways

Taking the banking system as an example below, the present invention will be further described in detail in conjunction with the accompanying drawings.

1. System Structure Description

FIG. 1 is an overall structural diagram of the authentication system, including a user terminal 6, a user information server 1, an authentication server 2 and a mobile phone token 5. User information server 1 is the data server in the system, using the oracle9i database system, which stores the tables set according to the identity authentication protocol, and provides each user information required in the authentication process. It includes the following fields: ID number, user ID, registration password Pr, encryption and decryption key Ke, current work password Ks (same as the current work password stored in the mobile phone token), the sign that the account is being used ( to prevent competitive attacks) and mobile phone numbers, etc. The user information server 1 receives the operation (query and modify user information) request from the authentication server 2, and the operation request uses the OLEDB data interface. The authentication server 2 is the server end of the entire authentication system, responsible for receiving and completing user service requests. The service module of the authentication server, the password generation module 3 and the communication module 4 are arranged in the authentication server. The password generation module 3 is responsible for generating the dynamic identity authentication password on the server side, which is the hardware implementation of the "dynamic electronic password generation algorithm", and communicates with the authentication server 2 using the server bus. The communication module 4 uses the COM port to communicate with the authentication server 2, and the mobile phone token 5 is a user's mobile phone that can complete the authentication token function, and its SIM card has a JAVA program operating environment. The application module of the dynamic identity authentication client is an embedded application module developed by using JAVA language, and it is written into the SIM card of the mobile phone token 5 through the SIM card writing device TY311. The application module of the dynamic identity authentication client in the mobile phone token 5 and the password generation module 3 in the authentication server use the same dynamic password generation algorithm, and independently generate synchronous dynamic identity authentication passwords. The user terminal 6 (such as an ATM terminal) communicates with the identity authentication server 2 through the internal network 7 of the bank. During authentication, the user submits the user-side dynamic identity authentication password generated by the mobile phone token to the authentication server, and the authentication server compares the user-side dynamic identity authentication password with the server-side dynamic identity authentication password generated by itself, and judges whether the user passes the authentication based on the comparison result. Authentication.

Figure 2 is a structural diagram of the authentication server-side service module. The authentication server-side service module is the server-side software of the authentication system, which mainly completes functions such as network transmission control, authentication system security protocol processing, encryption and decryption of information transmission, user information access, and dynamic password acquisition and temporary storage. The authentication server-side service module includes a user information access module 8 , a dynamic password access module 9 , a protocol processing module 10 , a core management module 11 , an encryption module 12 and a network transmission module 13 . The user information access module 8 is the access module of the back-end user information server, responsible for completing the user information management commands of the core management module 11, including establishing new accounts, modifying existing account information, deleting expired account information, locking or unlocking user accounts and controlling User access rights, etc. The dynamic password access module 9 is the access module of the dynamic password generation module in the authentication service, it receives the user key information provided by the core management module 11, generates the dynamic password in the authentication process, and gives the dynamic password to the core management module 11 for temporary storage . The protocol processing module 10 is the server processing end of the security protocol of the dynamic identity authentication system, it receives the security protocol information provided by the core management module 11, and returns the processing result to the core management module 11. The core management module 11 is the core of the entire authentication server-side software, and is responsible for coordinating the interrelationships and information transmission among other modules. The encryption module 12 mainly completes the information encryption and decryption request of the core management module 11 . The network transmission module 13 mainly completes the information transmission task of the server side, and it receives the information of the bank's private network and the information of the communication module in the authentication server. It also handles the information transmission request of the core management module, and sends different types of information to different communication networks.

Fig. 3 is the realization figure of mobile phone token, and 22 is the partial structural diagram of SIM card in the mobile phone token, and 23 is the partial structural diagram of the interface of mobile phone. The dynamic identity authentication client application module in the mobile phone token includes a dynamic password generator 14, a memory 15, a password comparator 16 and a controller 17. Storer 15 is used for storing user ID, user ID number, registration password Pr, adding, decryption key Ke, and is responsible for storing the current working password Ks that is used to generate current dynamic identity authentication password (the same as the current working password stored in the server. The same), the startup password (or mobile phone token password) Pt of the client application module and the number of times Nt of continuously and incorrectly inputting the token access password on the token. The encryption key Ke and the current working password Ks are distributed by the authentication server for the user's mobile phone token when the user applies for the service; the activation password (or mobile phone token password) Pt of the client application module is provided by the user and written into the SIM card. The memory 15 is connected with the dynamic password generator 14, the password comparator 16 and the controller 17. The dynamic password generator 14 is used to generate the user's current authentication password from the current working password Ks, which can be a stream cipher algorithm such as RC4, corresponding to the server authentication password. The dynamic password generator 14 is connected with the display 20 through the display interface 18 of the mobile phone, and the generated password is displayed on the display screen. Password comparator 16 is used for judging whether mobile phone user is legal, and it links to each other with keyboard 21 by keyboard interface 19, and the password that the user inputs by keyboard is compared with the startup password (or mobile phone token password) Pt of client application module like this. The controller 17 is used to control the coordinated work of each module.

2. Certification process

As shown in Figure 4, the authentication process includes the following steps:

(1) The user inserts the bank card at the ATM terminal, submits user information, and sends an identity authentication request to the identity authentication server;

(2) After receiving the authentication request, the identity authentication server first verifies the legitimacy of the user information. If the user is a legal user (the user's information has been stored in the user information database), the identity authentication server generates the server-side dynamic identity authentication password and stores it temporarily, and prompts the user to input the user-side dynamic identity authentication password at the user terminal. The detailed process of this step is as follows:

(2.1) After receiving the authentication request, the network transmission module in the identity authentication server submits the user request to the core management module.

(2.2) The core management module inquires the user information database through the user information access module, if there is no information of the user in the user information database, the core management module generates an error message, and transmits it to the ATM terminal by the network transmission module, and the terminal receives the message After the text, the user is prompted: the user information is wrong. If there is the information of the user in the user information database, the user information management module returns the user information of the user to the core management module, and checks the Identification_Mode field value therein (field value 0 means that the user uses a static password authentication, and 1 means Use dynamic password authentication).

(2.3) If Identification_Mode=1, then the Lock_State field of this user of core management module inquiry (field value 0 represents that the user is locked, is 1 and represents that the user is locked), if Lock_State=1, core management module sends to ATM terminal information, prompting that the user has been locked and exiting the authentication process, otherwise the core management module will pass the current working password of the user to the dynamic password access module, and the dynamic password generating module will generate the dynamic authentication password of the user according to the current working password and return it to A core management module. The core management module temporarily stores the user's dynamic identity authentication password, and sends information to the ATM terminal, prompting the user to input the user terminal dynamic identity authentication password.

If a legal user finds that his account is locked, he can apply for unlocking through the mobile phone token. For the specific process of unlocking, see the "User Application for Unlocking" section of the dynamic identity authentication security protocol.

(3) The user generates a user-side dynamic identity authentication password through the mobile phone token, which is displayed on the mobile phone screen.

It must be emphasized that before using the dynamic identity authentication service provided by the bank, the user must complete the two processes of "mobile phone token initialization" and "starting the dynamic identity authentication service". For the details of the two processes, see the two parts of the dynamic identity authentication security protocol, "Mobile Token Initialization" and "Enable Dynamic Identity Authentication Service".

(4) The user enters the user terminal dynamic identity authentication password displayed on the mobile phone screen through the user terminal and transmits it to the identity authentication server, waiting for identity authentication.

(5) If the user end dynamic identity authentication password received by the identity authentication server is consistent with the server end dynamic identity authentication password, the identity authentication is passed; otherwise, the authentication fails. The detailed procedure for this step is as follows:

(5.1) The core management module of the authentication server obtains the client dynamic identity authentication password submitted by the user from the network transmission module;

(5.2) The core management module compares the user end dynamic identity authentication password and the temporary server end dynamic identity authentication password, if the two are consistent, then the core management module sends information to the ATM terminal by the network transmission module, prompting user authentication success, otherwise, The core management module modifies the user information in the user information database through the user information network module, adds 1 to the WrongPSW_Count field in the user information (the user will be locked when WrongPSW_Count reaches a critical value), and sends the line information to the ATM terminal through the network transmission module , requiring the user to restart the authentication process;

It must be pointed out that if a legitimate user finds that he cannot pass the authentication after correct operation, the user can use the mobile phone token to request system synchronization. For the synchronization process, see the "User Application System Synchronization" section of the dynamic identity authentication security protocol.

3. Dynamic Identity Authentication Security Protocol

The dynamic identity authentication method based on the mobile phone token mode is a kind of authentication method based on a synchronous dynamic identity authentication password. In the implementation process, it is necessary to ensure that the mobile phone token and the system synchronization of the authentication server are implemented. The present invention uses a dynamic identity authentication security protocol to realize this Purpose. The security protocol of dynamic identity authentication is the supporting protocol of the dynamic identity authentication method based on mobile phone token. It is an interaction protocol based on SMS, which defines the interaction process between the mobile phone token and the authentication server, the information format of the interaction, and the security mechanism to ensure the security of the interaction process (including the encryption method of the interaction information, the encryption key management method and authentication method for mutual information). The security protocol not only provides the user with the mobile phone token and the authentication server-side system synchronization function, but also supports the user to use the mobile phone token to complete the functions of dynamic identity authentication service startup, user unlocking and user cancellation of dynamic identity authentication service. The following describes the basic principles of the security protocol in detail from the aspects of protocol process, security mechanism and information format.

(1) Agreement process

1. Mobile phone token initialization

The mobile phone token initialization process is divided into two links: client application module writing and client application module initialization. Writing the client application module refers to using the SIM card writing device TY311 to write the client application module based on JAVA embedded dynamic identity authentication in the SIM card of the user's mobile phone. The client application module initialization is mainly to set the parameters of the client application module in the SIM card, including setting user identity information, information encryption and decryption keys, client application module startup password, current work password and user registration password and other parameters. The client's application module startup password and registration password are selected by the user and can be modified at any time. The client's application module startup password is used to ensure that only legitimate mobile phone token users can use the mobile phone token to complete the dynamic identity authentication process. The registration password is used to ensure that only legitimate users can use the mobile phone token to complete the "unlock" and "cancel dynamic identity authentication service" functions; the current work password and information encryption and decryption keys are divided into the current work password on the mobile phone token side and the authentication server The current working password of the terminal, the current working password and information encryption and decryption keys of the authentication server are also part of the user information, and both ends should have the same current working password and information encryption and decryption keys. At the time of initialization, the initial current working password and information encryption and decryption keys are respectively generated by the random number generator, and the current working password, information encryption and decryption keys in the mobile phone token and the current working password and information of the authentication server are The encryption and decryption keys are set as the initial current working password and the information encryption and decryption keys.

2. The user starts the dynamic identity authentication service

The process of enabling the dynamic identity authentication service by the user means that the user uses the mobile phone token to send a "request to enable the dynamic identity authentication service" to the authentication server. After receiving the request, the authentication server first verifies the legitimacy of the user's user information and performs corresponding processing , and then send the "Enable Dynamic Identity Authentication Service Response" to the user. The detailed process is as follows:

1) The user enters the activation password of the mobile phone token client application module (set when the mobile phone token is initialized), and passes the authentication of the mobile phone token terminal;

2) The user sends a "request for enabling dynamic identity authentication service" message to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the message of "opening the dynamic identity authentication service request" (the user ID and registration password in the verification information, the registration password is determined when the user's mobile phone is initialized);

4) The authentication server marks the user's authentication method as a dynamic identity authentication method in the user information database, and then sends the "open dynamic identity authentication service response" message to the mobile phone token;

5) The mobile phone token receives the message "Enable Dynamic Identity Authentication Service Response", prompting that the dynamic identity authentication service has been enabled.

See Figure 5 for the processing process of the mobile phone token side and the authentication server side when the user starts the dynamic identity authentication service.

3. User application system synchronization

As mentioned earlier, the key for users to be authenticated by the authentication server is to keep the mobile phone token and the authentication server in sync with the system. However, due to the abnormal situation that makes both ends out of sync (such as sudden power failure of the mobile phone during the user authentication process, etc.), it is necessary to restore the system synchronization status of both ends by implementing the "user application system synchronization" of the dynamic identity authentication security protocol. The detailed process is as follows:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the "application system synchronization request" message to the authentication server through the mobile phone token;

3) After the authentication server receives the "application system synchronization request" information, it verifies the legitimacy of the information (the user ID and registration password in the verification information, and the registration password is determined when the user's mobile phone is initialized);

4) The authentication server takes out the current working password of the server from the user information base;

5) The authentication server generates the "application system synchronous response" message, writes the current working password of the server into the "server information" field in the message, and then sends a response message to the user;

6) The mobile phone token extracts the current work password in the information after receiving the "application system synchronization response" information, and sets the current work password of the dynamic electronic password at the mobile phone token end as the current work password extracted in the information to complete the system synchronization.

See Figure 6 for the processing process of the mobile phone token side and the authentication server side when the user applies for system synchronization.

4. The user applies for unlocking

If the user finds that his account is locked by the bank, the user can apply for unlocking through the mobile phone token. The detailed process is as follows:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the "Account Unlock Request" message to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the "application account unlock request" information (verifies the user ID and registration password in the information, and the registration password is determined when the user's mobile phone is initialized);

4) The authentication server sets the user's "user status" field as unlocked in the user information database, and then sends the user a message of "response to apply for account unlocking";

5) The mobile phone token receives the message of "apply for account unlocking response" and prompts the user that the unlocking is successful.

See Figure 7 for the processing process of the mobile phone token side and the authentication server side when the user applies for unlocking.

If a legal user finds that his mobile phone token is locked, he can apply for unlocking through the mobile phone token, and the steps are as follows:

1) The user enters the mobile phone token registration password (generally the password is longer than the activation password), and passes the authorization authentication of the mobile phone token terminal;

2) The mobile phone token sets the "user status" field in it to the unlocked status, and then notifies the user of the "unlock response" information through the mobile phone.

5. The user cancels the dynamic identity authentication service

Users can not only open the dynamic identity authentication service through the mobile phone token, but also use the mobile phone token to cancel the dynamic identity authentication service. The detailed process is as follows:

1) The user enters the activation password of the mobile phone token client application module, and passes the identity verification of the mobile phone token terminal;

2) The user sends the message "cancel dynamic identity authentication service request" to the authentication server through the mobile phone token;

3) The authentication server verifies the legitimacy of the information after receiving the message "cancel dynamic identity authentication service request" (the user ID and registration password in the verification information, the registration password is determined when the user's mobile phone is initialized);

4) The authentication server marks the user's authentication method as a fixed password identity authentication method in the user information database, and then sends a "cancel dynamic identity authentication service response" message to the mobile phone token;

5) The mobile phone token receives the message of "cancellation of dynamic identity authentication service response", prompting that the dynamic identity authentication service has been cancelled.

When the user cancels the dynamic identity authentication service, see Figure 8 for the processing process of the mobile phone token end and the authentication server end.

6. The user terminates the dynamic identity authentication service

During the identity authentication process, if you want to terminate the dynamic identity authentication process, the steps are:

1) The user inputs the pre-determined termination instruction of the mobile phone token, and the token system terminates the authentication process;

2) The user inputs and transmits the "suspend dynamic identity authentication service request" to the identity authentication server through the user terminal;

3) The authentication server terminates the authentication process on the server side after receiving the "request to terminate the dynamic identity authentication service".

(2) The security mechanism of the security protocol

The security protocol encrypts and decrypts the interactive information according to encryption and decryption keys and block cipher algorithms such as DES (Data Encryption Standard).

The protocol not only defines the encryption and decryption methods of interactive information, but also specifies the corresponding encryption and decryption key management details. The protocol stipulates: write the encryption and decryption keys when the mobile phone token is initialized; use the method of updating the encryption and decryption keys based on the number of information usage times, that is, maintain an information counter on the user's mobile phone terminal, and count the request information sent by the mobile phone token number, when the counter reaches the threshold value, the mobile phone token will automatically set the key update flag in the interactive information, and the authentication server will carry new information encryption and decryption keys in the response information after receiving the information, and the mobile phone token After the card receives the new key, it starts to use the new key to encrypt and decrypt the information.

(3) Security protocol information format

The protocol information format is shown in Figure 9. Information is divided into service request information and service response information, and each information is divided into two parts: information header and information body. The specific format is described as follows:

(1) Protocol header

Version: the version number of the protocol;

Header length: the length of the protocol information header;

Server ID: Use a unique ID to identify each server that provides dynamic authentication services;

Total length: the total length of the information, the reason why this field is set is to consider the expansion of the information body in the future;

(2) Service request information body

Service type: the 1st bit indicates the information type; the 2nd bit indicates whether the client requests information encryption key update or whether there is an updated key in the response message; 3-8 bits are information type bits;

Verification code: information is verified using byte summation;

Serial number: identify each request information to prevent response replay attacks;

User ID: user authentication account;

Registration code: The user's mobile phone token initialization is generated, the user's private data. The server uses the user ID and user verification code to confirm the user's identity;

(3) Service response information body

Service type: same as above;

Verification code: Same as above;

Serial number: copy the serial number in the request to ensure the one-to-one correspondence between the response and the request;

New key: carry the protocol information to encrypt the new key;

Server information: the response information returned by the server to the user, such as the current working password of the algorithm;

Claims (10)

1. A dynamic identity authentication method for a mobile phone token is realized by utilizing a computer technology and a mobile communication technology, and comprises the following steps:

(1) a user inputs user information at a user terminal and sends an identity authentication request to an identity authentication server;

(2) after receiving the authentication request, the identity authentication server firstly verifies the validity of the user information; if the user is a legal user, the identity authentication server generates and temporarily stores a current dynamic identity authentication password of the server side, and prompts the user to input the current dynamic identity authentication password of the user side at the user terminal;

(3) the user inputs an application module starting password in the mobile phone token and passes the identity authentication of the mobile phone token end;

(4) the user generates a current dynamic identity authentication password of the user side through the mobile phone token and informs the user through the mobile phone;

(5) the user inputs the informed current dynamic identity authentication password of the user side through the user terminal and transmits the password to the identity authentication server to wait for identity authentication;

(6) if the current dynamic identity authentication password of the user side received by the identity authentication server is consistent with the current dynamic identity authentication password of the server side, passing the identity authentication; otherwise, the authentication is not passed.

2. The method of claim 1, wherein: when the step (2) is carried out, if a legal user finds that the own account is locked, the legal user can apply for unlocking through the mobile phone token, and the steps are as follows:

1) a user inputs a mobile phone token client application module starting password and passes the identity authentication of a mobile phone token end;

2) a user sends an 'application account unlocking request' message to an authentication server through a mobile phone token;

3) the authentication server receives the information of the 'application account unlocking request' and then verifies the validity of the information;

4) the authentication server sets a 'user state' field of the user to be in an unlocking state in a user information database, and then sends 'application account unlocking response' information to the user;

5) the mobile phone token receives the information of 'application account unlocking response' and prompts the user that the unlocking is successful.

3. The method according to claim 1 or 2, characterized in that: when the step (3) is performed, if the user finds that the dynamic identity authentication service is not started, the dynamic identity authentication service should be started, and the steps are as follows:

1) a user inputs a mobile phone token client application module starting password and passes the identity authentication of a mobile phone token end;

2) a user sends a request for opening dynamic identity authentication service to an authentication server through a mobile phone token;

3) the authentication server receives the information of 'starting dynamic identity authentication service request' and then verifies the validity of the information;

4) the authentication server marks the authentication mode of the user as a dynamic identity authentication mode in a user database, and then sends 'start dynamic identity authentication service response' information to the mobile phone token;

5) and the mobile token receives the response information of starting the dynamic identity authentication service and prompts that the dynamic identity authentication service is started.

4. The method of claim 3, wherein: in the process of identity authentication, if a legal user finds that the legal user can not pass the authentication after passing correct operation, the user can use a mobile token to request system synchronization, and the steps are as follows:

1) a user inputs a mobile phone token client application module starting password and passes the identity authentication of a mobile phone token end;

2) a user sends information of applying for a system synchronization request to an authentication server through a mobile phone token;

3) the authentication server receives the information of applying for the system synchronization request and then verifies the validity of the information;

4) the authentication server takes out the current working password of the dynamic electronic password of the server from the user information database;

5) the authentication server generates 'application system synchronous response' information, writes the current working password of the dynamic electronic password of the server end into a 'server side information' field in the information, and then sends response information to the user;

6) and after receiving the 'application system synchronous response' information, the mobile phone token extracts the current working password of the dynamic electronic password in the information, and sets the current working password value of the dynamic electronic password at the mobile phone token end as the current working password extracted from the information, thereby completing system synchronization.

5. The method of claim 4, wherein: in the process of identity authentication, if the dynamic identity authentication service is to be cancelled, the steps are as follows:

1) a user inputs a mobile phone token client application module starting password and passes the identity authentication of a mobile phone token end;

2) a user sends a request for canceling the dynamic identity authentication service to an authentication server through a mobile phone token;

3) the authentication server receives the information of canceling the dynamic identity authentication service request and then verifies the validity of the information;

4) the authentication server marks the authentication mode of the user as a fixed password identity authentication mode in a user information database, and then sends 'cancel dynamic identity authentication service response' information to the mobile phone token;

5) the mobile phone token receives the information of canceling the dynamic identity authentication service response and prompts that the dynamic identity authentication service is canceled.

6. The method of claim 5, wherein: in the process of identity authentication, if the dynamic identity authentication process is to be stopped, the steps are as follows:

1) the user inputs a preset stopping instruction of the mobile phone token, and the token system stops the authentication process;

2) the user inputs and transmits a request for stopping the dynamic identity authentication service to the identity authentication server through the user terminal;

3) and after receiving the request for stopping the dynamic identity authentication service, the authentication server stops the authentication process of the server side.

7. The method of claim 6, wherein: when the step (3) is carried out, if the user finds that the mobile phone token of the user is locked, the user can unlock the mobile phone token through the mobile phone token, and the steps are as follows:

1) the user inputs a preset registration password of the mobile phone token, and the authentication is carried out through the mobile phone token:

2) the mobile phone token sets the 'user state' field in the mobile phone token to be in an unlocking state, and then informs the user of 'unlocking response' information through the mobile phone.

8. A system for implementing the method of claim 1, comprising a user terminal, a user information server, an authentication server and a mobile token; wherein,

the user terminal is used for inputting user information and is communicated with the identity authentication server through a network;

the user information server is used for storing a table set according to the identity authentication protocol, providing each user information required in the authentication process and receiving the operation of the authentication server;

the authentication server is responsible for receiving and completing a service request of a user, and is provided with an authentication server side service module, a password generation module and a communication module; the authentication server side service module is used for network transmission control, authentication system security protocol processing, information transmission encryption and decryption, user information access and dynamic password acquisition and temporary storage; the password generation module is responsible for generating a current dynamic identity authentication password of the server end and is communicated with the authentication server through a bus of the server; the communication module is responsible for sending and receiving information of the authentication server end and is an intermediary for communication between the mobile phone token and the authentication server;

the mobile phone token is a user mobile phone with a dynamic identity authentication client application module arranged in an SIM card of the mobile phone, the dynamic identity authentication client application module and a password generation module in an authentication server use the same dynamic password generation algorithm and the same current working password, and independently generate a synchronous current dynamic identity authentication password.

9. The system of claim 8, wherein: the authentication server side service module comprises a user information management module (8), a dynamic password access module (9), a protocol processing module (10), a core management module (11), an encryption module (12) and a network transmission module (13);

the user information management module (8) is responsible for completing user information management commands of the core management module (11), including establishing a new account, modifying existing account information, deleting outdated account information, locking or unlocking a user account number and controlling user access authority;

the dynamic password access module (9) is an access module of the password generation module, receives the user key information provided by the core management module (11), generates a dynamic password in the authentication process, and sends the dynamic password to the core management module (11) for temporary storage;

the protocol processing module (10) is a service processing end of a dynamic identity authentication system security protocol and is used for receiving security protocol information provided by the core management module (11) and returning a processing result to the core management module (11);

the encryption module (12) is used for completing the information encryption and decryption request of the core management module (11);

the network transmission module (13) is used for completing information transmission tasks of a server end, receiving network information and information of a communication module in the authentication server, processing an information transmission request of the core management module (11), and sending different types of information to different communication networks;

the core management module (11) is responsible for coordinating the interrelation and information transfer among the modules.

10. The system according to claim 8 or 9, characterized in that: the dynamic identity authentication client application module in the mobile token comprises a dynamic password generator (14), a memory (15), a password comparator (16) and a controller (17);

the memory (15) is used for storing a user ID, a user identity card number, a registration password Pr and an encryption key Ke, and is responsible for storing a current working password Ks for generating a current dynamic identity authentication password, a starting password of a client application module or a mobile phone token password Pt and the number Nt of times of continuously and wrongly inputting a token access password on a token; it is connected with a dynamic password generator (14), a password comparator (16) and a controller (17);

the dynamic password generator (14) is used for generating a current authentication password of the user from the current working password Ks, the authentication password corresponds to the current authentication password of the server, and the authentication password is informed to the user through an output device of the mobile phone;

the password comparator (16) is used for judging whether the mobile phone user is legal or not;

the controller (17) is used for controlling the coordination work of the modules.

Images