TW201414328A - System for generating one time password and generating method using for the same - Google Patents

Abstract

A system for generating one time password (OTP) includes an intellectual mobile device and a store card, wherein the intellectual mobile device and the store card interconnect with each other in non-physical contact manner. The store card stores therein an algorithm, which is used to generate the OTP. When an OTP is required, user makes the store card in proximity to the intellectual mobile device, and the store card can receive wirelessly electrical power and a time-parameter from the intellectual mobile device within a certain range. The store card is turned-on through receiving the electrical power from the intellectual mobile device, and generates the OTP in accordance with the algorithm therein and the received time-parameter after it is turned-on.

Description

One-time password generation system and its production method

The present invention relates to a one-time password, and more particularly to a generation system and a production method for generating a one-time password by using a mobile device and a memory card.

Nowadays, the Internet is developed, and users can control various electronic devices, such as personal computers, tablets, or smart mobile phones, to connect to the Internet. Even if the user is at home, they can perform various tasks through the Internet, such as shopping, paying, or logging into an online bank to manage bank accounts.

Taking the above-mentioned online banking as an example, when using the online banking service, in order to be safe, all kinds of authentication mechanisms are used to confirm the user's usage rights, and in the existing verification mechanism, Password verification is the most convenient and most common. When an online transaction program proceeds to the verification step, the user simply enters the password and uploads it to the backend server for verification, and then completes the entire network transaction process after the verification is passed.

In order to improve the security of passwords, the one-time password (OTP) usage mode is the most common. OTP mainly puts specific parameters into a specific algorithm to dynamically calculate a password, and the parameters used in different time, situation or event are different, so the calculated OTP is also different. Avoid the problem of being stolen with a fixed password. On the server at the back end, a verification password is calculated with the same parameters and the same algorithm, and compared with the OTP uploaded by the user to determine whether the OTP input by the user is correct.

It is common in the market to put an identification code in an external token. When the user needs to use the OTP, the auxiliary tool transmits the verification code to the user's mobile phone or The computer then uses the verification code as a parameter by the software inside the mobile phone or the computer to calculate a set of OTP for the user to use. However, such a problem is that as long as the value is calculated by the software, an intermediate value that is easily stolen is generated. What's more, if a mobile phone or computer is invaded by a hacker or is implanted with a virus, it is more likely that the entire OTP calculation process will be cracked, and then it will be faked as a fake auxiliary tool.

In view of this, there is an urgent need in the market for a novel mechanism for users to improve the security of the OTP process and its use without compromising convenience when using OTP for verification.

The main object of the present invention is to provide a one-time password generating system and a generating method thereof, which can be calculated by a separate memory card and generate a one-time password for use by a user, thereby reducing one-time operation by a mobile device. When you use a password, you are at risk of being stolen or cracked by a third person.

To achieve the above objective, the present invention mainly includes a smart mobile device and a memory card, wherein the smart mobile device and the memory card can be communicatively connected through a contactless transmission interface. The memory card stores an algorithm for generating a one-time password. When the user needs to use the one-time password, the memory card is brought close to the smart mobile device, so that the smart mobile device transmits power and a time parameter to the storage through the transmission interface. card. The memory card can be started after receiving power and calculated by the received time parameters and an internal algorithm to generate a set of one-time passwords.

The effect achieved by the present invention over the prior art is that the algorithm required to generate the one-time password is stored by a separate memory card, and after receiving the externally supplied power and time parameters, the calculation is performed directly on the memory card. And generate a set of one-time passwords. Thereby, the operation program of the one-time password is not required to be executed by the user's mobile device, so that the mobile device can be prevented from being eavesdropped or implanted with a virus, thereby being stolen or even cryptographically operated during the generation of the password. The risk of the program being cracked.

DETAILED DESCRIPTION OF THE INVENTION A preferred embodiment of the present invention will be described in detail with reference to the drawings.

Referring first to the first figure, a system architecture diagram of a preferred embodiment of the present invention is shown. The One Time Password (OTP) generation system of the present invention mainly includes a smart mobile device 1 (hereinafter referred to as the mobile device 1 in the specification) and a memory card 2. The invention provides a set of OTPs for the user to use when the user executes a network transaction program on the network and needs to use an OTP to verify the identity. The mobile device 1 and the memory card 2 can be used to generate a set of OTPs for the user to use. Moreover, as shown in the first figure, the user can execute the network transaction program mainly through the mobile device 1, or use an additional computer device 4 to execute the network transaction program, which should not be limited. However, regardless of which electronic device the user performs the network transaction program, the OTP can be generated and used by the mobile device 1 and the memory card 2 of the present invention.

The memory card 2 referred to in this embodiment may be a card in which a numerical value or data is stored, such as a chip card, a leisure card, etc., and a transmission interface capable of communicating with the mobile device 1 is disposed thereon. . However, the memory card 2 can also be a token specially made by the manufacturer, and is only used to generate the OTP, and should not be limited.

Please refer to FIG. 2A, which is a schematic diagram of a network transaction page according to a preferred embodiment of the present invention. In the second figure A, the mobile device 1 is executed by the mobile device 1 as an example. When the user executes the online transaction program through the mobile device 1, the network transaction page W1 is mainly entered, and the user can input one or more transaction materials D1 in the network transaction page W1. For example, as shown in the figure, the online bank transfer page is taken as an example, and the transaction data D1 can be transferred to an account number and transferred amount, but is not limited. In the implementation of the above network transaction procedure, for security reasons, the banker can ask the user to input a set of OTPs for verification. After the verification is passed, the mobile device 1 is allowed to continue to execute the network that has not been completed. Trading procedures.

In this embodiment, the user can generate a set of OTPs through the memory card 2, and perform verification by using the OTP. More specifically, as shown in FIG. 2A, when the OTP is required to be used, the mobile device 1 can instruct the user to turn on a contactless transmission module on the mobile device 1, such as near field communication ( Near Field Communication (NFC) module, and the mobile device 1 is brought close to the memory card 2. Thereby, the mobile device 1 can provide information to the memory card 2, and the storage card 2 generates a set of OTPs and transmits them back to the mobile device 1. The mobile device 1 directly uploads the OTP to the mobile device 1. The verification server 4 is used for verification. In this embodiment, the OTP can be automatically uploaded by the mobile device 1, so that the manual input by the user can be omitted to avoid input errors. Moreover, by this technical means, the OTP is not displayed, so the risk that the OTP is peeped by a third person can be reduced. However, the above description is only a preferred embodiment of the present invention and should not be limited.

Please refer to FIG. 2B, which is a schematic diagram of a password display page according to a preferred embodiment of the present invention. In another embodiment, the user can execute the network transaction program through the computer device 3, and when the user needs to perform verification through the OTP, the mobile device 1 and the memory card 2 are used to generate the network transaction program. OTP. As shown, the memory card 2 can be automatically transmitted back to the mobile device 1 after the OTP is generated, and displayed by a screen 10 on the mobile device 1. For example, as shown in FIG. 2B, after receiving the OTP returned by the memory card 2, the mobile device 1 opens a password display page W2 and displays an OTP on the password display page W2 (for example, as shown in the figure). 12345678"). The user can view the screen 10 on the mobile device 1 to obtain the OTP, and input the OTP into the computer device 3, and upload the computer device 3 to the verification server 4 for verification.

Referring to the third figure, a block diagram of a preferred embodiment of the present invention is shown. In this embodiment, the mobile device 1 and the memory card 2 can be mainly connected through a contactless transmission interface. More specifically, the mobile device 1 and the memory card 2 can establish wireless through the NFC interface. Connected, but not limited to this.

As shown in the figure, the memory card 2 mainly includes a microprocessor 21, an NFC transmission interface 22 and a memory 23, wherein the microprocessor 21 is electrically connected to the NFC transmission interface 22 and the memory 23. In the implementation side, the memory card 2 is mainly a card without a built-in battery. The memory 23 mainly stores an algorithm 231 for generating an OTP, and the memory 23 can be mainly a non-volatile memory. For example, Read Only Memory (ROM), the algorithm 231 can be permanently saved even if the memory card 2 does not have a built-in battery.

The mobile device 1 has a corresponding NFC module (not shown). When the NFC module is turned on and the memory card 2 is close to the mobile device 1, the mobile device 1 can be established with the memory card 2. Communication connection. Thereby, the memory card 2 can receive the power P1 transmitted by the mobile device 1 through the NFC transmission interface 22, and the microprocessor 21 can be activated by the power P1. After the memory card 2 is activated, a time parameter T1 transmitted by the mobile device 1 can be further received, so that the microprocessor 21 can calculate the time parameter T1 received and the calculation stored in the memory 23. Method 231 performs the calculation and produces a set of OTPs 20. The time parameter T1 is mainly the time used by the mobile device 1, and the OTP 20 is a time-based OTP, but is not limited. In this embodiment, the memory card 2 is mainly transmitted back to the mobile device 1 through the NFC transmission interface 22 after being generated by the OTP 20, and is displayed by the mobile device 1 or directly uploaded to the verification server 4 authenticating.

In this embodiment, a time rule conforming to the OATH protocol can be applied. For example, the mobile device 1 can generate a time stamp every 30 seconds, and the memory card 2 can use the time stamp as Parameters to generate the OTP20. More specifically, the mobile device 1 applies a corresponding time stamp parameter (not shown) according to the current time, and transmits the time stamp parameter to the memory card 2, whereby the memory card 2 is based on the time stamp. The algorithm and the algorithm 231 calculate and generate the OTP 20. However, the above description is only a preferred embodiment of the present invention and should not be limited thereto.

It is worth mentioning that if the mobile device is executed by the mobile device 1 , the mobile device 1 can transmit the power P1 and the time parameter T1 to the memory card 2 The transaction data D1 entered in the online transaction program. Thereby, the microprocessor 21 in the memory card 2 can calculate and generate the OTP 20 according to the transaction data D1, the time parameter T1 and the algorithm 231. However, the data to be used by the memory card 2 as the calculation parameter of the algorithm 231 should be determined according to actual needs, and should not be limited thereto. In this embodiment, when the OTP 20 is generated by the memory card 2, it is automatically transmitted back to the mobile device 1 and automatically uploaded by the mobile device 1 to the verification server 4 for verification. Thereby, after the verification server 4 verifies that the OTP 20 has passed and replies to the mobile device 1, the mobile device 1 can be allowed to continue to execute the network transaction program that has not been completed.

Please refer to the fourth figure at the same time, which is a flow chart of password generation according to a preferred embodiment of the present invention. As shown, if the OTP 20 is to be obtained by the method of the present invention, first, the NFC module on the mobile device 1 must be turned on, and the memory card 2 is brought close to the mobile device 1 so that the memory card 2 can be received. The power P1 transmitted from the outside and the time parameter T1 (step S10). More specifically, the mobile device 1 transmits the power P1 and the time parameter T1 to the memory card 2.

After the memory card 2 receives the power P1 transmitted by the mobile device 1, the microprocessor 21 therein can be activated according to the time parameter T1 and the algorithm 231, and the OTP 20 (step S12). Finally, the memory card 2 automatically transmits the OTP 20 after the OTP 20 is generated (step S14), and more specifically, the memory card 2 automatically transmits the calculated OTP 20 to the mobile device 1 (ie, , the power P1 and the provider of the time parameter T1). After receiving the OTP 20, the mobile device 1 can be displayed by the screen 10 on the mobile device 1 or directly uploaded to the verification server 4 for verification, and whether the user performs the network transaction through the mobile device 1 Depending on the program.

Continuing to refer to the fifth figure, a flow chart of password generation according to another preferred embodiment of the present invention. In this embodiment, the user executes the network transaction program through the mobile device 1 (step S20), and when the network transaction program executes to a specific step, the network transaction program requests the mobile device 1 to input. A set of OTPs for verification. At this time, the user can open the NFC module on the mobile device 1 and bring the memory card 2 close to the mobile device 1 to allow the memory card 2 to receive the power P1 transmitted by the mobile device 1 and start up according to the steps (steps). S22).

It is worth mentioning that after the memory card 2 is started, the user can be authenticated to confirm that the user has the right to request the OTP 20. As shown in the third figure, a memory key 232 is further stored in the memory 23 of the memory card 2. When the memory card 2 is activated, an identification code (Personal Identification Number, PIN) appears on the mobile device 1. The input window (not shown) allows the user to enter an identification code in the input window. After receiving the identification code input by the user, the mobile device 1 transmits the identification code to the memory card 2 for verification (step S24). After receiving the identification code, the memory card 2 mainly performs comparison verification with the internally stored key 232 to determine whether the identification code can pass the verification (step S26). If the identification code fails to pass the verification, that is, the comparison with the key 232 does not match, then the process returns to the step S24, requesting the user to re-enter a correct identification code on the mobile device 1, otherwise the memory card 2 will not The OTP20 generation program will be executed. If the identification code passes the verification, it means that the user has the request authority of the OTP 20, so the memory card 2 can further receive the data transmitted by the mobile device 1.

After the identification code passes the verification, the mobile device 1 transmits the time parameter T1 to the memory card 2 (step S28), whereby the memory card 2 can be based on the received time parameter T1 and the internally stored calculation The method 231 performs calculations and generates the OTP 20 (step S30). It is worth mentioning that, in this embodiment, the network transaction program is mainly executed by the mobile device 1, such as network remittance, transfer, or inquiry balance, etc., in addition to the time parameter T1 described above, the storage The card 2 can also simultaneously receive the transaction data D1 input by the mobile device 1 in the online transaction program. Thereby, the memory card 2 can calculate and generate the OTP 20 according to the transaction data D1, the time parameter T1 and the algorithm 231 at the same time.

After the step S30, the memory card 2 automatically transmits the OTP 20 to the mobile device 1 through the NFC transmission interface 22 (step S32), and the mobile device 1 automatically uploads the OTP 20 to the verification server 4, The verification operation is performed (step S34). In this embodiment, the verification server 4 stores the same algorithm 231 as in the memory card 2, and therefore, after the verification server 4 receives the OTP 20, it can be based on the same parameter (for example, the time parameter). T1 and/or the transaction data D1) are nested into the same algorithm 231 for calculation to obtain a set of verification OTPs. In this way, the verification server 1 can determine whether the OTP 20 uploaded by the mobile device 1 can pass the verification by comparing the OTP 20 with the verification OTP (step S36).

If the OTP 20 fails to pass the verification, the network transaction program cannot be successfully executed; conversely, if the verification server 4 verifies that the OTP 20 passes and responds to the mobile device 1, the mobile device 1 is allowed to continue to execute yet. The completed network transaction procedure (step S38).

Through the above method, after the memory card 2 is close to the mobile device 1, the OTP 20 can be automatically generated and uploaded to the verification server 4 for verification. In other words, the user can automatically complete the verification process by simply turning on the NFC module on the mobile device 1 (or setting the NFC module to be normally turned on) and bringing the memory card 2 close to the mobile device 1. And let the mobile device 1 continue to execute the network transaction program. In the above process, the user does not even need to know the actual value of the OTP 20, and does not need to manually input, so that the problem that the third person is stolen or the user input is incorrect and the verification cannot be passed can be avoided.

Please refer to the sixth and seventh figures, which are respectively a system architecture diagram of another preferred embodiment of the present invention and a password generation flowchart of still another preferred embodiment. As shown in the sixth embodiment, another memory card 2' is disclosed in the embodiment, which is different from the memory card 2 in the above embodiment in that the memory card 2' further has a display unit 24 electrically connected to The microprocessor 21 is internal. The display unit 24 is configured to display the OTP 20 generated by the microprocessor 21, and in the embodiment, the display unit 24 is mainly implemented by an electronic paper, but is not limited thereto.

As shown in FIG. 7 , after the memory card 2 ′ is close to the mobile device 1 , the memory card 2 ′ can receive the power P1 and the time parameter T1 transmitted by the mobile device 1 through the NFC transmission interface 22 (steps). S40). After the step S40, the microprocessor 21 inside the memory card 2' is started by receiving the power P1, and is calculated according to the received time parameter T1 and the internally stored algorithm 231, and is generated. The OTP 20 described above (step S42).

The difference from the foregoing embodiment is that after the OTP 20 is generated, the memory card 2' does not return the OTP 20 to the mobile device 1, but displays the OTP 20 on the display unit 24 (step S44). User view. Through the technical means of the embodiment, whether the user executes the network transaction program through the mobile device 1 or the computer device 3, the OTP 20 can be viewed by the display unit 24 on the memory card 2', and manually It is input to the corresponding field and uploaded to the verification server 4 for verification. After the verification server 4 verifies that the OTP 20 has passed, the mobile device 1 and the computer device 3 can be allowed to continue to execute the network transaction program that has not been completed.

As described above, the one-time password generating system of the present invention mainly has the following three embodiments:

1. The mobile device 1 and the memory card 2 are regarded as an automatic verification device of the OTP. After the OTP 20 is generated by the memory card 2, the OTP 20 is automatically transmitted back to the mobile device 1, and the mobile device 1 automatically Upload to the verification server 4 for verification. The user does not need to view the actual value of the OTP 20, and does not need to manually input the OTP 20 into the corresponding field on the mobile device 1 or the computer device 3, so as to avoid the OTP 20 being peeped, or the user manually inputting errors, etc. problem;

2. After the OTP 20 is generated by the memory card 2, the OTP 20 is automatically transmitted back to the mobile device 1 and displayed by the mobile device 1. After the user can view the OTP 20 on the mobile device 1, the corresponding field on the computer device 3 is manually input, and uploaded to the verification server 4 by the computer device 3 for verification. Thereby, the memory card 2 is regarded as a generation tool of the OTP 20, and the mobile device 1 is regarded as a display tool of the OTP 20;

3. The memory card 2' is regarded as an OTP creation token. When the memory card 2' generates the OTP 20, the display unit 24 is displayed thereon for viewing by the user. Therefore, the user can record the OTP 20 and input the OTP 20 into the corresponding field in the mobile device 1, the computer device 3 or other electronic devices, so that the OTP 20 can be applied to more electronic devices. .

The above is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Therefore, equivalent changes to the scope of the present invention are included in the scope of the present invention. Bright.

1. . . Mobile device

10. . . Screen

2, 2’. . . Memory card

20. . . One-time password

twenty one. . . microprocessor

twenty two. . . Near field communication transmission interface

twenty three. . . Memory

231. . . Algorithm

232. . . Key

twenty four. . . Display unit

3. . . Computer device

4. . . Authentication server

D1. . . Transaction data

P1. . . electric power

T1. . . Time parameter

W1. . . Online trading page

W2. . . Password display page

S10~S14. . . step

S20~S38. . . step

S40~S44. . . step

The first figure is a system architecture diagram of a preferred embodiment of the present invention.

FIG. 2A is a schematic diagram of a network transaction page according to a preferred embodiment of the present invention.

FIG. 2B is a schematic diagram of a password display page according to a preferred embodiment of the present invention.

The third figure is a block diagram of a preferred embodiment of the present invention.

The fourth figure is a flow chart of password generation according to a preferred embodiment of the present invention.

The fifth figure is a flow chart of password generation according to another preferred embodiment of the present invention.

Figure 6 is a system architecture diagram of another preferred embodiment of the present invention.

Figure 7 is a flow chart showing the generation of a password according to still another preferred embodiment of the present invention.

S10~S14. . . step

Claims (14)

A one-time password generating system includes a mobile device and a memory card, and the mobile device has a Near Field Communication (NFC) module, and the near field communication module can be stored when the near field communication module is turned on. The card performs a contactless communication connection, wherein the memory card includes:
a near field communication transmission interface, when the memory card is close to the mobile device, establishes a communication connection with the mobile device, and receives power and a time parameter transmitted by the mobile device, wherein the time parameter is a time used by the mobile device;
a memory storing an algorithm; and a microprocessor electrically connected to the near field communication transmission interface and the memory, the microprocessor is started after receiving the power transmitted by the mobile device, and is activated according to the startup The time parameter and the algorithm are calculated and a Time-based One Time Password (OTP) is generated. The system for generating a one-time password according to claim 1, wherein the memory card further comprises a display unit electrically connected to the microprocessor for displaying the one-time password. The system for generating a one-time password according to claim 2, wherein the display unit is electronic paper. The system for generating a one-time password according to claim 1, wherein the memory is a read only memory (ROM). The one-time password generating system of claim 1, further comprising a verification server connected to the mobile device via the Internet, the memory card being automatically returned to the mobile device after the one-time password is generated And the mobile device automatically uploads the one-time password to the verification server for verification. The one-time password generating system of claim 5, wherein the memory card further receives a transaction data input by the mobile device when executing a network transaction program, the microprocessor according to the transaction data, the time parameter, and The algorithm calculates and generates the one-time password, and when the verification server verifies that the one-time password has passed and responds to the mobile device, the mobile device is allowed to continue executing the network transaction program. The system for generating a one-time password according to claim 1, wherein the memory further stores a key for performing comparison verification with an identification code transmitted by the mobile device, and the memory card is associated with the identification. The time parameter transmitted by the mobile device is received after the code verification is passed. A method for generating a one-time password for a mobile device and a memory card, wherein the mobile device has a Near Field Communication (NFC) module, when the near field communication module is turned on, and the storage When the card is close to the mobile device, the mobile device performs a contactless communication connection with the memory card, wherein the memory card stores an algorithm, and the method for generating the one-time password includes:
a) the memory card receives the power transmitted by the mobile device and is activated accordingly;
b) receiving, by the memory card, a time parameter transmitted by the mobile device after starting; and
c) The memory card is calculated according to the time parameter and the algorithm, and generates a set of time-based one-time passwords. The method for generating a one-time password according to claim 8, wherein the memory card has a display unit, and the method for generating the one-time password further includes a step d: after the step c, displaying the one-time password on the display unit . The method for generating a one-time password according to claim 8, wherein the step c further comprises the following steps:
e) the memory card returns the one-time password to the mobile device; and
f) The mobile device displays the one-time password through the screen on it. The method for generating a one-time password according to claim 8, wherein the step b further includes the following steps:
g) the mobile device receives an externally input identification code and transmits the identification code to the memory card;
h) the memory card verifies the identification code; and
i) If the identification code passes verification, perform step b. The method for generating a one-time password according to claim 8, wherein the step a further includes the following steps:
A01) the mobile device performs an internet transaction procedure; and
A02) The network transaction program requests the mobile device to input the one-time password. The method for generating a one-time password according to claim 12, wherein in the step b, the storage card simultaneously receives a transaction data input by the mobile device in the network transaction program, and in the step c, the storing The card calculates and generates the one-time password based on the transaction data, the time parameter, and the algorithm. The method for generating a one-time password according to claim 12, wherein the step c further comprises the following steps:
j) the memory card returns the one-time password to the mobile device;
k) the mobile device automatically uploads the one-time password to a verification server for verification; and
l) After the one-time password is verified, the mobile device is allowed to continue executing the network transaction procedure.