CN111147482A - OTP algorithm-based identity identification code generation and verification method - Google Patents
OTP algorithm-based identity identification code generation and verification methodDownload PDFInfo
- Publication number
- CN111147482A CN111147482ACN201911357560.1ACN201911357560ACN111147482ACN 111147482 ACN111147482 ACN 111147482ACN 201911357560 ACN201911357560 ACN 201911357560ACN 111147482 ACN111147482 ACN 111147482A
- Authority
- CN
- China
- Prior art keywords
- identification code
- client
- key
- server
- digit
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04J—MULTIPLEX COMMUNICATION
- H04J3/00—Time-division multiplex systems
- H04J3/02—Details
- H04J3/06—Synchronising arrangements
- H04J3/0635—Clock or time synchronisation in a network
- H04J3/0638—Clock or time synchronisation among nodes; Internode synchronisation
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer And Data Communications (AREA)
Abstract
Translated fromChinese
Description
Technical Field
The invention relates to the field of application software system development, in particular to an identity identification code generating and verifying method based on an OTP algorithm.
Background
With the rapid development of mobile internet, the application of two-dimensional codes to identity recognition scenes is very common, and the two-dimensional codes are widely applied to a plurality of application fields such as travel, consumption payment, attendance access control, electronic ticketing and the like at present. The two-dimensional code has the characteristics of large information carrying capacity, easiness in manufacturing, low cost, accuracy in decoding and the like, can conveniently encode information into the two-dimensional code, is convenient for information transmission and circulation, and is suitable for popularization and application in various application fields. However, with the continuous development of information technology, the two-dimensional code also faces the related problems of information leakage, network limitation on the use scene, and the like.
The existing common technical scheme comprises:
1. the client (APP or H5 application which needs to use the identification code) requests the server interface to generate the corresponding identification code through the network. The identification code is a string of character strings generated by the server. (usually a string of characters containing service information)
2. The client applies for the identification codes in batches to the server interface through the network, caches the identification codes to the local, and directly uses the identification code information cached locally if the network is unavailable.
Most of the existing technical schemes are to request a server side to make codes through a network when a client side needs to use an identification code. The identification code is a string which is generated by the server and uniquely contains the service information. The premise of using the method is that the network is available, the code making request cannot be carried out if the client network is unavailable, and the identification code contains service information, so that the risk of information leakage exists.
In order to solve the problems of information leakage and network unavailability, the prior art also provides some solutions, such as encrypting the identification code, and requesting the identification code to be cached locally in batch when the network is available. Although these solutions can solve the above problems to some extent, the following problems still exist:
1. after the identification code is encrypted, the conventional bar code scanning gun cannot identify and read, and the identification code cannot be manually input under the condition that the scanning equipment fails.
2. The batch request identification is cached locally, the validity period of the identification code is difficult to determine, a large number of invalid code making requests are generated when the validity period is too short, and the risk of illegal use of the local identification code due to theft exists when the validity period is too long.
Disclosure of Invention
In view of the above, an object of the present invention is to provide an identity code generating and verifying method based on OTP algorithm, which can reduce the risk of information leakage to the greatest extent and can be used in a poor network environment or no network environment of a client.
The invention is realized by adopting the following scheme: an identity identification code generating and verifying method based on an OTP algorithm comprises the following steps:
step S1: after the client successfully logs in, time synchronization is carried out with the server, and the time consistency between the client and the server is ensured;
step S2: the server generates 10 groups of fixed and non-repeated prime numbers PN, and the prime numbers are numbered in sequence from 0 to 9; generating 10 groups of fixed and non-repeated OTP algorithm KEYs KEY [ ], and numbering in sequence, wherein the numbering is from 0 to 9;
step S3: the client side sends a parameter request to the server side, and the server side obtains a corresponding prime number and a key according to the UID of the client side;
step S4: the client stores the prime number, the key and the serial number locally;
step S5: the client generates an identification code;
step S6: the client generates the identification code according to the steps S1 to S5 and then displays the identification code in a two-dimensional code or bar code form; and the identification end scans the two-dimensional code or the bar code and uploads the identified identification code to the server for verification.
Further, the step of obtaining the corresponding prime number and the key in step S3 includes the following steps:
step SA: modulus is taken for the UID of the client by 10 to obtain a remainder;
step SB: the remainder is used as a prime number PN of the corresponding number generated in the number searching step S2;
step SC: the remainder is used as a KEY KEY of the corresponding number generated in the number searching step S2;
step SD: and returning the found prime number PN, OTP KEY KEY and serial number NO to the client.
Further, the specific content of the generated id in step S5 is:
generating a 6-bit one-time dynamic password:
p = Totp (K, TC), K being the OTP KEY, TC being the counter TC = (T-T0)/T1; t is the current timestamp, T0 start time is typically 0, T1 time interval;
generating a 2-bit random number:
r = Random (2), 2-digit Random number, not repeated within 1 minute;
identification code PIN = [ prime number PN (6-bit one-time dynamic password P + 2-bit random number R) + identification UID ] | number NO | | 2-bit random number R
Wherein, | | represents concatenation, concatenates random number, serial number in the back.
Further, the step S6 of verifying the received id code by the server specifically includes the following steps:
step Sa: selecting the third last digit of the identity identification code as a serial number NO, and acquiring a corresponding prime number PN and an OTP KEY KEY stored by the server according to the serial number NO; selecting the second last digit as a 2-digit random number R;
and Sb: intercepting the last 3 bits of the identification code PIN, and taking the rest digits as a temporary identification code TPIN;
step Sc: acquiring a 6-bit one-time dynamic password:
p = temporary identity code TPIN/prime PN-2 bit random number R;
the server side calculates a 6-bit one-time dynamic password by using a Totp algorithm:
p1= Totp (K, TC), K being the OTP KEY, TC being the counter;
comparing whether P1 is equal to P, if not, responding the result of verification failure to the client; if equal, continuing to execute step Sd;
step Sd: calculating a client UID: modulus is taken between the temporary identity identification code TPIN and the prime number PN, and the obtained remainder is the client UID; client UID = temporary identity code TPIN mod prime number PN;
step Se: and inquiring specific identity information corresponding to the UID according to the client UID obtained in the step Sd, and responding identity identification verification information to an identification end.
Compared with the prior art, the invention has the following beneficial effects:
(1) the identity identification code of the invention is composed of a group of pure numbers, does not contain plaintext service information, cannot analyze specific service meaning, and reduces information leakage risk to the greatest extent.
(2) The identity identification code is generated by the client according to the specific algorithm rule, is not limited by network availability, and can be used under the conditions of poor network environment or no network of the client.
(3) The identity identification code has timeliness and is dynamically generated, so that the risks of copying, stealing and malicious spreading and use of the identity identification code are reduced to the greatest extent.
(4) The invention gives consideration to the use cost, and the identification code is a group of pure numbers, so that the traditional bar code scanning gun can be directly used for reading and identifying, the upgrading and the reconstruction of identification equipment are not needed, the cost is reduced, and the application and the popularization are convenient.
Drawings
Fig. 1 is a flowchart of identification code generation according to an embodiment of the present invention.
Fig. 2 is a flowchart illustrating an identification code verification method according to an embodiment of the present invention.
Detailed Description
The invention is further explained below with reference to the drawings and the embodiments.
It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the disclosure. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments according to the present application. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.
As shown in fig. 1, the present embodiment provides an identity code generation and verification method based on OTP algorithm, which includes the following steps:
step S1: after the client successfully logs in, time synchronization is carried out with the server, and the time consistency between the client and the server is ensured;
step S2: the server generates 10 groups of fixed and non-repeated prime numbers PN, and the prime numbers are numbered in sequence from 0 to 9; (the generated prime number is larger than the total number of the servers needing identification, for example, if one server has 100 ten thousand members needing identification, each generated prime number is larger than 100 ten thousand);
generating 10 groups of fixed and non-repeated OTP algorithm KEYs KEY [ ], and numbering in sequence, wherein the numbering is from 0 to 9;
step S3: the client side sends a parameter request to the server side, and the server side obtains a corresponding prime number and a key according to the UID (a string of numbers capable of uniquely identifying the client side, such as a personnel number, an equipment number and the like) of the client side;
step S4: the client stores the prime number, the key and the serial number locally;
step S5: the client generates an identification code;
step S6: the client generates the identification code according to the steps S1 to S5 and then displays the identification code in a two-dimensional code or bar code form; and the identification end scans the two-dimensional code or the bar code and uploads the identified identification code to the server for verification.
Preferably, in this embodiment, the client may be application software or APP, H5, the identification end is a cash register system, an access control device, and the like, and the server is a program deployed on the server.
In this embodiment, the step of obtaining the corresponding prime number and the key in step S3 includes the following steps:
step SA: taking the module of the client UID (UIDmod 10) by 10 to obtain a remainder;
step SB: the remainder is used as a prime number PN of the corresponding number generated in the number searching step S2;
step SC: the remainder is used as a KEY KEY of the corresponding number generated in the number searching step S2;
step SD: and returning the found prime number PN, OTP KEY KEY and serial number NO to the client.
In this embodiment, the specific content of the generated id in step S5 is:
generating a 6-bit one-time dynamic password:
p = Totp (K, TC), K being the OTP KEY, TC being the counter TC = (T-T0)/T1; t is the current timestamp, the start time of T0 is generally 0, and the T1 time interval is self-defined (e.g., 30 seconds, 1 minute, etc.) according to the service;
generating a 2-bit random number:
r = Random (2), 2-digit Random number, not repeated within 1 minute;
identification code PIN = [ prime number PN (6-bit one-time dynamic password P + 2-bit random number R) + identification UID ] | number NO | | 2-bit random number R
Wherein, | | represents concatenation, concatenates random number, serial number in the back.
Preferably, in this embodiment, the identification code generation example is as follows:
P=726835，R=42，PN=25478448917，UID=10003045，NO=3
PIN = 25478448917*(726835+42)+ 10003045 || 3 || 42
=18519698523445254342
as shown in fig. 2, in this embodiment, the step of verifying the received id code by the server side in step S6 specifically includes the following steps:
step Sa: selecting the third last digit of the identity identification code as a serial number NO, and acquiring a corresponding prime number PN and an OTP KEY KEY stored by the server according to the serial number NO; selecting the second last digit as a 2-digit random number R;
and Sb: intercepting the last 3 bits of the identification code PIN, and taking the rest digits as a temporary identification code TPIN;
step Sc: acquiring a 6-bit one-time dynamic password:
p = temporary identity code TPIN/prime PN-2 bit random number R;
the server side calculates a 6-bit one-time dynamic password by using a Totp algorithm:
p1= Totp (K, TC), K being the OTP KEY, TC being the counter;
comparing whether P1 is equal to P, if not, responding the result of verification failure to the client; if equal, continuing to execute step Sd;
step Sd: calculating a client UID: modulus is taken between the temporary identity identification code TPIN and the prime number PN, and the obtained remainder is the client UID; client UID = temporary identity code TPIN mod prime number PN;
step Se: and inquiring specific identity information corresponding to the UID according to the client UID obtained in the step Sd, and responding identity identification verification information to an identification end.
Preferably, in this embodiment, the identification code verification example is as follows:
PIN=18519698523445254342
the calculation result derived by the above-mentioned check rule is as follows
NO =3, random number R =42, temporary identification code TPIN =18519698523445254
The corresponding prime number PN (this example PN = 25478448917) is found by the number NO =3, and the corresponding OTP KEY is found.
6-bit one-time password P = TPIN/PN-R
=18519698523445254/25478448917-42
=726835
And calculating P1= Totp (OTP KEY KEY) through the inquired corresponding KEY KEY, comparing whether the KEY is equal to P, P1, and if the KEY is not equal to the OTP KEY KEY, indicating that the KEYs of the two parties are inconsistent or the identification code is expired, determining that the verification fails. And if yes, continuing the UID.
UID= TPIN mod PN = 18519698523445254 mod 25478448917=10003045
The UID can inquire the specific identity information corresponding to the PIN.
Preferably, the embodiment provides a string of numbers that uniquely identifies a person or an object in the application software system). The method is based on the OTP algorithm, has time efficiency, is purely digital and supports the offline use of the network. The identification code is a set of numbers that are generated at the client using certain algorithm rules, and each code is time-sensitive (e.g., 1 minute). Because the identification code is generated at the client, the network is not required to be relied on. The pure digital and time-efficient information leakage is reduced to the greatest extent, and the use in a non-network environment is supported. The mode of generating and verifying the identification code can be widely applied to business scenes of identification such as consumption payment (payment code), access control attendance, electronic ticketing and the like.
The above description is only a preferred embodiment of the present invention, and all equivalent changes and modifications made in accordance with the claims of the present invention should be covered by the present invention.
Claims (4)
Translated fromChinesePriority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911357560.1ACN111147482A (en) | 2019-12-25 | 2019-12-25 | OTP algorithm-based identity identification code generation and verification method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911357560.1ACN111147482A (en) | 2019-12-25 | 2019-12-25 | OTP algorithm-based identity identification code generation and verification method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111147482Atrue CN111147482A (en) | 2020-05-12 |
Family
ID=70519982
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911357560.1APendingCN111147482A (en) | 2019-12-25 | 2019-12-25 | OTP algorithm-based identity identification code generation and verification method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111147482A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112907345A (en)* | 2021-03-30 | 2021-06-04 | 携程商旅信息服务（上海）有限公司 | Method, system, device and medium for ticket settlement based on identification code |
| CN120074965A (en)* | 2025-04-29 | 2025-05-30 | 晨羽智云(杭州)科技有限公司 | AI workflow model transaction platform confidentiality method and system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105827591A (en)* | 2016-02-22 | 2016-08-03 | 北京启迪思创科技有限公司 | Identity authentication method, client side, server and system |
| US20160330195A1 (en)* | 2013-12-02 | 2016-11-10 | Gemalto Sa | System and method for securing offline usage of a certificate by otp system |
| CN107180351A (en)* | 2017-04-13 | 2017-09-19 | 上海动联信息技术股份有限公司 | A kind of off line Dynamic Two-dimensional code generating method, method of payment and equipment |
| CN107818463A (en)* | 2017-09-25 | 2018-03-20 | 九派天下支付有限公司 | A kind of offline electronic payment method and system based on TOTP algorithms |
| CN109766979A (en)* | 2019-01-18 | 2019-05-17 | 北京思源互联科技有限公司 | Two-dimensional code generation method, verification method and device |
| CN110046532A (en)* | 2019-04-25 | 2019-07-23 | 深圳左邻永佳科技有限公司 | All-purpose card two dimensional code generates and read method |
- 2019
- 2019-12-25CNCN201911357560.1Apatent/CN111147482A/enactivePending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20160330195A1 (en)* | 2013-12-02 | 2016-11-10 | Gemalto Sa | System and method for securing offline usage of a certificate by otp system |
| CN105827591A (en)* | 2016-02-22 | 2016-08-03 | 北京启迪思创科技有限公司 | Identity authentication method, client side, server and system |
| CN107180351A (en)* | 2017-04-13 | 2017-09-19 | 上海动联信息技术股份有限公司 | A kind of off line Dynamic Two-dimensional code generating method, method of payment and equipment |
| CN107818463A (en)* | 2017-09-25 | 2018-03-20 | 九派天下支付有限公司 | A kind of offline electronic payment method and system based on TOTP algorithms |
| CN109766979A (en)* | 2019-01-18 | 2019-05-17 | 北京思源互联科技有限公司 | Two-dimensional code generation method, verification method and device |
| CN110046532A (en)* | 2019-04-25 | 2019-07-23 | 深圳左邻永佳科技有限公司 | All-purpose card two dimensional code generates and read method |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112907345A (en)* | 2021-03-30 | 2021-06-04 | 携程商旅信息服务（上海）有限公司 | Method, system, device and medium for ticket settlement based on identification code |
| CN120074965A (en)* | 2025-04-29 | 2025-05-30 | 晨羽智云(杭州)科技有限公司 | AI workflow model transaction platform confidentiality method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR102180658B1 (en) | Secure collection of sensitive data | |
| US11455621B2 (en) | Device-associated token identity | |
| CN115811412B (en) | Communication method and device, SIM card, electronic equipment and terminal equipment | |
| JP2005062556A (en) | Authentication system, server, authentication method, and program | |
| CN104270338A (en) | Method and system for electronic identity registration and authentication login | |
| CN109413096A (en) | A kind of login method and device more applied | |
| CN101291217A (en) | Network identity authentication method | |
| US20220374872A1 (en) | Platform for building decentralized applications | |
| CN112311779B (en) | Data access control method and device applied to block chain system | |
| CN111147482A (en) | OTP algorithm-based identity identification code generation and verification method | |
| CN115695371A (en) | Domain name registration and domain name resolution method, device, system, equipment and storage medium | |
| WO2023029476A1 (en) | Method for determining account information when user is in non-login state, and system | |
| CN113761549B (en) | Interface safety control and verification method and device | |
| CN113159865A (en) | Card coupon verification method based on two-dimensional code | |
| CN112561525A (en) | Block chain biological face recognition method and system | |
| US20190268323A1 (en) | On demand multifactor authentication | |
| JP2002007342A (en) | User side device, service providing side device and recording medium | |
| CN113904840A (en) | Signature-based hospital tamper-proof request verification system | |
| WO2017118763A1 (en) | System, method and apparatus for data transmission | |
| US10764283B1 (en) | Monitoring to trigger on demand multifactor authentication | |
| CN115801333B (en) | A business account application method based on legal identity | |
| CN117474135B (en) | Hotel management method and system based on blockchain | |
| TWI791905B (en) | Authentication access system and method based on tokenization technology | |
| CN111800256B (en) | Old people two-dimensional code electronic license application method and system | |
| US20220383327A1 (en) | Method and device for transmitting an identifier of a user during an electronic payment made by the user. |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | Application publication date:20200512 | |
| RJ01 | Rejection of invention patent application after publication |