One time password generating method and apparatus

[0001] The invention relates to a user authentication system, in particularly to a one time password generating method and an apparatus.

[0002] At present, more and more online crimes emerge, which is mainly resulted from disadvantages inhered in authentication method. The commonly-used method is static password authentication. The so-called static password authentication method means that data used in the authentication process is static data, this means that, the password in each authentication is constant, therefore the static password is easy to be got through memory scanning or online listening. It is a potential threat to security.

[0003] For recent years, slow development in password technology and rapid development in decryption technology make it a threat to reliability of authenticating a user.

[0004] A dynamic password authentication technology is developed in order to eliminate the security problems derived from the static password. The dynamic password, also called the one time password, is a name relative to the traditional static one.

[0005] The dynamic password differs with the changeable dynamic factor used for generating the password. Double factors are applied in algorithm for generating the dynamic password. Among the two factors, one is for identifying a user, which is constant, such as the user's private password, while the other is a changeable factor, such as time, random data, and a counter value etc.

[0006] The dynamic password technology applies a special apparatus named one time password token with a built-in power, a password generating chip, and a screen. The password generating chip executes special password algorithm, and a password is generated based on the current time and frequency value and is displayed on a screen.

[0007] Due to advantages that the one time password token is hold by a user himself and therefore others cannot get the password therein along with that the password cannot be predicted, the technology meets the need for authenticating and authorizing a user during a process of distant logging-on online information service system.

[0008] However, the present one time password generating apparatus has disadvantages such as lack of a function of authenticating a user as a valid holder of the apparatus thereon, only for one user with the old apparatus, and imitation of the apparatus when it is lost or theft.

[0009] The invention overcomes the above-mentioned shortcomings, and provides a method for generating a one time password with high safety and convenience and an apparatus thereof.

[0010] The one time password generating method provided by the invention includes steps of collecting fingerprint images, extracting fingerprint feature data, comparing the fingerprint feature data with one pre-stored fingerprint feature template or more fingerprint feature templates separately, and generating a one time password after a match is found.

[0011] Before the step of collecting fingerprint images, the invention further includes a step of triggering a signal to collect fingerprint images.

[0012] The step of comparison is a step of comparing the fingerprint feature data extracted with at lest one of pre-stored fingerprint feature templates separately.

[0013] The one time password can be generated by the fingerprint feature template or the user's secret corresponding to the template.

[0014] The step of generating a one time password can be executed by computing the user's secret and a dynamic factor, or by computing the fingerprint feature template value and a dynamic factor with preset password generating algorithm.

[0015] The dynamic factor includes an event and/or a time factor.

[0016] The invention further includes a step of evening or merging fingerprint images collected from many times after those images are collected.

[0017] The invention further includes a step of choosing an optimal fingerprint image from those collected from many times after those fingerprint images are collected.

[0018] The pre-stored fingerprint feature template(s) can be one or more fingerprint feature templates corresponding to one user.

[0019] The pre-stored fingerprint feature templates can be a plurality of fingerprint feature templates corresponding to more users.

[0020] The invention also discloses a one time password generating apparatus, including:

[0021] a fingerprint image collecting unit for collecting fingerprint images under control of a control unit;

[0022] a fingerprint feature extracting unit for extracting fingerprint feature data from the fingerprint images collected by the fingerprint image collecting unit under control of the control unit;

[0023] a storage unit for storing one or more fingerprint feature templates under control of the control unit;

[0024] a comparison unit for comparing the fingerprint feature data extracted by the fingerprint feature extracting unit with those fingerprint feature templates in the storage unit and returning a comparison result to the control unit;

[0025] the control unit for starting a one time password generating unit according to the comparison result and sending the password to an output unit;

[0026] the one time password generating unit for generating a one time password with the pre-stored one time password generating algorithm and sending it to the control unit; and

[0027] the output unit for outputting the one time password under control of the control unit.

[0028] The apparatus further includes a trigger unit for sending a signal to the control unit to trigger the fingerprint image collecting unit.

[0029] The output unit further includes a screen, a blue-tooth communication interface, or an infrared communication interface.

[0030] The apparatus further includes a battery unit for power supply.

[0031] The output unit can be a USB communication interface.

[0032] The USB communication interface can be used as a power supply for the apparatus.

[0033] The fingerprint image collecting unit can be an infrared sensor, a fingerprint scanner, a CCD, or a CMOS image sensor.

[0034] The storage unit can store one or more fingerprint feature templates corresponding to one valid user.

[0035] The storage unit can store a plurality of fingerprint feature templates corresponding to more valid users.

[0036] The apparatus further includes an input unit for inputting fingerprint feature templates.

[0037] The invention adds a function of fingerprint authentication to the one time password generating apparatus, as a result, avoids disadvantages such as lack of a function of authenticating a user as a valid holder of the apparatus thereon, only for one user holding the old apparatus, imitation of the apparatus when it is lost or theft, and therefore improves security of the apparatus greatly.

[0040] The embodiment 1 discloses a one time password generating method, as shown in FIG. 1, a flow chart thereof, including steps described below.

[0041] In step 101, a trigger signal from a button or a sensing apparatus is received to enable collecting fingerprint images.

[0042] In step 102, fingerprint images are collected through scanning, taking photo, or infrared sensing.

[0043] Preferably, those fingerprint images can be collected for many times, and a final optimal one can be gotten from those collected ones through selecting them, or evening or merging them.

[0044] In step 103, fingerprint feature data is extracted from the final optimal image.

[0045] In step 104, the fingerprint feature data is compared with that pre-stored one corresponding to one valid user.

[0046] The step of comparison is a step of comparing the fingerprint feature data collected in Step 103 with one fingerprint feature template when only one fingerprint feature template is pre-stored, or with more fingerprint feature templates separately when more fingerprint feature templates are pre-stored.

[0047] In this embodiment, one or more fingerprint feature templates corresponding to one valid user can be pre-stored, this means that, the template can be gotten from one finger of the valid user or more templates from more fingers of the same person. For example, these templates can be gotten from the middle finger of one user's left and right hand separately, or from more fingers of one user's left hand at the same time. Also, fingerprint feature templates from many valid users can be pre-stored, wherein only one fingerprint feature template can be stored by each valid user from his one finger or more by each valid user from different fingers of his two hands. Furthermore, a method of one user storing fingerprint feature templates is different from that of another, for example, party A can store only one template from his one finger, while party B can store more templates from his different fingers.

[0048] In step 105, determining if a match is found, if it is, go to step 106; otherwise a trouble-shooting will be executed. The trouble-shooting can be an end to all steps, or a prompt of a user to re-input fingerprints for authentication which means that it is to return to step 102 for a restart.

[0049] In step 106, after the match is found, a password is enabled to generate with one time password generating algorithm.

[0050] The one time password also can be generated by one user's pre-stored secret corresponding to the fingerprint feature template matched in the comparison process in step 105. The user's secret can be a user's ID number, or a random number, etc.

[0051] More methods of generating a one time password with the pre-stored password generating algorithm by computing the user's secret and time and/or event factor etc. are listed below.

[0052] The one time password can be gotten by a part or whole of one user's secret directly or indirectly in combination with a time and/or an event factor. For example, if one user's secret is 12345 and a time factor is 1011, the password can be gotten by computing whole of the user's secret and the time factor directly, herein computation includes addition, subtraction, multiplication, division, AND, OR, NOT, and XOR, etc. Take subtraction as an example, the password can be gotten by 12345 minus 1011 that is 11334. In the above-described operation, the time factor can be gotten by the current time or a conversion to it. The conversion to the time factor includes a time digit exchange, a time digit combination, a time digit sort, or an operation (addition, subtraction, multiplication, and division) to the time value by a fixed value. In all, those skilled in the art will get the time factor converted with all the above-mentioned methods or the other replacements, and therefore it is not necessary for more description. Otherwise, the password also can be gotten by part of one user's secret, such as by continue or discontinue part of the secret as pre-determined. For example, the password 123+1011=1134 can be gotten by adding the first three digits 123 of the user's secret of 12345 and the time factor 1011. Different from the above-mentioned algorithm, the password also can be gotten by computing a conversion result of the whole or part of the user's secret and time factor, herein the conversion method of the whole or part of the user's secret includes a digit exchange, a digit combination, and a digit sorting. Taking digit exchange method as an example, the password 54321 can be gotten firstly by reversing the user's secret order of 12345, and secondly by adding the result value and the time factor. The method of generating a one time password by a user's secret and an event factor is the same as that by a user's secret and a time factor. Moreover, the password also can be gotten by computing a user's secret and a time & event factor. For example, this operation can be made by direct or indirect conversion of whole and part of a user's secret along with an operation to a time & event factor like addition, subtraction, multiplication, division, AND, OR, NOT, and XOR, etc.

[0053] The password can be further gotten by a combination of a fingerprint feature template with a time and/or an event factor. The process of generating a password by a fingerprint feature template and a time and/or event factor is the same as that by a user's secret and a time and/or an event factor.

[0054] In step 107, the password is output to a user.

[0055] The password can be shown on a screen and input by a user into a host to be authenticated. Also, the password can be output to a host by a USB communication interface in connection with the host. Further, the password can be output to a host by a blue-tooth or an infra-red communication interface.

[0056] In this embodiment 2, a one time password generating apparatus is disclosed. As shown in FIG. 2, a structure view of this embodiment 2, the apparatus includes a fingerprint image collecting unit 201, a fingerprint feature extracting unit 202, a storage unit 203, a comparison unit 204, a control unit 205, a one time password generating unit 206, and an output unit 207.

[0057] Fingerprint image collecting unit 201 is for collecting fingerprint images under control of the control unit 205, which can be an infra-red fingerprint sensor with a digital interface, a fingerprint scanner, a CCD, or a CMOS image sensor, etc.

[0058] Fingerprint feature extracting unit 202 is for extracting fingerprint feature data from fingerprint images under control of the control unit 205, which firstly converses those collected finger images into digital images convenient for extracting fingerprint feature by enhancing, segmenting, smoothing, and thinning them, and then extracts fingerprint feature data from those processed digital images.

[0059] Storage unit 203 is for pre-storing one or more fingerprint feature templates from one valid user, or a plurality of fingerprint feature templates from more valid users. The one time password generating algorithm can be pre-stored in the storage unit 203, or in the one time password generating unit 206. Also, the storage unit 206 can store the user's secret corresponding to one or more fingerprint feature templates used to generate a one time password in combination with a dynamic factor. Further, the storage unit 203 can be integrated with the control unit 205 into one control chip, or can be an extensive SRAM or FLASH memory in connection with the control unit 205.

[0060] Comparison unit 204 is for comparing fingerprint feature data extracted by the fingerprint feature extracting unit 202 with the fingerprint feature template pre-stored in the storage unit 203 when only one fingerprint feature template corresponding to one valid user is pre-stored in the storage unit 203, or with more templates one by one when more fingerprint feature templates corresponding to one or more valid users are pre-stored in the storage unit 203, and returning a comparison result to the control unit 205.

[0061] Control unit 205 is for enabling or disabling the one time password generating unit to generate a password based on the above comparison result. If the comparison result shows a match is found between the fingerprint feature and at least one of the fingerprint feature templates, an authentication is passed and one time password generating unit 206 is enabled, otherwise the user is authenticated as an invalid user and one time password generating unit 204 is disabled.

[0062] One time password generating unit 206 is for generating a password with pre-stored one time password generating algorithm under control of the control unit 205.

[0063] Output unit 207 is for outputting the password generated by the one time password generating unit 206; the output unit 207 can apply a USB communication interface, through which a working power will be supplied by a host. Also, the output unit 207 can be a screen, including a segment code screen, a dot-matrix screen, a characters screen or an images screen, or a blue-tooth or an infra-red communication interface through which a one time password is sent to a host and the apparatus is supplied power with a battery unit.

[0064] Furthermore, the one time password generating apparatus includes a trigger unit 208 for sending a trigger signal to the control unit 205 for enabling the fingerprint image collecting unit to collect fingerprint images, which can be a button, a digital key, or a sensor, etc.

[0065] Furthermore, the one time password generating apparatus includes an input unit for inputting fingerprint feature templates, which can be a USB interface, or a UART interface, etc.

[0066] Because a person's fingerprints are safe, unique, stable, easy to get and hard to copy, fingerprint identification becomes a method of identifying a user. With development of science and technology, fingerprint identification technology is perfecting.

[0067] In early 90's of twenty century, the fingerprint identification technology is widely used as a relatively perfect biometric identification method.

[0068] Due to cost cut by a large margin in the automatic fingerprint identification system, application of the above-mentioned technology is no longer limited to such sectors as law and public security. And it develops into a method of a user being authenticated by a computer.

[0069] Traditional fingerprint identification systems are all based on PC, which boast of quick identification speed, high storage volume, and perfect software design.

[0070] However, the PC-based fingerprint identification system has setbacks of high price, uneasy to move and high power loss, which limits its expansion in application.

[0071] Since late twenty century, the rapid development in silicon technology and embedded technology provides a platform for people to design a low-cost portable fingerprint identification system.

[0072] As a result, the fingerprint identification system is applied to many sectors, such as information security technology in visiting a website resource, authentication for an ATM card and a credit card, double-authentication for various smart IC cards, employee confirmation, and electronic lock for home usage.

[0073] The invention adds a fingerprint authentication function to the process of generating a one time password, this in detail means that, only the user who passes a valid authentication will get a true password. The improvement avoids setbacks that the old one time password generating apparatus is lack of a function of authenticating a user as the valid holder for the apparatus, and thus improves security of the apparatus. Meanwhile, the invention can be applied to authenticating more valid users through their fingerprints, that differs from that traditionally only used by one valid user, and therefore widens application of the apparatus. Furthermore, the invention avoids the risk that the apparatus may be imitated when lost or theft, as a result, improves security of the apparatus.

[0074] The above-mentioned is a detail description of the one time password generating method and apparatus thereof of this invention with explanations on its principle and embodiments, which is only for understanding the method and relative principle of the invention. Those skilled in the art will recognize that many modifications may be made to this configuration without departing from the scope of the present invention. Therefore, the method described in this specification should not be regarded as a limitation to the invention.