Secure data interaction method and system

• US 9,807,612 B2
• Filed: 01/30/2015
• Issued: 10/31/2017
• Est. Priority Date: 04/25/2014
• Status: Active Grant

• Current Assignee: Tendyron Corporation
• Original Assignee: Tendyron Corporation
• Inventors: Li, Dongsheng
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US15/306,675
• Publication Number:
  US 20170064554A1
• Time in Patent Office: 1,005 Days
• Field of Search: 713169, 713173
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

Provided are a secure data interactive method and system, the method including: scanning, by a terminal, an intelligent cipher token in a signal coverage range and obtaining identification information of the intelligent cipher token; conducting a mutual authentication between the terminal and a background system server, and/or conducting a mutual authentication between the terminal and the intelligent cipher token; obtaining, by the terminal, user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token; and storing, by the terminal, the user information into a pre-established current user list.

Claims

1. A secure data interactive method, comprising:

scanning, by a terminal, an intelligent cipher token in a signal coverage range and obtaining identification information of the intelligent cipher token;

conducting a mutual authentication between the terminal and at least one of a background system server and the intelligent cipher token;

obtaining, by the terminal, user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token; and

storing, by the terminal, the user information into a pre-established current user list;

wherein obtaining by the terminal user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token comprises;

sending, by the terminal, the identification information of the intelligent cipher token and a user information reading request to the background system server;

obtaining, by the background system server, the user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token, after the background system server receives the identification information of the intelligent cipher token and the user information reading request;

obtaining, by the background system server, response information of the user information reading request based on the user information and sending the response information of the user information reading request to the terminal; and

obtaining, by the terminal, the user information based on the response information of the user information reading request, after the terminal receives the response information of the user information reading request;

or

sending, by the terminal, a user information reading request to the intelligent cipher token, based on the identification information of the intelligent cipher token;

obtaining, by the intelligent cipher token, pre-stored user information, obtaining response information of the user information reading request based on the pre-stored user information, and sending the response information of the user information reading request to the terminal; and

obtaining, by the terminal, the user information based on the response information of the user information reading request, after the terminal receives the response information of the user information reading request.

2. The method according to claim 1, after scanning by a terminal an intelligent cipher token in a signal coverage range and obtaining identification information of the intelligent cipher token, further comprising:

generating, by the terminal, a real-time identification list, after the terminal obtains identification information of all intelligent cipher tokens in the signal coverage range of the terminal;

comparing, by the terminal, each piece of identification information in the real-time identification list with all the identification information in the pre-established current user list, at a predetermined time interval;

executing, by the terminal, the step of obtaining user information corresponding to an scanned intelligent cipher token respectively based on identification information included in the real-time identification list but not included in the pre-established current user list;

deleting, from the pre-established current user list, user information corresponding to each intelligent cipher token with the identification information included in the pre-established current user list but not included in the real-time identification list.

3. The method according to claim 1, after scanning by a terminal an intelligent cipher token in a signal coverage range and obtaining identification information of the intelligent cipher token, further comprising:

generating, by the terminal, a real-time identification list, after the terminal obtains identification information of all intelligent cipher tokens in the signal coverage range of the terminal;

comparing, by the terminal, each piece of identification information in the real-time identification list with all the identification information in the pre-established current user list, at a predetermined time interval;

executing, by the terminal, the step of obtaining user information corresponding to an scanned intelligent cipher token respectively based on identification information included in the real-time identification list but not included in the pre-established current user list, and storing obtained user information into the real-time identification list;

copying user information corresponding to each intelligent cipher token with the identification information included in the real-time identification list and included in the pre-established current user list from the pre-established current user list to the real-time identification list; and

taking the real-time identification list as an updated current user list.

4. The method according to claim 1, after sending by the terminal the identification information of the intelligent cipher token and a user information reading request to the background system server, further comprising:

judging, by the background system server, whether the identification information of the intelligent cipher token is included in an intelligent cipher token abnormality list pre-stored in the background system server;

after the background system server judges that the identification information of the intelligent cipher token is included in the intelligent cipher token abnormality list, obtaining, by the background system server, an intelligent cipher token locking instruction, signing the intelligent cipher token locking instruction by using a private key of the background system server to generate fifth signature information, and sending the intelligent cipher token locking instruction and the fifth signature information to the intelligent cipher token via the terminal;

verifying, by the intelligent cipher token, the fifth signature information by using a public key in a pre-stored background system server certificate, after the intelligent cipher token receives the intelligent cipher token locking instruction and the fifth signature information; and

executing, by the intelligent cipher token, an intelligent cipher token locking operation based on the intelligent cipher token locking instruction, after the fifth signature information is successfully verified.

5. The method according to claim 1, further comprising:

receiving and checking, by the background system server, a terminal registration application;

sending, by the background system server, a terminal key pair generating instruction to the terminal, after the terminal registration application is successfully checked;

generating, by the terminal, a terminal key pair after the terminal receives the terminal key pair generating instruction;

sending, by the terminal, a public key in the terminal key pair to the background system server;

generating, by the background system server, a terminal certificate and sending the terminal certificate to the terminal, after the background system server receives the public key in the terminal key pair;

storing, by the terminal, the terminal certificate;

and

receiving and checking, by the background system server, an intelligent cipher token registration application;

sending, by the background system server, an intelligent cipher token key pair generating instruction to the intelligent cipher token, after the intelligent cipher token registration application is successfully checked;

generating, by the intelligent cipher token, an intelligent cipher token key pair after the intelligent cipher token receives the intelligent cipher token key pair generating instruction;

sending, by the intelligent cipher token, a public key in the intelligent cipher token key pair to the background system server;

generating, by the background system server, an intelligent cipher token certificate and sending the intelligent cipher token certificate to the intelligent cipher token, after the background system server receives the public key in the intelligent cipher token key pair; and

storing, by the intelligent cipher token, the intelligent cipher token certificate.

6. The method according to claim 5, further comprising:

obtaining, by the terminal, a terminal cancellation application, signing the terminal cancellation application by using a private key of the terminal to generate sixth signature information, and sending the terminal cancellation application and the sixth signature information to the background system server;

verifying, by the background system server, the sixth signature information by using a public key in the terminal certificate pre-stored, after the background system server receives the terminal cancellation application and the sixth signature information;

after the sixth signature information is successfully verified, deleting, by the background system server, the terminal certificate pre-stored, generating terminal cancellation completion information and sending the terminal cancellation completion information to the terminal;

deleting, by the terminal, the private key of the terminal after the terminal receives the terminal cancellation completion information;

and/or

obtaining, by the intelligent cipher token, an intelligent cipher token cancellation application, signing the intelligent cipher token cancellation application by using a private key of the intelligent cipher token to generate seventh signature information, and sending the intelligent cipher token cancellation application and the seventh signature information to the background system server;

verifying, by the background system server, the seventh signature information by using a public key in the intelligent cipher token certificate pre-stored, after the background system server receives the intelligent cipher token cancellation application and the seventh signature information;

after the seventh signature information is successfully verified, deleting, by the background system server, the intelligent cipher token certificate pre-stored, generating intelligent cipher token cancellation completion information and sending the intelligent cipher token cancellation completion information to the intelligent cipher token;

deleting, by the intelligent cipher token, the private key of the intelligent cipher token after the intelligent cipher token receives the intelligent cipher token cancellation completion information.

7. The method according to claim 1, after the background system server receives the identification information of the intelligent cipher token and the user information reading request, and before the background system server sends the response information of the user information reading request to the terminal, further comprising:

sending, by the background system server, user authorization request information to the intelligent cipher token via the terminal;

generating, by the intelligent cipher token, authorization information and sending the authorization information to the background system server via the terminal, after the intelligent cipher token received the user authorization request information;

executing, by the background system server, the step of sending the response information of the user information reading request to the terminal, after the background system server receives the authorization information.

8. The method according to claim 1, wherein information transmitted between the background system server and the terminal is transmitted after at least one of an encryption calculation and a check calculation via a first session key, wherein the first session key is pre-stored in the background system server and the terminal or generated through a negotiation of the background system server and the terminal;

and/or

information transmitted between the terminal and the intelligent cipher token is transmitted after at least one of an encryption calculation and a check calculation via a second session key, wherein the second session key is pre-stored in the terminal and the intelligent cipher token or generated through a negotiation of the terminal and the intelligent cipher token.

9. A secure data interactive system, comprising:

a terminal, a background system server and an intelligent cipher token;

wherein,

the terminal is configured to;

scan the intelligent cipher token in a signal coverage range, and obtain identification information of the intelligent cipher token;

conduct a mutual authentication with at least one of the background system server and the intelligent cipher token;

obtain user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token; and

store the user information into a pre-established current user list;

when the terminal obtains the user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token by cooperating with the background system server, the terminal is further configured to;

send the identification information of the intelligent cipher token and a user information reading request to the background system server; and

receive response information of the user information reading request sent by the background system server and obtain the user information based on the response information of the user information reading request; and

the background system server is configured to;

receive the identification information of the intelligent cipher token and the user information reading request sent by the terminal, and obtain the user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token; and

obtain the response information of the user information reading request based on the user information, and send the response information of the user information reading request to the terminal;

when the terminal obtains the user information corresponding to the intelligent cipher token based on the identification information of the intelligent cipher token by cooperating with the intelligent cipher token, the terminal is further configured to;

send a user information reading request to the intelligent cipher token based on the identification information of the intelligent cipher token;

receive response information of the user information reading request sent by the intelligent cipher token, and obtain the user information based on the response information of the user information reading request; and

the intelligent cipher token is configured to;

obtain pre-stored user information, obtain the response information of the user information reading request based on the pre-stored user information, and send the response information of the user information reading request to the terminal.

10. The system according to claim 9, wherein,

after scanning the intelligent cipher token in the signal coverage range and obtaining the identification information of the intelligent cipher token, the terminal is further configured to:

obtain identification information of all intelligent cipher tokens in the signal coverage range of the terminal and generate a real-time identification list;

compare each piece of identification information in the real-time identification list with all the identification information in the pre-established current user list, at a predetermined time interval;

obtain user information corresponding to an scanned intelligent cipher token respectively based on identification information included in the real-time identification list but not included in the pre-established current user list;

delete, from the pre-established current user list, user information corresponding to each intelligent cipher token with the identification information included in the pre-established current user list but not included in the real-time identification list.

11. The system according to claim 9, wherein,

after scanning the intelligent cipher token in the signal coverage range and obtaining the identification information of the intelligent cipher token, the terminal is further configured to:

obtain identification information of all intelligent cipher tokens in the signal coverage range of the terminal and generate a real-time identification list;

compare each piece of identification information in the real-time identification list with all the identification information in the pre-established current user list, at a predetermined time interval;

obtain user information corresponding to an scanned intelligent cipher token respectively based on identification information included in the real-time identification list but not included in the pre-established current user list, and store obtained user information into the real-time identification list;

copy user information corresponding to each intelligent cipher token with the identification information included in the real-time identification list and included in the pre-established current user list from the pre-established current user list to the real-time identification list; and

take the real-time identification list as an updated current user list.

12. The system according to claim 9, wherein,

after the terminal sends the identification information of the intelligent cipher token and the user information reading request to the background system server, the background system server is further configured to:

judge whether the identification information of the intelligent cipher token is included in an intelligent cipher token abnormality list pre-stored in the background system server;

obtain an intelligent cipher token locking instruction, sign the intelligent cipher token locking instruction by using a private key of the background system server to generate fifth signature information, and send the intelligent cipher token locking instruction and the fifth signature information to the intelligent cipher token via the terminal, after the background system server judges that the identification information of the intelligent cipher token is included in the intelligent cipher token abnormality list; and

the intelligent cipher token is further configured to;

receive the intelligent cipher token locking instruction and the fifth signature information and verify the fifth signature information by using a public key in a pre-stored background system server certificate;

execute an intelligent cipher token locking operation based on the intelligent cipher token locking instruction, after the fifth signature information is successfully verified.

13. The system according to claim 9, wherein,

the background system server is further configured to:

receive and check a terminal registration application;

send a terminal key pair generating instruction to the terminal, after the terminal registration application is successfully checked;

receive a public key in a terminal key pair sent by the terminal, generate a terminal certificate and send the terminal certificate to the terminal;

the terminal is further configured to;

receive the terminal key pair generating instruction sent by the background system server and generate the terminal key pair;

send the public key in the terminal key pair to the background system server;

store the terminal certificate;

and

the background system server is further configured to;

receive and check an intelligent cipher token registration application;

send an intelligent cipher token key pair generating instruction to the intelligent cipher token, after the intelligent cipher token registration application is successfully checked;

receive a public key in an intelligent cipher token key pair sent by the intelligent cipher token, generate an intelligent cipher token certificate and send the intelligent cipher token certificate to the intelligent cipher token;

the intelligent cipher token is further configured to;

receive the intelligent cipher token key pair generating instruction sent by the background system server and generate the intelligent cipher token key pair;

send the public key in the intelligent cipher token key pair to the background system server;

store the intelligent cipher token certificate.

14. The system according to claim 13, wherein,

the terminal is further configured to:

obtain a terminal cancellation application, sign the terminal cancellation application by using a private key of the terminal to generate sixth signature information, and send the terminal cancellation application and the sixth signature information to the background system server;

receive terminal cancellation completion information sent by the background system server and delete the private key of the terminal;

the background system server is further configured to;

receive the terminal cancellation application and the sixth signature information sent by the terminal and verify the sixth signature information by using a public key in the terminal certificate pre-stored;

after the sixth signature information is successfully verified, delete the terminal certificate pre-stored, generate the terminal cancellation completion information and send the terminal cancellation completion information to the terminal;

and/or

the intelligent cipher token is further configured to;

obtain an intelligent cipher token cancellation application, sign the intelligent cipher token cancellation application by using a private key of the intelligent cipher token to generate seventh signature information, and send the intelligent cipher token cancellation application and the seventh signature information to the background system server;

receive intelligent cipher token cancellation completion information sent by the background system server, and delete the private key of the intelligent cipher token;

the background system server is further configured to;

receive the intelligent cipher token cancellation application and the seventh signature information sent by the intelligent cipher token and verify the seventh signature information by using a public key in the intelligent cipher token certificate pre-stored;

after the seventh signature information is successfully verified, delete the intelligent cipher token certificate pre-stored, generate the intelligent cipher token cancellation completion information and send the intelligent cipher token cancellation completion information to the intelligent cipher token.

15. The system according to claim 9, wherein,

the background system server is further configured to:

send user authorization request information to the intelligent cipher token via the terminal;

receive authorization information sent by the intelligent cipher token via the terminal and send the response information of the user information reading request to the terminal; and

the intelligent cipher token is further configured to;

receive the user authorization request information sent by the background system server via the terminal, generate the authorization information, and send the authorization information to the background system server via the terminal.

16. The system according to claim 9, wherein information transmitted between the background system server and the terminal is transmitted after at least one of an encryption calculation and a check calculation via a first session key, wherein the first session key is pre-stored in the background system server and the terminal or generated through a negotiation of the background system server and the terminal;

and/or

information transmitted between the terminal and the intelligent cipher token is transmitted after at least one of an encryption calculation and a check calculation via a second session key, wherein the second session key is pre-stored in the terminal and the intelligent cipher token or generated through a negotiation of the terminal and the intelligent cipher token.