阅读说明：本技术 一种密码输入方法与装置 (Password input method and device ) 是由 谢建全 屈喜龙 彭慧 古今杰 李博 刘胜宗 于 2021-09-26 设计创作，主要内容包括：本发明公开了一种密码输入方法与装置,方法包括以下步骤：步骤1,产生1位随机数字r∈{0,1,2,......9},并发送给用户；步骤2,接收输入的密码字符b,并根据密码字符b和随机数字r按预设规则逆向计算真实密码的当前位字符c；其中,所述密码字符b是用户根据接收到的随机数字r和真实密码的当前位字符k按预设规则计算并输入得到；在步骤2接收到密码字符之后在计算字符c的同时,同步地重新开始执行步骤1,直到真实密码全部字符输入完毕。本发明能有效防止偷窥者窃取真正的密码,安全性高,能防止重放攻击,能应用于各类需要通过输入密码来进行认证的场合。(The invention discloses a password input method and a device, and the method comprises the following steps: step 1, generating a 1-bit random number r belonging to {0, 1, 2,. 9}, and sending the r to a user; step 2, receiving an input password character b, and reversely calculating a current bit character c of the real password according to the password character b and the random number r according to a preset rule; the password character b is obtained by calculating and inputting a user according to a received random number r and a current bit character k of a real password according to a preset rule; and (3) after the password characters are received in the step (2), synchronously restarting to execute the step (1) while calculating the characters c until all the characters of the real password are input. The invention can effectively prevent a peeper from stealing the real password, has high safety, can prevent replay attack, and can be applied to various occasions needing to be authenticated by inputting the password.)

1. A password input method, comprising the steps of:

step 1, generating a 1-bit random number r belonging to {0, 1, 2,. 9}, and sending the r to a user;

step 2, receiving an input password character b, and reversely calculating a current bit character c of the real password according to the password character b and the random number r according to a preset rule; the password character b is obtained by calculating and inputting a user according to a received random number r and a current bit character k of a real password according to a preset rule;

and (3) after the password characters are received in the step (2), synchronously restarting to execute the step (1) while calculating the characters c until all the characters of the real password are input.

2. The password input method of claim 1, wherein the method of calculating the password characters according to the preset rule comprises: b ═ k + r) mod 10; the method for reversely calculating each bit character of the real password according to the preset rule comprises the following steps: c ═ 10+ b-r) mod 10.

3. A password input method according to claim 1, wherein the random number is transmitted to the user by: displaying the random number on a local display screen of the system.

4. The password input method of claim 1, wherein the random number is transmitted to the user's handheld terminal by message push.

5. A password input apparatus, comprising: the system comprises a random number generation module, an information sending module, a password keyboard and a calculation module;

the random number generation module is used for generating a random number r epsilon {0, 1, 2.. 9 };

the information sending module is used for sending the random numbers generated by the random number generating module to a user;

the password keyboard module is used for receiving password characters input by a user; the password character b is obtained by calculating and inputting a user according to a received random number r and a current bit character k of a real password according to a preset rule;

the calculation module is configured to: and reversely calculating the current bit character c of the real password according to the password character b and the random number r and a preset rule.

6. The password input device of claim 5, wherein the method for calculating the password character according to the preset rule by the calculation module is as follows: b ═ k + r) mod 10; the method for reversely calculating each character of the real password by the user according to the preset rule comprises the following steps: c ═ 10+ b-r) mod 10.

7. The password input device of claim 5, wherein the information sending module is a local display screen and the sending mode is displaying random numbers.

8. The password input device of claim 5, wherein the information sending module is a wireless communication device, and sends the random number to the handheld terminal of the user by means of message pushing.

Technical Field

The invention relates to the field of information security, in particular to a password input method and a password input device capable of preventing peeping.

Background

The password is the most common method for realizing authentication and is a common means for realizing authority control, and the method is particularly widely applied to the financial field, for example, the existing domestic deposit cards which cannot be overdrawn all need to be authorized by the password, and the credit cards also default to trade by the password under common conditions. The password is easy to be peeped by lawless persons in the password input process, if the lawless persons know the account information of the bank card at the same time, the user funds can be stolen after the card is cloned, and potential safety hazards are brought to the user.

In order to prevent input passwords from being peeped, a plurality of mechanisms adopt shielding methods at present, most commonly various shielding covers are applied, liquid crystal touch screens with small visual angles are adopted in the mechanisms, and the passwords are input by assisting input codes in a disorganized arrangement sequence, the principle of the method is similar to that of shielding, so that a peeper with a large visual angle deviated from the front view cannot see the passwords input by the user, the passwords input by the methods are all password characters in the using process and are all 'what you see is what you get', therefore, the methods only reduce the probability that the passwords are peeped in the password input process, but cannot completely solve the problem that the passwords are peeped.

If lawless persons can deduce the password by researching the gesture of the user when inputting the password on the POS machine password keyboard; for example, there is a media report that some lawbreakers even cover a layer of keyboard on the keyboard of the ATM of the bank, the covered keyboard has a function of recording the password input by the user, the password input by the user is completely sent to the lawbreaker no matter what way is adopted, even a criminal group makes hands and feet on the mobile POS machine to directly record the password input by the user, which also means that the problem that the password is peeped by a shielding method cannot be completely solved.

Disclosure of Invention

The technical problem to be solved by the present invention is to provide a password input method with high security and preventing peeping, which overcomes the shortcomings of the background art.

In order to achieve the technical purpose, the invention adopts the following technical scheme:

a password input method comprising the steps of:

step 1, generating a 1-bit random number r belonging to {0, 1, 2,. 9}, and sending the r to a user;

step 2, receiving an input password character b, and reversely calculating a current bit character c of the real password according to the password character b and the random number r according to a preset rule; the password character b is obtained by calculating and inputting a user according to a received random number r and a current bit character k of a real password according to a preset rule;

and (3) after the password characters are received in the step (2), synchronously restarting to execute the step (1) while calculating the characters c until all the characters of the real password are input.

In a more preferred scheme of the password input method, the method for calculating the password characters according to the preset rule comprises the following steps: b ═ k + r) mod 10; the method for reversely calculating each bit character of the real password according to the preset rule comprises the following steps: c ═ 10+ b-r) mod 10.

In a more preferred approach to password entry, the way in which the random number is sent to the user is: displaying the random number on a local display screen of the system.

In a more preferred password input method scheme, a message push mode is adopted to send the random number to a handheld terminal of a user.

Another aspect of the present invention further provides a password input apparatus, including: the system comprises a random number generation module, an information sending module, a password keyboard and a calculation module;

the random number generation module is used for generating a random number r epsilon {0, 1, 2.. 9 };

the information sending module is used for sending the random numbers generated by the random number generating module to a user;

the password keyboard module is used for receiving password characters input by a user; the password character b is obtained by the user according to the received random number r and the current bit character k of the real password through calculation according to a preset rule;

the calculation module is configured to: and reversely calculating the current bit character c of the real password according to the password character b and the random number r and a preset rule.

In a more preferred scheme of the password input device, the method for calculating the password characters by the calculation module according to the preset rule comprises the following steps: b ═ k + r) mod 10; the method for reversely calculating each character of the real password by the user according to the preset rule comprises the following steps: c ═ 10+ b-r) mod 10.

In a more preferred scheme of the password input device, the information sending module is a local display screen, and the sending mode is to display random numbers.

In a more preferred scheme of the password input device, the information sending module is a wireless communication device, and sends the random number to a handheld terminal of a user in a message pushing mode.

Compared with the prior art, the invention has the beneficial effects that:

firstly, the characters input on the keyboard by the user are not password characters, but are characters generated after the characters are operated with a random number, even if a peeper peeps the contents input by the user, the peeper needs to calculate according to the random number generated before the input of the system, and after the system detects the input of the user, the random number displayed on the screen is updated, so that the peeper cannot calculate the true password of the user according to the input of the user and the updated random number. Therefore, even if a peeper obtains all the contents input by the user on the keyboard, the true password of the user cannot be obtained; and the auxiliary input password is a random number, so that a peeper cannot pass the authentication of the system by using the peeped input next time. The invention can effectively prevent a peeper from stealing the real password, has high safety, can prevent replay attack, and can be applied to various occasions needing to be authenticated by inputting the password.

Secondly, when the user converts the password into the input character, the mod 10 operation used in the calculation process is very simple, the essence is that the single digit is taken, the user can work only with the mathematics level of the lower grades of the primary school, and the problem of difficult calculation in use does not exist. In addition, in the implementation process of the invention, hardware equipment of the existing password authentication system is not required to be added for replacement and transformation, so that the invention has good practicability.

Drawings

Fig. 1 is a block diagram of a hardware device according to an embodiment of the present invention.

Detailed Description

The following describes embodiments of the present invention in detail, which are developed based on the technical solutions of the present invention, and give detailed implementation manners and specific operation procedures to further explain the technical solutions of the present invention.

Example 1

The present embodiment provides a password input method, which is shown in fig. 1, and includes the following steps:

step 1, generating a 1-bit random number r belonging to {0, 1, 2,. 9}, and sending the 1-bit random number r to a user.

Here, there are two alternative ways of sending the random number to the user: one is to display the random number on the local display screen of the system, and the other is to transmit the generated random number r to the handheld terminal by adopting a message pushing mode, so that the user terminal can conveniently display the random number r to the user through the display screen.

After receiving the random number r, the user calculates the actual character r to be input according to the received random number r and the current bit character k of the real password according to a preset rule, where the preset rule in this embodiment is: b ═ k + r) mod 10. Actually, the ones digit is b after r and k are added, and the ones digit can be simply obtained by mental arithmetic and input through a keyboard.

And 2, receiving the input password character b through the keyboard, and reversely calculating the current bit character c of the real password to be (10+ b-r) mod 10 according to the password character b and the random number r according to a preset rule.

Since b is (k + r) mod 10, it can be known from the calculation principle that:

namely, the system can calculate the real password k of the user according to the password character b actually input by the user, and input of the one-digit password is completed.

In order to improve the internal calculation efficiency of password input, after the password characters are received in the step 2, the step 1 is synchronously restarted while the characters c are calculated, and the steps are repeated until all the characters of the real password are input.

For example, the user inputs a password in the form of 6 decimal digits, the content of the password is 881156, and the operation steps are as follows:

(a) randomly generating a random number r for assisting in inputting the password, and assuming that the content is 5;

(b) the system displays this number 5 on the screen;

(c) the user calculates 5 the result of adding the first password 8 to be input to obtain 13, and the single digit 3 is taken as an input code to input 3 on a keyboard;

(d) after detecting the input of the user, the system converts the input into a real password according to the input of the user, and the calculation process is (10+3-5) mod 10 to obtain a real password 8;

and repeating the four steps to complete the input of each password bit remained later, wherein the number r for assisting the input of the password is random every time. Assuming that the numbers used to generate the auxiliary input password in this example are sequentially 5, 9, 2, 5, 3, 1, respectively, the corresponding inputs for the user input password 881156 are sequentially 3, 7, 3, 6, 8, 7. From the input content, the user's input characters have no direct visual relationship with the actual password, such as two identical password characters, whose input may not be the same, and the same identical input characters, whose corresponding passwords may be different.

Example 2

The present embodiment provides a password input device, including: the device comprises a random number generation module, an information sending module, a password keyboard and a calculation module. Wherein:

(1) a random number generation module for generating a random number r ∈ {0, 1, 2.

(2) And the information sending module is used for sending the random numbers generated by the random number generating module to the user.

The information sending module can be a local display screen or a wireless communication device. If the display screen is a local display screen, the random number can be received by the user after being displayed; if the mobile terminal is a wireless communication device, the random number is sent to the handheld terminal of the user for viewing through the wireless communication device in a message pushing mode.

After seeing the random number r on the display screen, the user calculates the current bit character k according to the received random number r and the real password according to a preset rule, wherein the preset rule in the embodiment is as follows: b ═ k + r) mod 10.

(3) The password keyboard module is used for receiving password characters input by a user; the password character b is obtained by the user according to the received random number r and the current bit character k of the real password through calculation according to a preset rule;

(4) a calculation module to: and reversely calculating the current bit character c of the real password according to the password character b and the random number r and a preset rule.

The operation principle of each module in this embodiment is the same as that described in embodiment 1, and is not repeated here.

The above embodiments are preferred embodiments of the present application, and those skilled in the art can make various changes or modifications without departing from the general concept of the present application, and such changes or modifications should fall within the scope of the claims of the present application.