WO2013117019A1

WO2013117019A1 - Method and device for system login based on dynamic password generated autonomously by user

Info

Publication number: WO2013117019A1
Application number: PCT/CN2012/071358
Authority: WO
Inventors: 宗祥后; 金栋; 方国平
Original assignee: Zong Xianghou; Jin Dong; Fang Guoping
Priority date: 2012-02-10
Filing date: 2012-02-20
Publication date: 2013-08-15
Also published as: CN102638447B; CN102638447A

Abstract

Disclosed are a method and device for system login based on a dynamic password generated autonomously by a user, which is based on at least one preset login rule defined autonomously by a user and dynamically generates a login password by providing random information to verify the dynamic password of the user. The present invention solves the problem of the password being unreliable caused by the fact that a random dynamic password always needs to be provided by a technician rather than a user himself/herself in the prior art, such as a so-called verification code and so on.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to all occasions where static, dynamic passwords are used as user logins, payment, electronic locks, and all electronic devices are turned on and the process security is secured. BACKGROUND OF THE INVENTION The use of passwords is ubiquitous in our lives, especially in today's digital age. It is becoming more common today. We need to perform these operations repeatedly every day, for example, we need to enter a password to open the phone, Enter the password to log in to the computer, need to enter the password to log in to the company's network, need to enter a password to log in to MSN or QQ or Fetion or Want Want chat, etc., need to enter a password to send and receive mail, need to enter a password to log in to the game website to play games, You need to enter a password to enter the office, you need to enter a password to access the Internet, pay online, and swipe your card. You must also enter a password on the ATM to log in to the user's account. Passwords are really important to each of us. It protects our privacy and protects our important information (such as keys for encryption, account information, etc.) from being stolen by others, protecting our people. The personal safety of the property. Most of the time, static passwords are used. Static passwords basically use fixed numbers and letter combinations, mainly for user account passwords, query passwords, and so on. There are usually some security risks in using these static passwords. First, for the convenience of memory, many users use the mobile phone number including their own (or family, good friends), fixed phone number, birthday date, and pinyin of the name. , learn well, job number, company or group name, etc. and passwords that are related to themselves and can be guessed as passwords. These are easily tried and exhausted by others through robot programs. Second, many people like to put one Passwords are used on a variety of applications, and even all systems use the same password. If it is intercepted and cracked by others, he may use this password to try to log in to other systems. The problem is that when your application's password is cracked, other applications will fall. Third, others often use peeks, deceptions, etc. to obtain the user's password. Fourth, internal staff may also illegally use the legal authorization to obtain the user's password in certain circumstances; Since the static password does not change during a certain period of time and can be used repeatedly, if it is accidentally leaked, it may be used by others, and the security is low. Therefore, a static password cannot fundamentally determine the identity of a user. As a result, in a specific situation, an individual can easily forge a fake identity or steal the identity of an existing user, thereby creating a huge economy and reputation for enterprises and individuals. loss. In our real life, when you go to an ATM machine to withdraw money, or when you spend money on a POS machine, there is often a habitual action, blocking the keyboard by hand, and then entering the password, in order to prevent others from being on the sidelines. Peep on. Once the password is obtained by others, it will result in the loss of property. In addition, for those who shop online, the most worrying thing is that they encounter a phishing website (counterfeit bank online banking interface), enticing users to enter an account number and password, so that others improperly obtained your account number and password. In order to solve the drawbacks of static passwords, there are now technologies that use dynamic passwords. The dynamic password is a special algorithm that generates a time-related, unpredictable random number combination every 60 seconds. Each password can only be used once, and 43200 passwords can be generated each day. It uses a dedicated hardware called dynamic tokens with built-in power, a cryptographic chip and a display. The authentication server uses the same algorithm to calculate the current valid password. The user only needs to input the current password displayed on the dynamic token into the client computer to implement identity authentication. Since the password used each time must be generated by a dynamic token, only the legitimate user holds the hardware, so the identity of the user can be considered reliable by password verification. Moreover, the password used by the user is different every time. Even if the hacker intercepts the password once, the password cannot be used to fake the identity of the legitimate user. However, the current technology does not use dynamic passwords in large-area cryptosystems. There are also some reasons for this. Dynamic passwords have some disadvantages: First, users need to have dynamic tokens for authentication. Second, dynamic passwords need one. The additional server accepts requests from the authentication server relay; again, the OTP (the secondary password) is expensive in large networks; again, once the dynamic token falls into the hands of others, it will be logged in by the identity of the person. , causing unnecessary losses; Finally, under coercive conditions, these measures are not technically feasible. In some specific applications, the prior art login device or method also has drawbacks: For example, in our daily life, mobile phones and computers are our necessary tools, in order to prevent others from using my mobile phone and computer, often You need to enter your password when you turn it on. In addition, some important personal information, such as the mobile phone's electronic key, is stored in our mobile phone and computer. In this application, we store all the electronic keys around us. If you log in easily, it is equivalent to getting the key to open the door, and its security is affected. Therefore, you need to use a password to log in. In addition, some folders in the computer also store more important information, which needs to be protected and can be viewed after correct login. In the case of this, you will need a password and login. For example, for online banking, online payment and other applications involving user funds security, the password, payment password, etc. required to be logged in must be safe and reliable, and even the password is randomly changed. At present, in order to protect the user's account, the following methods are generally adopted: One is to prevent the Trojan from detecting the user's keyboard, and the soft keyboard is used, and the arrangement of the soft keyboard is always changing; the other is using a digital certificate. Ways to identify users, according to the place of storage, are divided into fixed digital certificates and mobile digital certificates; the third method of using dynamic tokens, in addition to static passwords, add a random number; the last one is to use transmission verification The way to code the phone, you need to enter the static password and the received verification code at the same time; these methods are much safer than simply using static passwords, which can solve some problems. However, in the state of being coerced, or when dynamic tokens, digital certificates, and mobile phones are stolen by others, these methods are very pale and easily attacked, directly affecting the user's funds and personal safety. In terms of bank security, ATMs and POS machines of banks now use 6-bit static passwords. It is very insecure to use such passwords, and it is easy to be sneaked or detected by others. At the same time, under the state of being coerced, it is impossible to report an alarm. In addition, in some large enterprises, companies, and institutions, a large number of product design documents, important documents, etc. are generated every day, which is of great value. With the intensification of competition in the industry, the risk of these important data and documents being compromised is increasing. It is necessary to adopt appropriate security and confidential technology to combine the enterprise confidentiality management system to effectively protect enterprise digital intellectual property. The document management system is a software-based technology that manages all product-related information (including electronic documents, digital files, database records, etc.). Its role is to manage the development and utilization of information resources of enterprise products. As an important part of the file management system, the identity of the user is identified. Currently, there are only a few types of identification: username/password, smart card authentication, dynamic token, biometric authentication and USBkey authentication. The username/password is the simplest and most commonly used authentication method. Since the password is static data, it can be easily sneaked into, or intercepted by a Trojan in the computer's memory or a listening device on the network. Therefore, it is a very insecure way of identity authentication. Smart card authentication is a chip with built-in integrated circuit, which stores data related to the user's identity. It is produced by a special manufacturer through special equipment and is non-replicable hardware. But since the data read from the smart card is static every time, Techniques such as memory scanning or network monitoring are still very easy to intercept the user's authentication information, or there are security risks. Dynamic passwords are a combination of time-related, unpredictable random numbers generated every 60 seconds according to a specialized algorithm. Each password can only be used once. The dynamic password technology adopts a one-time and one-secret method to effectively ensure the security of the user identity. However, if the time or number of times the client and the server are not in good synchronization, the problem that a legitimate user cannot log in may occur. In addition, once a dynamic token falls into the hands of others or the user is coerced, it will be spoofed by someone else. Biometric authentication refers to the technique of verifying the identity of a user by using each person's unique biometrics, often with fingerprints, iris recognition, and the like. Although this technology is the most reliable method of identity authentication, due to the maturity of the technology, the biometric authentication technology has great limitations. For example, the user's body is affected by injuries, resulting in failure to identify properly; the cost of the certification system is high. It is also impossible to solve the situation in which the user is falsely recognized in the case of being coerced.

The USBkey identity authentication method is a convenient and secure identity authentication technology developed in recent years. It adopts a strong two-factor authentication mode combining software and hardware and one time and one secret, and is now widely applied to the document management and control system. However, the PIN code currently used by the USBkey is still static, and there is also a risk of being sneaked. The defects described above are all present.

SUMMARY OF THE INVENTION The object of the present invention is to overcome the deficiencies in the prior art, and to provide a method and apparatus for obtaining autonomous dynamic password in a safe, reliable, simple, and inexpensive manner for effectively protecting a user account. Safety. In a modification of the proposed method and apparatus, the user can set at least one login password. In addition to setting at least one normal login password, at least one alarm (duress) password can be set according to actual needs. To achieve the above object, an aspect of the present invention is directed to a method for dynamically logging a system based on a user-generated dynamic password, wherein the system stores at least one login rule preset by the user, the login rule including at least one controlled An element and at least one control element controlling the at least one controlled element; the method comprising: generating random information corresponding to the number of controlled elements, providing the random information to a user, and utilizing the stored information based on the random information The login rule generates a login reference password; obtains a dynamic password input by the user; matches the dynamic password and the login reference password, and if the two match, allows login, and if the two do not match, the login is refused. Preferably, storing the login rules preset by the at least one user includes acquiring the number and location of the controlled elements; acquiring the number and location of the control elements; and combining the controlled elements and the control elements to form a login rule; The login rule is stored. Preferably, the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user. Preferably, in addition to acquiring the user identity information, the encryption key is also acquired to invoke the stored login rule corresponding to the user by using the user identity information and the encryption key. Preferably, the providing the random information to the user is provided to the user in the form of an image, a sound, or the like. Preferably, the controlled elements are digitized information of numbers, letters, characters, national characters, musical symbols, chromatograms, chemical element symbols, pictures, etc.; the control elements are permutations and combinations, mathematical operations Symbol, logical operator, shift operator. Preferably, the acquisition control element and the controlled element are implemented by providing a control element input and/or selection interface and a control element input and/or selection interface. Further, the method further includes storing, by the user, a preset alarm rule, where the alarm rule includes at least one controlled element and at least one control element that controls the at least one controlled element, and provides the random information to the user. At the same time, based on the random information, an alarm reference password is generated by using the stored alarm rule; the dynamic password and the alarm reference password are matched, and if the two match, the alarm is generated. Another aspect of the present invention is directed to another method for dynamically logging a system based on a user-generated dynamic password, wherein the system stores a plurality of user-set login rules, the login rule including at least one controlled element and the at least An at least one control element controlled by the control element; the method comprising the steps of: generating random information corresponding to the number of controlled elements, providing the random information to the user; acquiring user identity information and a dynamic password input by the user; The acquired user identity information invokes the stored login rule corresponding to the user and generates a reference password based on the random information; and matches the dynamic password and the reference password, if the two match, the login is allowed, if the two do not match Then refuse to log in. Preferably, storing the login rules preset by each user includes acquiring the quantity and location of the controlled elements; Obtaining the number and location of the control elements; combining the controlled element and the control element to form a login rule; storing the login rule. Preferably, the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user. Preferably, in addition to acquiring the user identity information, the encryption key is also acquired to invoke the stored login rule of the corresponding user by using the user identity information and the encryption key. Preferably, the providing the random information to the user is to provide the random information to the user's terminal device in the form of an image and or a sound by wire or wirelessly. This aspect of the invention also includes apparatus for the method. A third aspect of the present invention is directed to a method for dynamically logging a system based on a user-generated dynamic password, wherein the system stores a plurality of user-set login rules, the login rule including at least one controlled element and the at least An at least one control element controlled by the control element; the method comprising the steps of: acquiring the identity information of the user; calling the stored login rule corresponding to the user according to the acquired identity information; generating random information corresponding to the number of the controlled element, Providing the random information to the user; simultaneously generating a login reference password based on the login rule of the user and the random information; and matching the dynamic password and the login reference password, if the two match, allowing login, such as If it does not match, the login is refused. Preferably, storing the login rules preset by each user includes acquiring the number and location of the controlled elements; acquiring the number and location of the control elements; combining the controlled elements and the control elements to form a login rule; and registering the login Rules are stored. Preferably, the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user. Preferably, in addition to acquiring the user identity information, the encryption key is also acquired to invoke the stored login rule of the corresponding user by using the user identity information and the encryption key. Preferably, the providing the random information to the user is to provide the random information to the user's terminal device in the form of an image and or a sound by wire or wirelessly. A fourth aspect of the present invention is directed to a method for logging in to a system based on a user-generated dynamic password, wherein the system stores at least one login rule preset by a user, the login rule including at least one controlled element and the at least one At least one control element controlled by the control element; the method comprising the steps of: sensing the presence of the user terminal; acquiring the identity information of the user; calling the stored login rule corresponding to the user according to the acquired identity information; generating the number of the controlled element Corresponding random information, the random information is provided to the user terminal by short-range wireless communication; and a login reference password is generated based on the login rule of the user and the random information; receiving a dynamic password sent by the user terminal; and the dynamic The password and the login reference password are matched. If the two match, the login is allowed. If the two do not match, the login is refused. Preferably, storing the login rules preset by each user includes acquiring the number and location of the controlled elements; acquiring the number and location of the control elements; and combining the controlled elements and the control elements to form a login rule; Store. Preferably, the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user. Preferably, in addition to acquiring the user identity information, the encryption key is also acquired to invoke the stored login rule of the corresponding user by using the user identity information and the encryption key. Preferably, the providing the random information to the user is to provide the random information to the user's terminal device in the form of an image and or a sound by wire or wirelessly. Aspects of the present invention further include apparatus corresponding to the methods, the apparatus comprising: a random information generating unit, configured to generate random information corresponding to the number of controlled elements, and a random information transmitting unit, configured to provide the random information a user, a login reference password generating unit, configured to generate a login reference password by using the stored login rule based on the random information; an obtaining unit, configured to acquire at least a dynamic password input by the user; and a matching unit, the dynamic password, and the login The base password is matched. If the two match, the login is allowed. If the two do not match, the login is denied. Further, a rule setting unit is further configured to allow the at least one user to set and store at least the login rule thereof, including a unit for acquiring the number and location of the controlled elements; and acquiring a unit of the number and location of the control elements; The unit that is controlled by the control element and the control element to form a login rule; a unit that stores the login rule. Further, the method further includes an encryption unit that encrypts when the login rule is stored, and the encryption key is protected by the system. Tube, or generated by user control. The obtaining unit acquires the encryption key in addition to acquiring the user identity information, so as to invoke the stored login rule corresponding to the user by using the user identity information and the encryption key. The providing the random information to the user is provided to the user through the image provided to the display device of the device being logged in, or provided to the device being logged in by sound. Wherein, the controlled elements are numbers, letters, characters, national characters, musical symbols, chromatograms, chemical element symbols, pictures, and the like; the control elements are permutation combinations, mathematical operators, logical operators, shifts Operator. The acquiring unit acquiring the control element and the controlled element is implemented by providing a control element input and/or selection interface and a controlled element input and/or selection interface. Further, the storage unit further stores an alarm rule preset by the at least one user, the alarm rule includes at least one controlled element and at least one control element that controls the at least one controlled element, and further includes an alarm The reference password generating unit is configured to generate an alarm reference password by using the stored alarm rule based on the random information; and an alarm matching unit, matching the dynamic password and the alarm reference password, and if the two match, report the old password. In a preferred embodiment, the user-defined conversion rules and/or algorithms may also include or associate some dynamic change information, such as time and date. This will cause the conversion rules and algorithms to change over time. In the foregoing encryption step, the encrypted user-defined conversion rule, or algorithm, or the rule addition algorithm is encrypted in the step to avoid the definition of the conversion rule, or the algorithm, or the rule addition algorithm is easily steal. The dynamic password generated by using random information by using the methods in the present invention can make up for the drawbacks of the static password. Since the result is obtained by dynamic random information conversion and calculation, the result obtained each time is different. Others cannot get a password by peeping, even if they are intercepted by others during the transmission process, because they have random characteristics, they cannot get the correct password, and it is invalid to be used again. Once the user has set the rules and/or algorithms, they need to remember the conversion rules and algorithms they set, the fixed parameters used, and the location selected. The settings can be modified at any time during the application process. Compared with the current dynamic token, the dynamic password using the method of the present invention has no special dynamic token hardware, no hardware cost, and all operations are performed on the user terminal device and/or the remote server. There are also no problems with the theft and fraudulent use of dynamic tokens. The only thing the user needs to remember is the algorithms and rules set in advance. The algorithm and rules are completely defined by the user and saved in the mind of the user. They cannot be stolen by others. For the behavior of some fake banking websites used to take the user's bank account number and password, the method of the present invention makes these people unable to obtain the password of the user, and can effectively protect the security of the user funds. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram of the present invention. Figure 2a is a logic schematic diagram of a first embodiment of the present invention. 2b is a logic schematic diagram of a scheme for setting a password rule function according to the first embodiment of the present invention. Figure 2c is a logic block diagram of the device corresponding to this embodiment. FIG. 2d is a detailed flowchart of the rule setting process in the embodiment. 2e is a detailed flowchart of the login process in the embodiment. FIG. 2f is a detailed flowchart of the rule modification process in the embodiment. Figure 3a is a logical schematic diagram of a second embodiment of the present invention. FIG. 3b is a logical schematic diagram of a scheme of setting a password rule function according to a second embodiment of the present invention. Figure 3c is a logic block diagram of the device corresponding to this embodiment. FIG. 3d is a detailed flowchart of the rule setting process in the embodiment. FIG. 3e is a detailed flowchart of the login process in the embodiment. FIG. 3f is a detailed flowchart of the rule modification process in the embodiment. Figure 4a is a logic schematic diagram of a third embodiment of the present invention. Program logic diagram of a third embodiment password rules embodiment of the present invention, FIG. ₄ b is set by the function. Figure 4c is a logic block diagram of the device corresponding to this embodiment. FIG. 4d is a detailed flowchart of the rule setting process in the embodiment. 4e is a detailed flowchart of the login process in the embodiment. 4fl, 4f2 are detailed flowcharts of the rule modification process in the embodiment. Figure 5a is a logic schematic diagram of a fourth embodiment of the present invention. FIG. 5b is a logic schematic diagram of a scheme of setting a password rule function according to a fourth embodiment of the present invention. Figure 5c is a logic block diagram of the device corresponding to this embodiment. Figure 6a is a logic schematic diagram of a fifth embodiment of the present invention. Figure 6b is a logical schematic diagram of a scheme for setting a password rule function according to a fifth embodiment of the present invention. Figure 6c is a logic block diagram of the apparatus of the fifth embodiment of the embodiment.

The detailed description of the various embodiments of the present invention is intended to be in the The application is not to be construed as limiting the scope of the invention. In an optional embodiment of the present invention, various methods for logging in various systems and devices corresponding to the method are provided, and the method and corresponding device thereof can be applied to a user terminal such as a local user terminal that needs to be logged in. Such as mobile phones, laptops, and web servers, web chat tools and other systems. In the commonly used settings, first, through the login method, the user may need to log in, for example, his own terminal device, such as a user's mobile phone, a computer, etc., or a public server. The server may be remote or Locally, a login rule is saved in advance. The login rule may be, for example, a conversion rule, or a calculation formula, or a combination of rules and calculation formulas, and the login rule includes at least one such as a numerical value, a letter, a character, a national text, and a current a controlled element such as time; further comprising a control element that controls at least a portion of the at least one controlled element, the control element being an operator such as addition, subtraction, multiplication, division, square, square root, etc., or , or , or other logical operators, or operators such as left shift, right shift a certain number of operations. When the login rule definition is completed, the definition rule is stored by the logged device, and in an optional embodiment, the login rule is encrypted and saved. When the user needs to log in to the system, the logged-in device may be controlled to generate, for example, a random number of randomly generated information corresponding to the number of the aforementioned controlled elements, such as: numbers, letters, characters; Text (such as Chinese, Japanese, etc.); music; chromatography; chemical elements; For example, it may be a set of random numbers generated by a random number generator. And providing the user with an image, a sound, or the like through a screen display such as a local display device of the logged-in device and a terminal connected to the server, or a sound amplifying device, etc.; the logged-in device needs to call a previously-converted conversion rule for the user Generating a login reference password for the certain amount of random information; on the user side, according to the random amount of information generated and provided by the user, the user can obtain a password according to the conversion rule memorized in the mind, and through, for example, a terminal device or The input device provided by the terminal connected to the server is input into the registered terminal device or the server, and the registered terminal device or server matches the dynamic password with the reference password after receiving the dynamic password, and if the matching is successful, The user is allowed to log in to the terminal device or the server. If the matching is unsuccessful, the user's login is denied. The user-defined login rule that needs to be saved is preferably obtained by a rule generation step provided by the method in this embodiment. In this step, the user is first provided with a rule input interface, where the rule input interface includes the at least one of the foregoing The input area of the control element is used to acquire the number and position of the controlled elements, and may also include an area of the control element for performing operations such as calculation, logical judgment, shifting, etc. on the at least one controlled element for acquiring the number and position of the control elements. After the user fills in the input area of the controlled element and or the control element input area, the two are combined to generate a user-defined combination, that is, the login rule; then the user-defined login rule is saved, and the storage rule can be saved. Add or associate the identification ID of the corresponding user; if necessary, encrypt the saved user-defined conversion rule, or calculation formula, or a combination of rules and calculation formulas, and the encryption key is set by the user. Static password control generation. In the example of the foregoing method, if the matching fails, and the user is denied the login, the user may choose to randomly provide a new one. Control element, or allow the user to re-enter the password corresponding to this controlled element within a given time. In a preferred embodiment, the step of acquiring the dynamic password may include providing the user with a password input interface, and the password input interface may include displaying an area of the random controlled element for displaying the certain amount of random information for the user, and may further include The input area of the password is used to obtain the dynamic password of the user. The input password can be displayed in plain text or cipher text. In some applications, for example, during the login process of a public rather than a private device or a server, an identifier including a user ID, such as a user ID, may be provided to collect the user identity or user ID; The purpose of the identity is to subsequently invoke the stored user-defined login rules for the user based on the identity. In a preferred embodiment, another user-defined conversion rule, or a calculation formula, or a combination of rules and calculation formulas may be defined and stored for implementing functions other than login. For example, the other user-defined conversion rule, or a calculation formula, or a combination of rules and calculation formulas may correspond to an alarm function, that is, when the dynamic password obtained by the dynamic password acquisition step satisfies the other user-defined conversion. The rule, or the calculation formula, or the combination of the rule and the calculation formula, that is, the alarm rule, jumps to an alarm step and sends an alarm signal to the appropriate alarm receiving device. This is especially useful when targeting money access terminals or online banking servers, so that you can silently complete an alarm when you are coerced. The application of the present invention provides a platform for the user to design a password algorithm unique to the user himself within a certain range. In accordance with a particular application of the invention, a normal login password and an alert (duress) login password can be designed. In the initial setting, in addition to the normal login password conversion rules and algorithms, the user can also set the conversion rules and algorithms for the alarm (duress) login password and save them. When the user inputs a dynamic password, the terminal device calculates a reference password according to a conversion rule or algorithm preset by the user, and compares it with the password input by the user, thereby determining whether the user is a normal login or an alarm (coercion) login. However, it should be noted that the user should avoid generating the same value when setting the normal login password rules and functions and alarm (duress) login password rules and functions. In the present application: user-defined conversion rules, or calculation formulas , or a combination of rules and calculation formulas, referred to as login rules, may refer to converting random information into numbers, letters or words according to certain rules. For example, Chinese characters are displayed, which can convert Chinese characters into stroke numbers or four-corner numbers; convert a piece of music into a score. Login rules can also refer to converting a set of characters into another set of rules according to agreed rules. For example, convert a set of letters plus 5 into another set of letters, such as a converted to f, b converted to g, y converted to d, etc.; or a set of characters rearranged by convention, such as abed converted to bade, etc. . Accordingly, the random controlled elements involved in the login rule refer to information that the system can randomly generate, such as: numbers, letters, characters; texts of various countries (such as Chinese, Japanese, etc.); music; chromatography; chemical elements; And other information. The static control elements in the login rule can be, for example, mathematical operators, logical operators, shift operators, and so on. The manner in which the user receives the random information can, for example, visually and audibly receive information such as random images, audio, and the like transmitted from the registered device. The terminal devices in the registered device include, but are not limited to, desktop computers, notebook computers, mobile phones, tablet computers, access control devices, currency access terminals, and the like. The server in the logged-in device may refer to a local or remote online banking login server, an instant messaging login server, a software login server, and the like. The application of booting the mobile phone, booting the computer, etc., taking the computer as an example: Referring to Figures 2a to 2c, in a method according to an embodiment of the present invention, the user can set a login rule for later use when logging in for the first time. This can be done by a rule setting unit 101 of the login device; as shown in FIG. 2b, the rule setting unit 101 includes providing the user with a display area S211, and distinguishing between the controlled element setting area and the static control element setting on the display area. When the user completes the setting of the controlled element and the setting of the static control element S212 and confirms S213 by inputting or selecting, the unit considers that the login rule is set, and the unit will set the login rule. The storage along with the ID of the user is stored in a storage unit for later calling S214, and the storage may be encrypted. Since the computer is generally a multi-user system, it is necessary to store the login rule in association with the ID of the user. In the embodiment for a single-user terminal system such as a mobile phone, the login device may omit the step of associating with the user ID, directly Login rules are stored. Each time the user turns on, the login device runs to the user login interface, and receives a user-entered identity information, such as an ID, by a user identity obtaining unit 105, and generates, for example, 6 by the controlled element generating unit 103 for the ID. The bit random array is taken as the controlled element S203, and the 6-bit random number is sent and transmitted on the computer display device through the transmitting unit 104. S204: g § g § @ @ , where a, b, c, d, e, f respectively Represents six different numbers or letters, for example 134356. At the same time, the login device retrieves the previously saved login rule S206 for the user ID from the storage unit 102 through the reference password generation unit 106, and generates a reference password corresponding to the group 6-bit random number according to the acquired rule. . The generated reference password is then sent to the matching unit 107 in a login device for subsequent matching. On the other hand, after the user observes the random number from the computer display device, the user can select a password and re-arrange or calculate the above-mentioned number or letter according to the registration rule stored in the mind, and obtain a password as the acquisition unit 105 of the dynamic password registration device. The corresponding location of the login interface provided. For example, the user only uses the reverse arrangement as the password ggg g, ie 653431. After receiving the dynamic password, the login device sends it to the matching unit 107 to match the reference password S207. If it matches, the matching is considered successful, and the login device is allowed to log in, and the login device stops running. If the match is not successful, the random information generating unit may be selected to generate a new set of random information, and the user is given the opportunity to input the dynamic password again for the current random information group. In this embodiment, the user identity obtaining unit and the user dynamic password acquiring unit may be configured to acquire information at the same time, so that the reference password generating unit may generate a reference password for a certain client. Alternatively, it may be set that the user identity obtaining unit may acquire the user ID before the user dynamic password acquiring unit and generate the reference password after obtaining the ID, that is, the user dynamic password obtaining unit waits for the user to input its dynamic password. Because the random number or letter generated is changed every time you log in, the password of the composition is always changing. This enables the above-mentioned login device to avoid the problem that the passwords often encountered by login methods such as static passwords are stolen or sneaked, and also avoid the trouble of carrying devices such as USBKEY. The above rule change is a relatively simple application. If it is 6 random numbers or letters, a 6-bit password is synthesized, and there are 720 variations. If the random number or letter, and the entered password can be peeked or intercepted, the combination can be easily derived. Therefore, the use of this change rule as a password is generally used in the power-on password of a mobile phone, or on a personal computer used at home. In order to avoid malicious attacks by intruders and to constantly try passwords, you can use the wrong password input for a certain number of times to close the login of the day, or wait a few hours to log in. Figure 2d shows the flow of the specific setting of the login rule, wherein the rule setting process is generally set by the user to select a password. And trigger. The login method first enters the rule function editor, enters the rule function editor: displays the six-digit random number corresponding to the letter, and edits the rule function. Display verification interface, including: display six-digit random number, dynamic password input window, receive user input: dynamic password (DPW), calculate password value DPW' according to newly set rule function, random number, compare DPW and DPW' Consistent, if consistent, encrypt the save rule function. If they are inconsistent, return to the rule function editor: Display the six-digit random number corresponding letter, the edited rule function. Users need to log in to devices such as mobile phones. The login program can be run automatically when the phone is turned on or triggered by the user's selection. After the login process is started, the device calls the random number generator to generate a six-digit random number. The login interface is displayed, including: displaying a six-digit random number, a dynamic password input window; receiving the user input: a dynamic password DPW; finding the stored rule function and Decoding, calculate the dynamic password value DPW' according to the random number; compare DPW and DPW' to see if it is consistent, if it is consistent, allow login. If it is inconsistent, you can choose to judge the accumulated error on the day more than 5 times. If it exceeds 5 times, it will end the day login. Operation, if not more than 5 times, call the random number generator to regenerate the six-digit random number. Optionally, compare DPW and DPW' to see if they are consistent. If they are inconsistent, directly call the random number generator to generate a six-digit random number. Figure 2e shows the above specific login process. The rules that have been set may need to be modified. The specific process of the rule modification may be as shown in Figure 2f: the user selects [Modify Password], invokes the random number generator, generates a six-digit random number, and verifies the original password, including: Displaying six digits Random number, dynamic password input window, receive user input: dynamic password DPW (original), find the stored rule function and decode, calculate the dynamic password value DPW' according to the random number, compare whether DPW and DPW' are consistent, if they are consistent Enter the rule function editor: Display the six-digit random number corresponding to the letter, edit the rule function, if it is inconsistent, judge the cumulative error on the day more than 5 times? According to the judgment result, it is determined that the password cannot be modified, and the login is quit, or the random number generator is called to generate a six-digit random number. Enter the rule function editor: Display the six-digit random number corresponding to the letter, edit the rule function. After completion, the verification interface is displayed, including: displaying a six-digit random number, a dynamic password input window, and displaying a verification interface, including: displaying a six-digit random number, a password input window, and receiving a user input: a dynamic password NDPW (new), According to the newly set rule function and random number, the dynamic password value NDPW' is calculated. Is the comparison between NDPW and NDPW' consistent? If it is consistent, the rule function is saved and encrypted, and then the password is modified. If it is inconsistent, the new rule function can be viewed, and can be modified, and confirmed. After confirmation, the verification interface is redisplayed, including: display six-digit random number, dynamic password input window . Embodiment 2: Login Device Application of Network Chat Tool Referring to Figures 3a to 3c, in a method according to another embodiment of the present invention, similar to the previous embodiment, a user can set a login rule when the system is first applied. For later use, this can be done by logging in a rule setting unit of the device. 101 is completed; as shown in FIG. 3b, the running process of the rule setting unit 101 includes providing a display area for the user on the user's terminal, and distinguishing the controlled element setting area and the static control element setting area S311 on the display area; When the user collects the setting of the controlled element and the setting of the static control element S312 and confirms the post S313 by inputting or selecting, the unit considers that the login rule is completed, and the unit will set the login rule with the user together with the user. The ID identifier is stored in a storage unit for later calling S302, and the storage may be encrypted. Since the network chat tool is generally a multi-user system, it is necessary to associate the login rule with the ID ID of the user. Each time the user logs in to the network chat tool, as shown in FIG. 3a, the login device runs to the user login interface, and receives a user-entered identity information, such as a user ID, by a user identity obtaining unit 105, and for the ID The controlled element generating unit 103 generates, for example, a 6-bit random array as the controlled element S303, and transmits the 6-bit random number to the display device of the user terminal via the network via the transmitting unit 104 on the display device S304: g § gg @ @ , where, a , b, c, d, e, f represent six different numbers or letters, respectively, for example 134356. At the same time, the login device retrieves the previously saved login rule S306 for the user ID from the storage unit 102 through the reference password generation unit 106, and generates a reference instruction corresponding to the group 6-bit random number according to the acquired rule. . The generated reference command is then sent to the matching unit 107 in a login device for subsequent matching. On the other hand, after the user observes the random number from the display device of the terminal 20, the user can select a password or a rearrangement or calculation according to the registration rule memorized in the mind, and obtain a password and provide it as a dynamic password registration device. The corresponding location of the login interface. For example, the user only uses the reverse arrangement as the password ggg g, ie 653431. After the acquisition unit 105 of the registration device acquires the dynamic password, S306 sends it to the matching unit 107 to match the reference password S307. If it matches, it considers that the matching is successful, and allows the login device S316 to stop the operation. If the match is not successful, the random information generating unit may be selected to generate a new set of random information, or the user may be given the opportunity to input the dynamic password again for the current random information group. Because the random number or letter generated is changed every time you log in, the password of the composition is always changing. This enables the above-mentioned login device to avoid the problem that the passwords often encountered by login methods such as static passwords are stolen or sneaked, and also avoid the trouble of carrying devices such as USBKEY. In this embodiment, the user identity obtaining unit and the user dynamic password acquiring unit may be configured to acquire information at the same time, so that the reference password generating unit may generate a reference password for a certain client. Alternatively, it may be set that the user identity obtaining unit may acquire the user ID before the user dynamic password acquiring unit and generate the reference password after obtaining the ID, that is, the user dynamic password obtaining unit waits for the user to input its dynamic password. The login device or the login method in this embodiment can be integrated into the existing network day tool as part of the network chat tool. For the general network chat tool, it is characterized by the necessity to connect with the external connection through the network, so it is vulnerable to attack by the Trojan horse program, and the hacker can monitor the password input by the user, thereby stealing the user's login password. Therefore, for such passwords, the conversion changes used need to be relatively complicated. In addition to rearranging the positions, some simple addition and subtraction operations need to be added. The specific use is as follows: When the user is ready to enter the chat software, in the login interface, the first six random numbers or letters are displayed: § g

(Note: a, b, c, d, e, f represent six different numbers or letters respectively) The user selects the above numbers or letters according to the pre-set arrangement rules, and then performs simple addition and subtraction (for the addition of letters) Subtraction is to move the letter backward/forward, such as h plus 5 is m, h minus 5 is c), and then rearranged as a password input. As a simple example, a password can consist of the following rules:

When logging in, randomly display 6 digits or letters: 5 f 4 mu 8. According to the conversion rule, a set of passwords can be obtained: kh 13 2 11 η (Note: When subtraction is used to generate negative numbers, take the positive part) . For passwords generated by conversion in this way, it is difficult to find out the rules of change. Others cannot collect data to derive the rules of password composition. In this way, it can also be applied to login devices such as online games, online shopping, travel business networks, emails, company-wide local area networks, and the like. Figure 3d shows the setup process: where the user selects [Set Password], enters a new username, and determines if it has the same name? If yes, prompt to re-enter, if otherwise provide six-digit random number corresponding to the letter, edit the rules; then the personal terminal enters the rule Function editor: Display the six-digit random number corresponding to the letter, edit the rule function; After the rule function is edited: The server side, call the random number generator, generate a six-digit random number, and send it to the personal terminal, and the personal terminal receives the six The bit random number generates a temporary key Dkey, which is encrypted by Dkey and sent to the server terminal. In the personal terminal, the display verification interface includes: displaying a six-digit random number, a dynamic password input window, receiving a user input: a dynamic password DPW; on the server side, generating a temporary key using a six-digit random number, that is, Dkey, decrypting with Dkey The rule function calculates the password value DPW' according to the newly set rule function and the random number; after that, the server compares whether the DPW and the DPW' are consistent, and if yes, encrypts and saves the rule function, thereby completing the password modification; if not, Then enter the rule function editor: display the six-digit random number corresponding letter, the edited rule function, recall the random number generator, generate a six-digit random number and provide it to the personal terminal and server. After the rules are set, when you need to log in to the server, the login process is as follows, as shown in Figure 3e: In the personal terminal user, select [Login], issue a login request to the server, and the server calls the random number generator to generate a six-digit random number. The six-digit random number is sent to the personal terminal and displayed by the display interface, displaying the login interface, including: displaying a six-digit random number, a user name, and a dynamic password input window; thereafter, receiving the user input at the user terminal: user name UID, dynamic Password DPW, after the server collects the user name UID and the dynamic password DPW, does it determine whether there is such a user? If not, it is judged whether the accumulated error on the day exceeds 5 times, and the login operation is ended after more than 5 times. If there is no more than 5 times, the user is required to log in again; if it is determined that the user is present, the saved user rule function is found and Decrypt, get the rule function, then calculate the user's dynamic password DPW', and then compare DPW and DPW' to see if it is consistent. If it is consistent, it will allow login. If it is inconsistent, it will judge the accumulated error more than 5 times on the day, and judge according to the change. The result ends the login or asks the user to log in again. When the user needs to modify the already set rules, the following modification process is run, as shown in FIG. 3f: The user selects [modify password], and after receiving the user's modification request, the server calls the random number generator to generate six digits. The random number is sent to the user terminal, and the stored user rule function is found and decoded, and the dynamic password value is calculated according to the random number.

DPW, in the user terminal, provides a verification original password interface, including: displaying a six-digit random number, a dynamic password input window, obtaining the user input: dynamic password DPW (original), and then judging whether the comparison DPW and DPW' are consistent? If they are inconsistent, judge the cumulative error on the day more than 5 times? And end the login or recall the random number generator to generate a six-digit random number; if it is consistent, enter the modify rule function interface; enter the rule function editor on the client: display the six-digit random number corresponding letter, edit the rule function area For the user to edit; after that, use the six-digit random number to generate the temporary key Dkey, use the Dkey encryption rule function at the user end, and send it to the server. On the server side, the temporary key Dkey is also generated by the six-digit random number, and Dkey is used. Decrypting the rule function; thereafter, providing a display verification interface on the user terminal, including: displaying a six-digit random number, a dynamic password input window, obtaining a password input by the user, NDPW, sending to the server, and according to the new setting on the server side The rule function, the random number, calculate the password value NDPW', and compare whether NDPW and NDPW' are consistent? If it is consistent, save the password and complete the modification. If it is inconsistent, enter the rule function editor: Display the six-digit random number corresponding letter, the edited rule function, and repeat the above process. Embodiment 3, Application of Online Banking, Online Payment, Online Securities Referring to Figures 4a to 4c, in a method according to another embodiment of the present invention, similar to the foregoing embodiment, a user can set a login when logging in for the first time. The rules are for later use, which can be done by a rule setting unit 101 of the login device; the rule setting unit includes providing a display area for the user on the display device of the user's terminal 20, and distinguishing the controlled element settings on the display area The area and static control element setting area S411; when the user completes the setting of the controlled element and the setting of the static control element S412 by the input or selection, and confirms the confirmation after S413, the unit considers that the registration rule setting is completed, then the unit will The set registration rule is stored together with the ID of the user in a storage unit for later calling S402, and the storage may be encrypted. Since online banking and the like are multi-user systems, it is necessary to store the login rule in association with the ID of the user. An alarm rule can also be set by the same flow and stored in the rule storage unit 102 as well. In such an embodiment, since each password, rule, and the like needs to be transmitted through the network, it is preferable that the password and the rule can be encrypted by the encryption unit and then transmitted through the Internet, and the data transmitted to the server is decrypted by the encryption unit. For example, the user side software setting encryption unit encrypts the rules and passwords, and the server side software setting decryption unit is used to decrypt the rules, passwords, and the like transmitted through the network. After the user logs in to the online banking, for example, when logging in to the online banking through the web browser, the login device 10 of the online banking server provides an obtaining unit 105 that collects the user identity by providing the user login interface, and receives the identity information S401 input by the user. For example, a user ID, such as a user, generates, for example, a 6-bit random array as the controlled element S403 by the controlled element generating unit 103 for the ID, and transmits the 6-bit random number to the display device of the user terminal 20 through the network. S404: g § g § @ @ , where a, b, c, d, e, f represent six different numbers or letters, respectively, for example 134356. At the same time, the login device generates a login rule and an alarm rule for the user ID identifier saved in advance from the storage unit 102 through the reference password generating unit 106, and generates a corresponding 6-bit random number according to the acquired rule. A login reference command and or an alarm reference password S406. The generated registration and/or alarm reference command is then transmitted to the matching unit 107 in the registration device for subsequent matching S407. On the other hand, the user observes these random numbers, for example, from the display device of the terminal 4©20 to which the server is connected, that is, According to the registration rule remembered in the mind, after selecting the above numbers or letters to rearrange or calculate, a password is obtained and used as the corresponding position of the login interface provided by the dynamic password registration device. For example, the user only uses the reverse arrangement as the password gg gg, ie ⁶⁵³⁴³ i. After receiving the dynamic password and a static password, the login device sends s ⁴ (1⁄2, sends it to the matching unit 107, and matches the login reference password S407. If the matching is successful, the matching is considered successful, and the login device S416 is allowed to stop the login device. If the match is not successful, the match is considered unsuccessful, and then the alarm reference password is matched. If the match is successful, the login and alarm are allowed. If the match is not successful, the random information generating unit may be selected to generate a new set of random information, or given to the user. The opportunity to re-enter the dynamic password for the current random packet. Because the random number or letter generated is changed every time you log in, the composed password is always changing. This allows the above login device to avoid static password. The passwords that are often encountered by the login means are stolen or sneaked, and the problem of carrying the device such as USBKEY is also avoided. In this embodiment, the user identity acquisition unit and the user dynamic password acquisition unit can be configured to obtain information at the same time. , whereby the reference password generating unit can then generate a certain customer Alternatively, the user identity obtaining unit may obtain the user ID before the user dynamic password obtaining unit and generate the reference password after obtaining the ID, that is, the user dynamic password obtaining unit waits for the user to input its dynamic password. In an optional implementation manner of this embodiment, a static password input by a user may be accepted at the same time when the dynamic password of the user is acquired, where the static password is associated with the rule of the user when the rule is saved. After the static password, the stored password is extracted in the storage unit 102 using the static password and the login reference password is calculated. If the static password is inaccurate, the rules saved by the storage unit 102 cannot be correctly decrypted. Using the method or apparatus of the present invention, Implementing secure logins is very simple, because the passwords we enter are randomly changed. Don't worry about Trojans detecting user keyboard input. Even if others get the password that the user entered this time, it won't be used again next time. Because the conversion rules, or the way of operation is Recalling in the mind of the user, therefore, the user who can get the correct result based on the random number must be the user himself. In this way, it is verified that the user is operating. At the same time, the user can also set the alarm reference password, when the user When life is in danger, you can enter the alarm password, which can stabilize the coercion, and can send a request signal to the outside in silent and uninterested. For example, when the user logs in to the online bank, the login interface displays the random number: gggg

(Note: a, b, c, d, e, f represent six different numbers respectively) When the user sets, the dynamic password set is composed of the following groups of equations: yl =@ ³ +@ ² +7 y2=@ ³ +@ ² +7 y3=| ³ +@ ² +7 y4= ten 7 shell lj The dynamic password is composed of the above four sets of data, that is, yly2y3y4. For example, the generated random number is: 6 9 3 8 5 6, Bay IJ yl = 6 ³ 10 9 ² 10 7 = 216 10 81 10 7 = 304 yl = 9 ³ 10 3 ² 10 7 = 729 10 9 7 7 = 745 yl = 8 ³ 10 5 ² 10 7 = 512 10 25 10 7 = 544 yl = 5 ³ + 6 ² + 7 = 125 + 36 + 7 = 168 The dynamic password obtained is: 304745544168. Dynamic passwords obtained by this kind of operation, because the operating equations used by the users are diverse, the variables used in each expression are also variable (a variable, or two, or three, etc.), the expression The coefficients and constants in the variable are also indefinite, and the composition of the dynamic password is also indefinite (can be two formulas, or three formulas, or four formulas, etc.). Therefore, it is difficult to derive the arithmetic rules from known random numbers and generated passwords. Of course, if the user feels that the above-mentioned set operation cannot be memorized, these operations and combination rules can be input into the mobile phone. In actual use, the corresponding value can be manually input according to the displayed random number, and then the corresponding value can be obtained. Dynamic password. If wireless communication (such as infrared, WiFi, Bluetooth, etc.) is established between the mobile phone and the computer, the generated dynamic password can be directly transmitted to the computer through wireless. The specific rule setting process, as shown in Figure 4d: The user starts the login rule or alarm by selecting [Set Password] The setting of the rule, after which the bank account is sent to the server, and the server verifies whether the account still exists. If the account exists, the user enters the account number, name, ID number, withdrawal password and other information, and invokes a random number generator. Generate a six-digit random number, use the six-digit random number to generate the temporary key Dkey, encrypt the user identity information with Dkey and send it back to the server, and then use Dkey to decrypt the user identity information on the server side, and then check with the bank system existing database. Is the user information consistent? If they are inconsistent, re-acquire the user identity information and encrypt the transmission; if they are consistent, provide the user static password setting interface, and obtain the static password. For example, the user is required to input: new static port SPW, repeated input static password SPW, and the following process and common The server setting process is the same. You can set the alarm rule description together only when adding the login rule. After the login rule is set, the user can log in to the online banking system or online payment system through any user terminal at any time. The login process is as follows, as shown in Figure 4e: After receiving the request that the user needs to log in, the server calls the random number generator to generate a six-digit random number. The displayed login interface includes: display six-digit random number, account number, static password. The dynamic password input window is provided to the user terminal, and obtains the identity information input by the user, the static password, and the dynamic password DPW calculated according to the six-digit random number. After receiving the foregoing information, determining whether the user account is available? If there is no such account, it is judged that the accumulated error is more than 5 times on the day. If it is exceeded, the login process is ended. If it is not exceeded, the user account and password are displayed incorrectly and re-entered; if there is the account, the saved user rule function is found ( Normal DPW and alarm ADPW) ciphertext, use the six-digit random number to generate the temporary key Dkey, decrypt it with Dkey, get the static password SPW, use the static password SPW to generate the decryption key Skey, and use Skey to decrypt the saved rule function ciphertext. The rule function calculates the normal and alarm reference password values DPW' and ADPW of the user, and compares whether DPW and DPW' are consistent. If they are consistent, the login is allowed. If they are inconsistent, compare whether ADPW and ADPW' are consistent. If they are consistent, they are allowed. If you log in, but send out an alarm signal, if it is inconsistent, judge the accumulated error more than 5 times on the day, and end the login operation or display the user account and password error according to the judgment result, and re-enter. After the login rule and or the alarm rule are set, the modification process can be used to modify the two. The specific process is as follows, as shown in Figure 4fl and 4f2: After detecting the user's request to modify the password, the random number generator is called to generate A six-digit random number, provided in the display modify password interface, the interface can include: display six-digit random number, static password, dynamic password input window; receive user input: static password SPW (original), dynamic password DPW (original), the temporary key Dkey is generated by a six-digit random number, the static password SPW is encrypted by Dkey and the static password SPW is transmitted to the server, and the server uses a six-digit random number to generate the temporary key Dkey, and then decrypts with Dkey. Obtain the static password SPW, then use the static password SPW to generate the decryption key Skey, decrypt the saved regular function ciphertext with Skey, get the rule function, calculate the user's normal and alarm reference password values DPW', ADPW, compare DPW and DPW' Whether it is consistent, if it is consistent, choose to modify the static password, dynamic password rule function; if it is inconsistent, compare DPW and ADPW 'Is it consistent, such as If it is consistent, choose to modify the static password and dynamic password rule function, and alarm at the same time; if it is inconsistent, judge the cumulative error on the day more than 5 times? If not exceeded, the random number generator is called to regenerate the six-digit random number. If it is exceeded, the process is terminated. The specific process of selecting the static password and dynamic password rule function is as follows: Modify the static password, enter the new static password NSPW, and repeat the input to determine whether the passwords entered twice are consistent? If it is consistent, use Dkey to encrypt the static password NSPW. If it is inconsistent, re-enter the new static password NSPW and repeat the input. After encrypting the static password NSPW with Dkey, send the ciphertext to the server and enter the modification interface of the dynamic password rule function. . Decrypt with Dkey on the server side, get the static password NSPW, and then use the static password NSPW to generate a new encryption key NSkey, so that Skey=NSkey, Skey is used for the encryption rule function (including normal and alarm). Enter the rule function editor on the client: Display the six-digit random number corresponding to the letter, edit the rule function area for the user to edit (here can edit the normal login rule function and the alarm login rule function); thereafter, generate with six random numbers Temporary key Dkey, use Dkey encryption rule function (including normal and alarm) at the user end, and send it to the server side, use Dkey to decrypt the rule function (including normal and alarm) on the server side; thereafter, provide display verification interface in the user terminal. , including: display six-digit random number, normal login password and alarm login password input window to obtain the normal login password NDPW and alarm login password NADW input by the user, and send it to the server, according to the newly set rule function (including normal and Alarm), random number, calculate the password values NDPW' and NADW', and compare NDPW and NDPW', NADW and NADPW'? If it is consistent, use Skey to encrypt and save the password (including normal and alarm), and complete the password modification; if it is inconsistent, enter the rule function editor: display the six-digit random number corresponding letter, the edited rule function (including normal and alarm), Repeat the above process.

Embodiment 4, Application of Login to Bank ATM and POS Machine Referring to FIGS. 5a to 5c, in an embodiment for such an application, as shown in FIG. 5a, similar to the previous embodiment, it includes login steps 503, 504. 505, 506, 507, etc., the user generally implements authentication using a tool such as a bank card. Therefore, the login apparatus and method of the present invention may not necessarily provide an interface for the user to input the user ID, but the user ID acquisition unit 105 directly reads A bank card or the like is used to determine the ID of the user, and subsequent settings such as the provision of the random information and the generation of the reference password, the acquisition of the input dynamic password, and the setting of the password matching unit 107 may be performed by means of a login method such as a web chat tool. Or it can be like the login method for online banking, depending on how the ATM or POS is arranged. The setting of the login rule can be set locally and sent to the server in the background by the ATM machine, as shown in Figure 5b, or Through the network banking and other settings, the server side of the bank only needs to associate or bind the set login rules with tools such as the user's bank card. Similar to the previous embodiment, it includes steps 511, 512, 513, 502, and the like. A logical block diagram of the corresponding device is shown in FIG. 5c, which is similar to the previous embodiment, and includes a server terminal 10, a user terminal 20, and units 101 to 107 at the server end. In this field, the login device of the present invention is employed. And the login method can solve the problems existing in the prior art well, and ensure the personal safety and capital security of the user. For the average user (meaning that the amount of funds is relatively small), it can be combined with relatively simple calculation methods, which is easy to remember and not easily cracked by others. If the amount of money is extremely large, and a complex combination of calculation formulas is needed, and the human brain cannot remember these complicated formulas, you can use the method described above to input all the formulas and their combinations into the mobile phone. Completing complex operations and combinations to generate the final dynamic password. Embodiment 5, Electronic lock, electronic key application (including home electronic lock, access control, car lock, etc.) Referring to Figures 6a to 6c, in a further embodiment, the dynamic password of the present invention can also be applied to electronic locks and electronic In the key, the original static password is changed to our dynamic password, which also prevents peeks from others. Depending on the use of the electronic door lock and the level of security, various electronic locks with login or login methods can be designed. For example, for a situation with a lower security level, such as a general company in a business building, a door access to a community, etc., the login device and method of the present invention can be directly embedded in an access control device, such as a card reader, and the access device can be The foregoing login rule setting such as web chat and login verification by the user are implemented. For places with higher security levels, such as locks for banks, prisons, and state administrative agencies, you can use the electronic key on the mobile phone, and input the original calculation formulas and combinations into the mobile phone. When you need to open the door, The user can input the corresponding value on the mobile phone according to the random information prompted by the electronic lock (or the electronic lock sends the random number to the mobile phone and displayed on the display of the mobile phone), and then sends the obtained result to the mobile phone. Electronic lock to complete the unlocking action. At the same time, the alarm reference password can also be set, so that the specific implementation scheme can be used in the coerced state to refer to the implementation process of the online banking, and replace the user computer terminal with a mobile phone. Embodiment 6 Application of File Control The login device and the login method in one embodiment of the present invention may be attached to a digital file in the form of software. In the file control system. In this way, when a user needs to access a file managed by the file management system, the user needs to first log in to the file management system or log in to a specific folder or file. After the login is successful, the file or folder can be processed, for example. View and other operations. In this way, the login device or the login method attached to the file management system needs to have a login rule storage unit for storing the login rules preset by each user of the system in an encrypted or unencrypted form, wherein the login rule includes At least one controlled element and at least one control element controlling the at least one random information; further comprising a random information generating unit, such as a random number generator, for generating random information corresponding to the number of operated elements, and Providing the random information to the user; further comprising: a dynamic password obtaining unit, configured to receive a dynamic password calculated by the user based on the random information by the brain; a reference password generating unit, the user invokes the stored login rule based on the random information A reference password is generated; a comparison unit matches the dynamic password and the reference password, and if the two match, the login is allowed, and if the two do not match, the login is denied. After refusing to log in, you can choose to wait for another new dynamic password for the current random information, and compare the new dynamic password with the reference password to determine whether to allow login; or, you can generate and provide new random information. And correspondingly generate a new reference password, and wait for the user's new dynamic password through the dynamic password acquisition unit. Similar to the previous embodiment, as shown in FIG. 6a, the login step includes 603, 604, 605, 606, 607, etc.; similar to the foregoing embodiment, the basic steps of the rule setting are as shown in FIG. 6b, including steps 611, 612. , 613, 602, etc. A logical block diagram of the corresponding device is shown in FIG. 5c, which is similar to the previous embodiment, and includes a system terminal 10, a user terminal 20, and units 101 to 107 at the server end. Specific examples of rules that can be set: The following describes some specific implementations of the present invention, which can be applied to application fields with different security levels, but in actual user settings, it is not limited to the following solutions, and is not limited to the following defined arrays. The number, length of the array, and length of the password can be defined by the user according to the actual situation. For convenience of explanation, the following examples are based on 6-digit random numbers and letters. For the login application of mobile phones and other terminals: Option 1 (pure arrangement rules) Definition: Assume that the random controlled element is a set of six-bit encoding gg§, where the encoding can be a number, or a letter, or a character; and the static operating element is the second, fourth, and sixth digits with one or three , five-digit content interchangeable transposition operator; the saved user preset login rule is

According to the login rule defined above, when the user logs in, the random controlled element generating unit in the terminal generates a set of six-digit random codes in the random controlled element step, for example, 1, 2, 3, 4, 5, and 6 And displayed on the screen of the terminal, the user obtains the result A=214365 according to the stored registration rule in the mind according to the displayed random code, and inputs the result as a password; the reference password generating step preferably receives the aforementioned password input The saved login rule for the user is then called, and the base password A' = 214365 is obtained according to the saved login rule. The matching step then compares the password A entered by the user with the reference password A' obtained by the reference password calculation step. If they are equal, that is, the match is considered to be the user's own input, allowing the user to log in, and allowing subsequent operations; In case of error, the login and subsequent operations are rejected. The specific application of the foregoing six-digit random code may also be, for example, when the terminal device, for example, the mobile phone is powered on, randomly displays "GUMW PA" on the screen. According to the above-mentioned rules, the correct password is "UGWMAP", that is, The system can only allow users to log in after the user has correctly entered the aforementioned password. With this simple rearrangement and partial replacement, the advantage is that the rules are simple and convenient to remember, and can be used in some cases where the input is relatively private, such as the power-on password for the mobile phone and the password for logging in the electronic key. Wait. The disadvantage is that the rules are simple and it is easy to introduce its rules. For example, if the entire input process is sneaked, the rules can be derived by comparing several groups, tens of sets of random codes and dynamic passwords. Option 2 (pure calculation formula): Definition: Assume that the generated random controlled elements are a set of six-bit ggg §, and the static operation elements are multiplied, squared, and added. The login rule is y=5 X c ² +9. When logging in, the terminal background will first generate the set of six-digit random numbers &, b, c, d, e and f, for example, when the phone is turned on, on the screen. "7 9 5 3 8 2" will be displayed, then the reference password generation step will be calculated according to the saved expression y'=5 X c ² +9=134, and 134 will be used as the reference password; the user will randomly select a set according to the display. Count, calculate the result y=5 X c ² +9=134 according to the expression stored in the mind, and input 134 as the password; then the matching step compares the password y input by the user with the reference password y', if equal , it is considered to be the user's own input, allowing subsequent operations; if it is wrong, the subsequent operations are rejected. Scheme 3 (calculation formula plus complement, rearrange): In scheme 2, it is possible to obtain a single digit, or two digits. In order to strengthen its strength and avoid being derived from others, you can pass certain The rules, for the calculation of single digits, make up its 100,000, tens, thousands, hundred and ten digits, thus ensuring that its six-digit password has a value. For the result of two digits, three digits, four digits, five digits, you can use the same method to make up. For example, according to Option 3, we can set the following rules. 100,000 people use the square of the first digit and take its single digit. The 10,000 digits use the square of the second digit and take its single digit. The thousand digits adopt the first digit. The square of the three digits is taken as its single digit, and so on. In the example of scenario two, the random number is "7 9 5 3 8 2". According to the current padding rule, the correct password is "915134". If the random number is "4 7 0 6 9 1", the correct password is "690619". Scheme 4 (password is any number of digits) In the above scheme, the number of passwords we set is fixed, such as 4 digits, 6 digits or 8 digits. In order to increase the difficulty of other people's deciphering, the password can be set to any length. And it is uncertain. The composition of the password can be a combination of several algorithmic results. Definition: Suppose the generated random number is 1 group g @ @ gg solid, the password is: y=yiy ₂ y ₃ y ₄ where: _yi =a ² +3 y ₂ =c ² +5 y ₃ =d ² +7 y ₄ =f ² +9 For example, when logging in, the terminal background will first generate a set of random numbers 9, 6, 2, 5, 3, 8. The terminal user calculates according to the algorithm set in advance: _yi =84, y ₂ =9 , y ₃ =32, y ₄ =73, then the password combination is: 8493273. The above four schemes are all set up under the premise of a set of random information. In most of the application fields, the security of the security zone has been greatly improved compared with the existing schemes, such as the password for the mobile phone, computer Power-on password, electronic key application Login, QQ login, MSN login, etc. In some areas requiring high security levels, such as online banking, online transactions, document management of government agencies and troops, etc., it is necessary to further improve their security performance. When using the present invention, random codes can be appropriately added ( The number of groups, and the number of bits of the dynamic password, increase the difficulty of the cracker and improve its security performance. Scheme 5 (multiple sets of random codes) The following is an example of four sets of 4-bit random codes. As an example, the actual application can be adjusted according to the specific situation. It is not limited to 4 groups of 4 bits, and the password is not Limited to 4 bits, it can be designed to any number of bits. Definition: Assume that the generated random numbers (or letters) are 4 groups, each group consisting of 4 digits (or letters), and the array is as follows:

HHBH 0HBH ΞΒ The password consists of 4 digits (or letters);

Generation of 4-digit password (defined by the user, the following is only an example):

H B B B Note: The password is generated by rearranging the combination. The four sets of random numbers and passwords are not limited to numbers, but also letters and characters. However, since this method is relatively simple, if it can be peeked by others, the rules can be derived by obtaining a certain number of random codes (numbers) and corresponding passwords. Use rearrangement combination, and add (or subtract) a set of 4-digit seeds reserved in advance according to the corresponding bits. When setting the password calculation mode, you can set a new 4-digit seed number:

The generation of a 4-digit password (defined by the user, the following is only an example): When the two numbers are added greater than 10, the single digit is taken; when the two phases are reduced to 0, the positive number is taken. Example 1, when the computer is turned on, the screen displays 4 sets of random numbers "8362", "2396", "3058" and "8924". When the user presets a set of seeds "1234", the above rules are followed. The correct password is "9588". Example 2: When the computer is turned on, four random letters " ₀ fjt""rUpC""PTjk""dRJZ" are displayed on the screen. When the user presets a group of seeds "1234", the above rules are followed. The correct password is "pWmD'O Note: This scheme is more secure than the scheme 1. In addition to the simple rearrangement, the calculation function is added, and the cracking is more difficult, but it is adopted. Simple corresponding bit addition and subtraction, when the intruder gets a certain number of random numbers and password values, it can also derive its rules. Other various arbitrary definition calculation formulas

4-bit password generation (defined by the user, the following is only an example): y= (0 + H) x(0+0) The y value can be entered as a password, and the insufficient part can be left blank; or by the following Complement: When y<10, thousands, hundred, ten digits add 0 0 when 10<=y<100, thousands, hundreds add 00 when 100<=y<1000, thousands add when y>=1000, directly as password Entering all of the above combinations can be freely combined according to the user's settings, resulting in ever-changing results. Alarm (stress) The calculation formula of the login can also be set by the above method. To avoid the two rule functions generating the same value, the calculation formula can be the same as the normal login calculation formula, and only one constant is added or subtracted. Scheme 5 (Text Conversion Method) Random information can be designed in Chinese kanji form, with the stroke of the Chinese character or the four-corner number as the password. For example, the random information displays "Human-machine synchronization dynamic password". The conversion rule agreed by the user in advance is to select the strokes of the 2nd, 4th, 6th, and 8th characters as the password input, and the password is "6785"; of course, it can also be adopted. The four-corner number of the text is used as the password. In order to increase the difficulty of deciphering, the converted number can be simply calculated, and the obtained result is input as a password. Option 6 (Music Conversion) Random information can be designed as music, with the notation as a password. For example, when the computer is turned on, a piece of music is randomly played, and the user uses the notation of the first few notes of the piece of music as the input of the password. It is also possible to perform a simple calculation on the converted notation and input the obtained result as a password. Scheme 7 (Conversion of Chemical Elements) Random information can be designed as a chemical element with its atomic number as a serial port. For example, when the computer is turned on, it displays several chemical elements, such as "Aluminum, Iron, Carbon, and Copper", which can be converted into a set of data "1326629", which is entered as a password. It is also possible to perform a simple operation on the converted atomic number and input the result as a password. Since an important part of the invention lies in the agreed registration rules, their storage and confidentiality are equally important. The saving of the login rule may be specifically set according to the application field of the present invention. If it is used for protecting the data in the mobile phone, the login rule may be saved in the local area of the mobile phone; if the invention is used to log in to the computer, Login rules are saved on the computer that needs to be logged in; for those applications that want to log in to the server, such as instant messenger, email, access control, currency access device (ATM), etc., the login rules are best saved in On the corresponding server. According to the existing technology, the registration rule can be saved in two ways: "plain text" and "encryption". For example, the encryption key can be generated by a hash function without saving, so as to avoid being cracked by others. . As for the memory of the human brain on the user side, for general application fields, the user-set login rules do not need to be set up very complicated, and some convenient memory conversions such as selection, rearrangement, shifting, and simple operations are selected. In some particularly important situations, it is necessary to set the calculations very complicated and not to be cracked by others, but these operations cannot be remembered by the human brain. In this case, the user can save the equations in another intelligence. Terminal (such as a smartphone, On a handheld computer, etc., or on a personal computer, when a password input is required, a corresponding variable can be input on another smart phone, or a personal computer, to calculate the value of the password. The input of the password can be input by manual input or by wireless (infrared, WiFi, Bluetooth, etc.). The above is specifically described as a possible implementation of the present invention, which can be applied to application fields with different security levels, but in actual user setting, it is not limited to the following solutions, and is not limited to the number of arrays and passwords defined below. The length can be defined by the user according to the actual situation.

Claims

Claim

A method for logging in to a system based on a user-generated dynamic password, wherein the system stores at least one login rule preset by a user, the login rule including at least one controlled element and controlling the at least one controlled element. At least one control element;

It includes the following steps:

Generating random information corresponding to the number of controlled elements,

Providing the random information to the user, and generating a login reference password by using the stored login rule based on the random information;

Get the dynamic password entered by the user;

The dynamic password and the login reference password are matched. If the two match, the login is allowed. If the two do not match, the login is denied.

The login method according to claim 1, wherein storing the login rule set in advance by at least one user includes

Get the number and location of the controlled elements;

Get the number and location of control elements;

Combining the controlled element and the control element to form a login rule;

The login rule is stored.

The login method according to claim 2, wherein the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user.

4. The login method according to claim 3, wherein, in addition to acquiring the user identity information, the encryption key is further acquired to invoke the stored login rule corresponding to the user by using the user identity information and the encryption key.

The login method according to claim 1, wherein the providing the random information to the user is provided to the user in the form of an image, a sound, or the like.

6. The login method according to claim 1, wherein the controlled elements are numbers, letters, characters, national characters, musical symbols, chromatograms, chemical element symbols, pictures, and the like; the control elements are arranged Combinations, mathematical operators, logical operators, shift operators.

The login method according to claim 1, wherein the acquisition control element and the controlled element are implemented by providing a control element input and/or selection interface and a control element input and/or selection interface. 8. The login method according to claim 1, further comprising storing at least one alarm rule preset by each user, the alarm rule including at least one controlled element and at least controlling the at least one controlled element A control element provides the random information to the user, and generates an alarm reference password based on the random information using the stored alarm rule; and matches the dynamic password and the alarm reference password, and if the two match, an alarm is generated.

9. A method for logging in to a system based on a user-generated dynamic password, wherein the system stores a plurality of user-set login rules, the login rule including at least one controlled element and at least one of the controlled elements a control element;

It includes the following steps:

Providing the random information to the user;

Obtain user identity information and a dynamic password entered by the user;

Using the obtained user identity information, calling the stored login rule corresponding to the user and generating a reference password based on the random information;

The dynamic password and the reference password are matched. If the two match, the login is allowed. If the two do not match, the login is refused. The login method according to claim 9, wherein storing the login rules set in advance by each user comprises acquiring the number and location of the controlled elements;

Get the number and location of control elements;

Combining the controlled element and the control element to form a login rule;

The login rule is stored.

The login method according to claim 10, wherein the encryption is performed when the registration rule is stored, and the encryption key is stored by the system or controlled by the user.

The login method according to claim 11, wherein, in addition to acquiring user identity information, the encryption key is further acquired to facilitate calling the stored login rule of the corresponding user with the user identity information and the encryption key.

The login method according to claim 9, wherein the providing the random information to the user is to provide the random information to the user's terminal device in the form of an image and or a sound through a wired or wireless manner.

14. A method for logging in to a system based on a user-generated dynamic password, wherein the system stores a plurality of users preset a login rule, the login rule including at least one controlled element and at least one control element controlling the at least one controlled element;

It includes the following steps:

Providing the random information to the user;

Obtain user identity information and a dynamic password entered by the user;

The dynamic password and the reference password are matched. If the two match, the login is allowed. If the two do not match, the login is refused.

15. A method for logging in to a system based on a user-generated dynamic password, wherein the system stores a plurality of preset login rules for the user, the login rule including at least one controlled element and at least the at least one controlled element. a control element;

It includes the following steps:

Obtain the identity information of the user;

Recalling the stored login rule corresponding to the user according to the acquired identity information;

Providing the random information to the user; and generating a login reference password based on the login rule of the user and the random information;

16. The method for logging in to a system based on a user-generated dynamic password, wherein the system stores at least one login rule preset by a user, the login rule including at least one controlled element and at least the at least one controlled element being controlled a control element;

It includes the following steps:

Perceive the existence of the user terminal;

Obtain the identity information of the user;

And providing the random information to the user terminal by means of short-range wireless communication; and generating a login reference password based on the login rule of the user and the random information;

Receiving a dynamic password sent by the user terminal; The dynamic password and the login reference password are matched. If the two match, the login is allowed. If the two do not match, the login is refused.

17. The apparatus for logging in to a system based on a user-generated password, wherein the system includes at least a storage unit storing at least one login rule preset by a user, the login rule including at least one controlled element and the at least one controlled At least one control element that the element controls;

The device includes:

a random information generating unit, configured to generate random information corresponding to the number of controlled elements,

a random information transmission unit, configured to provide the random information to the user,

a login reference password generating unit, configured to generate a login reference password by using the stored login rule based on the random information; and an obtaining unit, configured to acquire at least a dynamic password input by the user;

The matching unit matches the dynamic password and the login reference password. If the two match, the login is allowed, and if the two do not match, the login is refused.

18. The apparatus according to claim 17, wherein the storage unit further stores at least one alarm rule preset by the at least one user, the alarm rule including at least one controlled element and the at least one controlled element And controlling at least one control element, further comprising an alarm reference password generating unit, configured to generate an alarm reference password by using the stored alarm rule based on the random information; and an alarm matching unit, matching the dynamic password and the alarm reference password If the two match, the alarm will be given.