Abstract:
An identity authentication method, system, and device, a dynamic token thereof acquires a login challenge code input by a user, and performs hashing of a work key and a first purpose code stored in the token, the obtained first hash data acting as a first calculation key, performs hashing of the first calculation key, first timing information, and the login challenge code to obtain a second hash data; the dynamic token performs truncation of the second hash data, and displays the obtained first truncated result as a login password, then the dynamic token waits for a user to trigger a key. Hence, on the basis of different purpose codes, the dynamic token generates different calculation keys, and on the basis of each calculation key generates dynamic passwords respectively applicable to each application scenario; correspondingly, on the basis of different purpose codes, an authentication server authenticates the dynamic passwords applicable to each application scenarios, reducing the risk of keys used for generating dynamic passwords being stolen, improving the security of a token authentication system.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention is related to a method for identity verification, a system and a device thereof, which belongs to information security field. 
       PRIOR ART 
       [0002]    Dynamic token is a device for generating a dynamic password, which is widely used in application fields such as e-bank, telecommunication operator and e-business, etc. The dynamic password generated by the dynamic token can be used for identity verification, which improves security of identification effectively. 
         [0003]    The prior art has following disadvantages: the dynamic token generates a dynamic password upon a seed key, which is a unique key information stored in the dynamic token; once the seed key is stolen, the security of identity verification cannot be assured. 
       SUMMARY OF THE INVENTION 
       [0004]    The object of the present invention provides a method for identity verification, a system and a device, which can reduce a risk that a key for generating a dynamic password is being stolen, therefore security of a token verification system is improved. 
         [0005]    Therefore, according to the first aspect of the present invention, there is provided a method for identity verification in a system including a dynamic token, a client side and an authentication server, wherein the method comprises following steps: 
         [0006]    receiving, by the authentication server, a first operating request from the client side, generating a first challenge code, storing the first challenge code as information corresponding to identification in the first operating request and sending the first challenge code to the client side; 
         [0007]    displaying, by the client side, the first challenge code; 
         [0008]    obtaining, by the dynamic token, a first challenge code input by a user; performing hash operation on a working key and a first usage code, which are stored in the dynamic token, upon detecting a first press key triggered; taking a first hash data obtained as a first computing key; performing hash operation on the first computing key, the first time information and the first challenge code to obtain a second hash data; 
         [0009]    performing, by the dynamic token, bit interception/truncation on the second hash data, taking a first bit interception result (truncated result) obtained as a first verification password to display; 
         [0010]    obtaining, by the client side, the first verification password input by a user, generating a first verification request including the first verification password and identification information, sending the first verification request to the authentication server; 
         [0011]    obtaining, by the authentication server, the identity information in the first verification request, searching for a working key and a first challenge code which are corresponding to the identity information in the first verification request, performing hash operation on the working key found by searching and the self-stored first usage code, taking a third hash data obtained as a second computing key, performing hash operation on the second computing key, a second time information and the first challenge code found by searching to obtain a fourth hash data; and 
         [0012]    performing, by the authentication server, bit interception on the fourth hash data, taking a second bit interception result obtained as a first verification password obtained by computing, determining whether the first verification password obtained by computing matches the first verification password obtained from the first verification request; if yes, sending information of successful verification to the client side; otherwise, sending information of failed verification to the client side. 
         [0013]    According to the second aspect of the present invention, there is provided a working method of a dynamic token which includes following steps: 
         [0014]    A1) waiting, by the dynamic token, for a user to trigger a press key; 
         [0015]    A2) when the press key of the dynamic token is triggered, determining, by the dynamic token, the press key triggered; if the press key triggered is a first press key, executing Step A3; if the press key triggered is a second press key, executing Step A5; 
         [0016]    A3) obtaining, by the dynamic token, a logon challenge code input by the user, performing hash operation on a working key and a first usage code, which are stored in the dynamic token; taking a first hash data obtained as a first computing key, performing hash operation on the first computing key, a first time information and a logon challenge code to obtain a second hash data; 
         [0017]    A4) performing, by the dynamic token, bit interception on the second hash data, displaying a first bit interception result obtained as a logon password, going back to Step A1; 
         [0018]    A5) obtaining, by the dynamic token, a signature challenge code input by the user, performing hash operation on the stored working key and a second usage code, which are stored in the dynamic token, taking the third hash data obtained as a second computing key, performing hash operation on the second computing key, the second time information and the signature challenge code to obtain a fourth hash data; and 
         [0019]    A6) performing, by the dynamic token, bit interception on the fourth hash data, displaying a second bit interception result obtained as signature password, going back to Step A1. 
         [0020]    According to the third aspect of the present invention, there is provided a working method for authentication server, which includes following steps: 
         [0021]    C1) waiting, by the authentication server, for a request from the client side; 
         [0022]    C2) after receiving the request from the client side, determining, by the authentication server, the received request, 
         [0023]    if the request is a logon request, executing C3; 
         [0024]    if the request is a logon verification request, executing C4; 
         [0025]    if the request is a signature request, executing C6; 
         [0026]    if the request is a signature verification request, executing C7; 
         [0027]    C3) generating, by the authentication server, a logon challenge code, storing the logon challenge code as information corresponding to the identity information in the logon request, sending the logon challenge code to the client side, going back to Step C1; 
         [0028]    C4) searching, by the authentication sever, the working key corresponding to the identity information and the logon challenge code in the logon verification request, performing hash operation on the working key found by searching and its self-stored first usage code, taking a twelfth hash data as a fourth computing key, performing hash operation on the fourth computing key and a fifth time information and the logon challenge code obtained by searching to obtain a thirteenth hash data; 
         [0029]    C5) performing, by the authentication server, bit interception on the thirteenth hash data, takes a seventh bit interception result obtained as the logon password obtained by computing; determining whether the logon password obtained by computing matches a logon password obtained from the logon verification request, if yes, sending information of successful authentication to the client side and going back to Step C1; otherwise, sending information of failed authentication to the client side and going back to Step C1; 
         [0030]    C6) generating, by the authentication server, a signature challenge code, storing the signature challenge code as information corresponding to the identity information in the signature request and sending the signature challenge code to the client side; go back to Step C1; 
         [0031]    C7) searching, by the authentication server, for the working key corresponding to the identity information in the signature verification request and the signature challenge code, performing hash operation on the working key found by searching and its self-stored second usage code and takes a fourteenth hash data obtained as a fifth computing key, performing hash operation on the fifth computing key, a sixth time information and the signature challenge code obtained by searching to obtain a fifth hash data; 
         [0032]    C8) performing, by the authentication server, bit interception on a fifteenth hash data, taking an eighth bit interception result obtained as a signature password obtained by computing, determining whether the signature password obtained by computing matches the signature password obtained from a signature password obtained from the signature authentication request, if yes, sending information of successful verification to the client side and going back to Step C1; otherwise, sending information of failed verification to the client side and going back to Step C1. 
         [0033]    According to the fourth aspect of the present invention, there is provided an identity verification system, which comprises a dynamic token, a client side and an authentication server, wherein 
         [0034]    the authentication server comprises: 
         [0035]    a first receiving module configured to receive a first operating request from the client side; 
         [0036]    a first generating module configured to generate a first challenge code, store the first challenge code as information corresponding to the identity information in the first operating request after receiving the first operating request; and 
         [0037]    a first sending module configure to send the first challenge code generated by the first generating module to the client side; 
         [0038]    the client side comprises: 
         [0039]    a second sending module configured to send the first operating request to the authentication server; 
         [0040]    a second receiving module configured to receive a first challenge code from the authentication server; and 
         [0041]    a first displaying module configured to display the first challenge code; 
         [0042]    the dynamic token comprises: 
         [0043]    a first storing module configured to store a working key and a first usage code; 
         [0044]    a first obtaining module configured to obtain a first challenge code input by a user; 
         [0045]    a detecting module configured to detect a press key; 
         [0046]    a first hash module configured to, when the detecting module detects that a first press key is triggered, perform hash operation on the working key and the first usage code which are stored by the first storing module to obtain a first hash data; 
         [0047]    a second hash module configured to take the first hash data obtained by hash operation performed by the first hash module as a first working key, perform hash operation on the first computing key, the first time information and the first challenge code obtained by the first obtaining module to obtain a second hash data; 
         [0048]    a first bit interception module configured to perform bit interception on the second hash data obtained by hash operation performed by the second hash module to obtain a first bit interception result; and 
         [0049]    a second displaying module configured to take the first bit interception result obtained by bit interception performed by the first bit interception module as a first verification password to display; 
         [0050]    the client side further comprises: 
         [0051]    a second obtaining module configured to obtain the first verification password input by the user; 
         [0052]    a second generating module configured to generate the first verification request including the identity information and the first verification password; 
         [0053]    the second sending module configured to send the first verification request generated by the second generating module to the authentication server; and 
         [0054]    the first receiving module in the authentication server is further configured to receive the first authentication request from the client side; 
         [0055]    the authentication server further comprises: 
         [0056]    a second storing module configured to store the first usage code; 
         [0057]    a third obtaining module configured to obtain the identity information in the first verification request received by the first receiving module; 
         [0058]    a searching module configured to search the working key corresponding to the identity information in the first verification request and the first challenge code; 
         [0059]    a third hash module configured to perform hash operation on the working key found by search and the first usage cod stored by the second storing module to obtain a third hash data; 
         [0060]    a fourth hash module configure to take the third hash data obtained by the third hash module as a second computing key, perform hash operation on the second computing key, the second time information and the first challenge code found by searching to obtain a fourth hash data; a second bit interception module configured to perform bit interception on the fourth hash data obtained by hash operation performed by the fourth hash module to obtain a second bit interception result; and 
         [0061]    a first determining module configured to take the second bit interception result obtained by the second bit interception module as the first verification password obtained by computing, determining whether the first verification password obtained by computing matches the first verification password obtained from the first verification request, 
         [0062]    in which the first sending module configured to send information of successful verification to the client side when the first determining module determines that the first verification password obtained by computing matches the first verification password obtained from the first verification request; send information of failed verification to the client side when the first determining module determines that the first verification password obtained by computing does not match the first verification password obtained from the first verification request; and 
         [0063]    the second receiving module in the client side further configured to receive information of successful verification or information of failed verification from the authentication server. 
         [0064]    According to the fifth aspect of the present invention, there is provided a dynamic token, wherein the dynamic token comprises: 
         [0065]    a storing module configured to store a working key, a first usage code and a second usage code; 
         [0066]    an obtaining module configured to obtain a logon challenge code and a signature challenge code input by the user; 
         [0067]    a detecting module configured to detecting a press key; 
         [0068]    a first determining module configured to, when the detecting module detects that a press key of the dynamic token is triggered, determine the press key triggered; 
         [0069]    a first hash module configured to perform hash operation on the working key and the first usage code stored by the storing module to obtain a first hash data when the first determining module determines that the press key triggered is the first press key; perform hash operation on the working key and the second usage code stored by the storing module to obtain a third hash data when the first determining module determines that the press key being trigged is the second key; 
         [0070]    a second hash module configured to take the first hash data, which is obtained by the hash operation performed by the first hash module, as the first computing key, perform hash operation on the first computing key, the first time information and the logon challenge code obtained by the obtaining module to obtain the second hash data; take the third hash data obtained by the first hash module as the second computing key, perform the second computing key, the second time information and the signature challenge code obtained by the obtaining module to obtain the fourth hash data; 
         [0071]    a bit intercepting module configured to perform bit interception on the second hash data, which is obtained by the hash operation performed by the second hash module, to obtain the first bit interception result; perform bit interception on the fourth hash data obtained by the second hash module to obtain the second bit interception result; and 
         [0072]    a displaying module configured to take the first bit interception result, which is obtained by bit interception performed by the bit intercepting module, as the logon password to display; take the second interception result, which is obtained by bit interception performed by the bit interception module, as the signature password to display. 
         [0073]    According to another aspect of the present invention, there is provided an authentication server, wherein the authentication server comprises: 
         [0074]    a storing module configured to store a first usage code and a second usage code; 
         [0075]    a receiving module configured to receive a request from a client side; 
         [0076]    a first determining module configured to determine the request received by the receiving module; 
         [0077]    a first generating module configured to generate a logon challenge code when the first determining module determines that the received request is a logon request, store the logon challenge code as information corresponding to the identity information in the logon request; generate a challenge code when the first determining module determines that the received request is the signature request, store the signature challenge code as information corresponding to the identity information in the signature request; 
         [0078]    a sending module configured to send the logon challenge code and the signature challenge code which are generated by the first generating module to the client side; 
         [0079]    a searching module configured to search for the working key and the logon challenge code, which are corresponding to the identity information in the logon verification request when the first determining module determines that the received request is the logon verification request; search for the working key and the signature challenge code which are corresponding to the identity information in the signature verification request when the first determining module determines that the received request is the signature verification request; 
         [0080]    a first hash module configured to perform hash operation on the working key obtained by searching by the searching module and the first usage code stored by the storing module to obtain a twelfth hash data; perform hash operation on the working key obtained by searching by the searching module and the second usage code stored by the storing module to obtain a fourteenth hash data; 
         [0081]    a second hash module configured to take the twelfth hash data, which is obtained by hash operation performed by the first hash module, as a fourth computing key, perform hash operation on the fourth computing key, the fifth time information and the logon challenge code, which is found by searching of the search module to obtain the thirteenth hash data; take the fourteenth hash data obtained by the hash operation performed by the first hash module as the fifth computing key, perform hash operation on the fifth computing key, the sixth time information and the searched signature challenge code to obtain the fifteenth hash data; 
         [0082]    a bit interception module configured to perform bit interception operation on the thirteenth hash data, which is obtained by performing hash operation by the second hash module  1008 , to obtain the seventh bit interception result; perform bit interception operation on the fifteenth hash data, which is obtained by performing hash operation by the second hash module, to obtain the eighth bit interception result; and 
         [0083]    a second determining module configured to take the seventh bit interception result, which is obtained by performing bit interception by the bit interception module, as a logon password obtained by computing, determine whether the logon password obtained by computing matches the logon password obtained in the logon verification request; take the eighth bit interception result, which is obtained by performing interception obtained by the bit interception module, as the signature password obtained by computing, determine whether the signature password obtained by computing matches the signature password obtained from the signature verification request, 
         [0084]    in which the sending module further is configured to send information of successful verification to the client side when the second determining module determines that the logon password obtained by computing matches the logon password obtained from the logon verification request; send information of failed verification to the client side when the second determining module determines that the logon password obtained by computing does not match the logon password obtained from the logon verification request; send information of successful verification to the client side when the second determining module determines that the signature obtained by computing matches the signature password obtained from the signature verification request; send information of failed verification to the client side when the second determining module determines that the signature obtained by computing does not match the signature password obtained from the signature verification request. 
         [0085]    According to the present invention, the dynamic token generates different computing keys (calculation keys) upon different usage cods and generates dynamic passwords used for variety of application sites (application scenario) upon different computing kyes; Correspondingly, an authentication server verifies dynamic passwords used in variety of application sites upon different usage codes, which reduces risks that the key used for generating a dynamic password is being stolen and improves security of a token verification system. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0086]      FIG. 1  and  FIG. 2  present a flow chart of a working method for a dynamic token illustrated in Embodiment 1 of the present invention; 
           [0087]      FIG. 3  and  FIG. 4  present a flow chart of a working method for an authentication server illustrated in Embodiment 1 of the present invention; 
           [0088]      FIG. 5  is a structural diagram of a dynamic token in Embodiment 2 of the present invention; and 
           [0089]      FIG. 6  is a structural diagram of an authentication server in Embodiment 2 of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0090]    The embodiments of the disclosure are described clearly and completely in conjunction with the accompanying drawings as follows. Apparently, the described embodiments are merely a part of but not all of the embodiments according to the disclosure. Based on the described embodiments of the disclosure, other embodiments obtained by those skilled in the art without any creative work belong to the scope of protection of the present invention. 
         [0091]    The technical solution of the present invention is applied in a token verification system including a dynamic token, a client side and an authentication server. In this case, the dynamic token is for generating a dynamic password; the authentication server is for obtaining the dynamic password generated by the dynamic token via the client side, verifying the dynamic password and sending a verification result to the client side and the verification result is displayed via the client side. 
       Embodiment 1 
       [0092]    Embodiment 1 of the present invention provides the working method for the dynamic token and the authentication server included in the identity verification system described above. 
         [0093]    As shown in  FIG. 1  and  FIG. 2 , the working method of the dynamic token of Embodiment 1 includes following steps. 
         [0094]    Step  601 , the dynamic token is powered up. 
         [0095]    Step  602 , the dynamic token determines whether the dynamic token itself is locked, if yes, execute Step  622 ; otherwise, execute Step  603 . 
         [0096]    Step  603 , the dynamic token prompts a user to input a start-up password. 
         [0097]    Step  604 , when the start-up password input by the user is obtained, the dynamic token determines whether the obtained start-up password is identical to its self-stored start-up password, if yes, initialize times of startup failure and execute Step  605 ; otherwise, execute Step  620 . 
         [0098]    Step  605 , the dynamic token waits for the user to trigger a press key. 
         [0099]    Step  606 , when the press key of the dynamic token is triggered, the dynamic toke determines the press key triggered, if the press key is a first press key, execute Step  607 ; if the press key the a second press key, execute Step  611 ; if the press key is a third press key, execute Step  615 . 
         [0100]    Step  607 , the dynamic token prompts the user to input a logon challenge code; 
         [0101]    Step  608 , the dynamic password obtains the logon challenge code input by the user, performs hash operation on its working key and a first usage code, which are stored in the dynamic token, and takes a first hash data obtained as a first computing key. 
         [0102]    Specifically, the dynamic token can combine its working key and the first usage code, which are stored in the dynamic token, to be a first data, fill the first data to obtain a first message, group the first message and perform iterative compression on obtained grouping data and obtains the first hash data. 
         [0103]    In the present embodiment 1, the working key can be data with length of 32 bytes, the first usage code can be data with length of 4 bytes; the first hash data obtained by performing hash operation on the working key and the first usage code can be data with length of 32 bytes. 
         [0104]    For example, in the dynamic token the first usage code of is “00000001”; the working key is “a26d180368a3775b810eb54193804a f4c5edc74d3a1dddca28ba700091e99b03”; the first hash data obtained by performing hash on the working key and the first usage code is “27AD795688C800C1FC2C1787FDDA3FB4E8A9108B538C96E666BB860B1FDA3E56”. 
         [0105]    Step  609 , the dynamic token performs hash on the first computing key, a first time information and the logon challenge code to obtain a second hash data. 
         [0106]    Specifically, the dynamic token can combine the first computing key, the first time information and the logon challenge code to be a second data, fill the second data to obtain a first message, group the second message and perform iterative compression on obtained grouping data and obtains the second hash data. 
         [0107]    In the present embodiment 1, the first computing key can be data with length of 32 bytes, the first time information can be data with length of 6 bytes; the logon challenge code input by the user can be data with length of 6 bytes; the second hash data obtained by performing hash operation on the first computing key, the first time information and the logon challenge code can be data with length of 32 bytes. 
         [0108]    For example, the first time information is “00000000015829CE”; the logon challenge code input by the user is “012345”; the first computing key is “27AD795688C800C1FC2C1787FDDA3FB4E8A9108B538C96E666BB860B1FDA3E56”; the second hash data obtained by performing computing by the dynamic token is “57f72a79575d05d01b647192c1fe2f72d593fe275ce3555695f8e25684e38bec”. 
         [0109]    Step  610 , the dynamic token performs bit interception/truncation on the second hash data, takes a first bit interception result (truncated result) obtained as a logon password and displays the logon password; go back to Step  605 . 
         [0110]    Specifically, the dynamic token can group the second hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the dynamic token performs modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on a second preset value by using the obtained modulo result and obtains the first bit interception result. 
         [0111]    In the present embodiment 1, the second hash data is data with length of 32 bytes; the dynamic token can group the second hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the dynamic token obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a module result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the first bit interception result. 
         [0112]    For example, the dynamic token obtains the second hash data is “57f72a79575d05d01b647192c1fe2f72d593fe275ce35556 95f8e25684e38bec” by computing, the first bit interception is “126092”, i.e. the logon password is “126092”. 
         [0113]    It should be noted that, after Step  610 , the client side can obtain the logon password generated by the dynamic password, generate a logon verification request including the logon password and identity information and send the logon verification request to the authentication server. 
         [0114]    Step  611 , the dynamic token prompts the user to input a signature challenge code. 
         [0115]    Step  612 , the dynamic token obtains the signature challenge code input by the user, performs hash operation on its working key and a second usage code, which are stored in the dynamic token, and takes a third hash data obtained as a second computing key. 
         [0116]    Specifically, the dynamic token can combine its working key and the second usage code, which are stored in the dynamic token, to be a third data, fill the third data to obtain a third information, group the third information and perform iterative compression on obtained grouping data and obtain the third hash data. 
         [0117]    In the present embodiment 1, the working key can be data with length of 32 bytes, the second usage cod can be data with length of 4 bytes, the third hash data obtained by performing hash operation on the working key and the second usage code can be data with length of 32 bytes. 
         [0118]    For example, the second usage code of the dynamic token is “00000002”, the working key is “a26d180368a3775b810eb54193804af 4c5edc74d3a1dddca28ba700091e99b03”; the third hash data obtained by performing hash on the working key and the second usage code is“8D5828922FEBFC8597FC7768A5CD856B45C3A104119BDE8B0E9A418D6A9AB768”. 
         [0119]    Step  613 , the dynamic token performs hash operation on the second computing key, a second time information and the signature challenge code to obtain a fourth hash data. 
         [0120]    Specifically, the dynamic token can combine the second computing key, the second time information and the signature challenge code input by the user to be a fourth data, fill the fourth data to obtain a fourth message, group the fourth message, perform iterative compression on obtained grouping data and obtain the fourth hash data. 
         [0121]    In the present embodiment 1, the second computing key can be data with length of 32 bytes, the second time information can be data with length of 8 bytes, the signature challenge code input by the user can be data with length of 6 bytes, the fourth hash data obtained by performing hash operation on the second computing key, a second time information and the signature challenge code can be data with length of 32 bytes. 
         [0122]    For example the second time information is“00000000015829CE”, the signature challenge code input by the user is “012345”, the second computing key is “8D5828922FEBFC8597FC7768A5CD856B45C3A104119BDE8B0E9A418D6A9AB768”, the fourth hash data obtained by computing by the dynamic token is “228ff7a222fdf903b7c84926cebe47b42dc7d2e101da3e995dc402169a4b25da”. 
         [0123]    Step  614 , the dynamic token performs bit interception on the fourth hash data, takes a second bit interception result obtained as signature password and displays the signature password; go back to Step  605 . 
         [0124]    Specifically, the dynamic token can group the fourth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the dynamic token performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the second bit interception result. 
         [0125]    In the present embodiment 1, the fourth hash data is data with length of 32 bytes; the dynamic token can group the second hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the dynamic token obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the second bit interception result. 
         [0126]    For example, the fourth hash data obtained by computing by the dynamic token is “228ff7a222fdf903b7c84926cebe47b42dc7d2e101da3e9 95dc402169a4b25da”, the second bit interception result is “821929”, i.e. the signature password is “821929”. 
         [0127]    It should be noted that, after Step  614 , the client side obtains the signature password generated by the dynamic token, generates a signature verification request including the signature password and the identity information and sends the signature verification request to the authentication server. 
         [0128]    Step  615 , the dynamic token performs hash operation on its self-stored working key and a third usage code, takes a fifth hash data obtained as a third computing key. 
         [0129]    Specifically, the dynamic token can combine its working key and the third usage code, which are stored in the dynamic token, to be a fifth data, fill the fifth data to obtain a fifth message, group the fifth message and performs iterative compression on obtained grouping data and obtains the fifth hash data. 
         [0130]    In the present embodiment 1, the working key can be data with length of 32 bytes, the third usage cod can be data with length of 4 bytes, the fifth hash data obtained by performing hash operation on the working key and the third usage code can be data with length of 32 bytes. 
         [0131]    For example, the third usage code of the dynamic token is “00000003”, the working key is “a26d180368a3775b810eb54193804af 4c5edc74d3a1dddca28ba700091e99b03”; the fifth hash data obtained by performing hash on the working key and the third usage code is“AFCC4F6EAC971346E64D5F234505426558B84B61EAF8DFAA18E8DD885BF11E3F”. 
         [0132]    Step  616 , the dynamic token performs hash operation on the third computing key and a third time information to obtain a sixth hash data. 
         [0133]    Specifically, the dynamic token can combine the third computing key and the third time information to be a sixth data, fill the sixth data to obtain a sixth message, group the sixth message and perform iterative compression on obtained grouping data and obtains the sixth hash data. 
         [0134]    In the present embodiment 1, the third computing key can be data with length of 32 bytes, the third time information can be data with length of 8 bytes, the sixth hash data obtained by performing hash operation on the third computing key and the third time information can be data with length of 32 bytes. 
         [0135]    For example, the third time information is “00000000015829CE”, the third computing key is “AFCC4F6EAC971346E64D5F23450 5426558B84B61EAF8DFAA18E8DD885BF11E3F”, the sixth hash data obtained by computing by the dynamic token is “e2738d9f6628bb77d6ef329e91c462c6a03ec54c19087fd23779a70530bb4a80”. 
         [0136]    Step  617 , the dynamic token performs bit interception on the sixth hash data to obtain a third bit interception result. 
         [0137]    Specifically, the dynamic token can group the sixth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the dynamic token performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the third bit interception result. 
         [0138]    In the present embodiment 1, the sixth hash data is data with length of 32 bytes; the dynamic token can group the sixth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the dynamic token obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the third bit interception result. 
         [0139]    For example, the sixth hash data obtained by computing by the dynamic token is “e2738d9f6628bb77d6ef329e91c462c6a03ec54c19087fd2 3779a70530bb4a80”; the third bit interception result is “590109”. 
         [0140]    Step  618 , the dynamic token performs hash operation on the third computing key and a fourth time information to obtain a seventh hash data. 
         [0141]    Specifically, the dynamic token can combine the third computing key and the fourth time information to be a seventh data, fill the seventh data to obtain a seventh message, group the seventh message and perform iterative compression on obtained grouping data and obtain the seventh hash data. In this case, the fourth time information is later than the third time information. 
         [0142]    In the present embodiment 1, the third computing key can be data with length of 32 bytes, the fourth time information can be data with length of 8 bytes, the seventh hash data obtained by performing hash operation on the third computing key and the fourth time information can be data with length of 32 bytes. 
         [0143]    For example, the third time information is “00000000015829CE”, the third computing key is “AFCC4F6EAC971346E64D5F23450 5426558B84B61EAF8DFAA18E8DD885BF11E3F”, the seventh hash data obtained by computing by the dynamic token is “ec3cf5692ca775c90d59dee26870ecd1af67faa0588787608e838c93fe6179d5”. 
         [0144]    Step  619 , the dynamic token performs bit interception on the seventh hash data to obtain a fourth bit interception result, displays the third bit interception result and the fourth bit interception result as a first synchronization code and a second synchronization code respectively, go back to Step  605 . 
         [0145]    Specifically, the dynamic token can group the seventh hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the dynamic token performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the fourth bit interception result. 
         [0146]    In the present embodiment 1, the seventh hash data is data with length of 32 bytes; the dynamic token can group the seventh hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the dynamic token obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the fourth bit interception result. 
         [0147]    For example, the seventh hash data obtained by computing by the dynamic token is “ec3cf5692ca775c90d59dee26870ecd1af67faa058878760 8e838c93fe6179d5”; the fourth bit interception result is “836749”, i.e. the first synchronization code is “590109”, the second synchronization code is “836749”. 
         [0148]    It should be noted that, after Step  619 , the client side can obtain the first synchronization code and the second synchronization code which are generated by the dynamic token, generate a synchronization request including the first synchronization code and the second synchronization code and the identity information, send the synchronization request to the authentication server. 
         [0149]    Step  620 , the dynamic token displays information indicating password error and updates times of startup failure. 
         [0150]    Step  621 , the dynamic token determines whether the times of startup failure is equal to a first preset times, if yes, go to Step  622 ; otherwise, go back to Step  603 . 
         [0151]    Step  622 , the dynamic password displays information indicating that the token is locked, generates and displays an unlock request code, prompts the user to input a unlock code. 
         [0152]    It should be noted that, after Step  622 , the client side can obtain the unlock request code generated by the dynamic token, generate an unlock request including the unlock request code and identity information, send the unlock request to the authentication server. 
         [0153]    Step  623 , when the unlock code input by the user is obtained, the dynamic token performs hash operation on its working key and the third usage code which are stored in the dynamic token, takes the obtained fifth hash data as the third computing key. 
         [0154]    Specifically, the dynamic token can combine its working key and the third usage code to be a fifth data, fill the fifth data to obtain a fifth message, group the fifth message and perform iterative compression on obtained grouping data and obtain the fifth hash data. 
         [0155]    In the present embodiment 1, the working key can be data with length of 32 bytes, the third usage code can be data with length of 4 bytes, the fifth hash data obtained by performing hash operation on the working key and the third usage code can be data with length of 32 bytes. 
         [0156]    For example, the third usage code in the dynamic token is “00000003”; the working key is “a26d180368a3775b810eb54193804af4 c5edc74d3a1dddca28ba700091e99b03”; the fifth hash data obtained by performing hash operation on the working key and the third usage code is “AFCC4F6EAC971346E64D5F234505426558B84B61EAF8DFAA18E8DD885BF11E3F”. 
         [0157]    Step  624 , the dynamic token performs hash on the third computing key and the unlock request code to obtain an eighth hash data. 
         [0158]    Specifically, the dynamic token can combine the third computing key and the unlock request code to be an eighth data, fill the eighth data to obtain an eighth message, group the eighth message and perform iterative compression on obtained grouping data and obtains the eighth hash data. 
         [0159]    In the present embodiment 1, the third computing key can be data with length of 32 bytes, the unlock request code can be data with length of 6 bytes, the fifth hash data obtained by performing hash operation on the third working key and the unlock request code can be data with length of 32 bytes. 
         [0160]    For example, the unlock request code is “322337”; the third computing key is “AFCC4F6EAC971346E64D5F234505426558B84B 61EAF8DFAA18E8DD885BF11E3F”; the eighth hash data obtained by computing by the dynamic token is “76d4b125be1942f9e54dd6bcd0bde811673187a74b321084ce0df24c62809123”. 
         [0161]    Step  625 , the dynamic token performs bit interception on the eighth hash data to obtain a fifth bit interception result. 
         [0162]    Specifically, the dynamic token can group the eighth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the dynamic token performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the fifth bit interception result. 
         [0163]    In the present embodiment 1, the eighth hash data is data with length of 32 bytes; the dynamic token can group the eighth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the dynamic token obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the fifth bit interception result. 
         [0164]    For example, the eighth hash data obtained by computing by the dynamic token is “76d4b125be1942f9e54dd6bcd0bde811673187a74b32108 4ce0df24c62809123”; the fifth bit interception is “783109”. 
         [0165]    Step  626 , the dynamic token determines whether the fifth bit interception result is identical to the obtained unlock code, if yes, execute Step  627 ; otherwise, execute Step  629 . 
         [0166]    Step  627 , the dynamic token displays information indicating successful unlocking and initializes the times of unlock failure. 
         [0167]    Step  628 , the dynamic token resets the startup password, stores the reset startup password and initializes the times of startup failure, then go back to Step  605 . 
         [0168]    Step  629 , the dynamic token displays information indicating unlock failure and updates the times of unlock failure. 
         [0169]    Step  630 , the dynamic password determines whether the times of unlock failure is equal to a second preset times, if yes, execute Step  631 ; otherwise, go back to Step  622 . 
         [0170]    Step  631 , the dynamic token clears its self-stored original seed key and the working key and displays information that the dynamic token is self-destroying. 
         [0171]    It should be noted that the dynamic token of the embodiment of the present invention is required to be activated before working normally, i.e. executing flow of the working method shown by  FIG. 6  and  FIG. 7 . The process of activating the dynamic token in the embodiment of the present invention includes that the dynamic token obtains a activation code input by the user, performs hash operation on the activation code and its self-stored original seed key, stores a ninth hash data obtained as the working key; the dynamic token sets up a startup password, stores the set startup password and initializes the times of startup failure. 
         [0172]    Specifically, the dynamic token can combine the activation code and its self-stored original seed key to be an ninth data, fill the ninth data to obtain a ninth message, group the ninth message and performs iterative compression on the grouped data so as to obtain the ninth hash data. 
         [0173]    In the present embodiment 1, the activation code can be data with length of 12 bytes, the original seed key can be data with length of 32 bytes, the ninth hash data obtained by performing hash operation on the activation code and its self-stored original seed key can be data with length of 32 bytes. 
         [0174]    For example, the activation code is “123456792518”, the original seed key is “000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F”; correspondingly, the ninth hash data obtained by computing by the dynamic token is“a26d180368a3775b810eb54193804af4c5edc74d3a1dddca28ba700091e99b03”. 
         [0175]    In this case, the activation code used in the activation process by the dynamic token is generated by the authentication sever; as shown by  FIG. 3  and  FIG. 4 , the working method of the authentication server includes following steps: 
         [0176]    Step  701 , the authentication server waits for a request from the client side. 
         [0177]    Step  702 , after receiving the request from the client side, the authentication server determines the received request, if the request is a activation request, execute Step  703 ; 
         [0178]    if the request is a logon request, execute Step  707 ; 
         [0179]    if the request is a logon verification request, execute Step  708 ; 
         [0180]    if the request is a signature request, execute Step  715 ; 
         [0181]    if the request is a signature verification request, execute Step  716 ; 
         [0182]    if the request is a synchronization request, execute Step  723 ; and 
         [0183]    if the request is an unlock request, execute Step  733 . 
         [0184]    Step  703 , upon the identity information in the activation request, the authentication server searches the original seed key corresponding to the identity information, 
         [0185]    in which the identity information can be a username, a serial number of the token, or any other information for marking identitity of a user of a dynamic token. 
         [0186]    Step  704 , the authentication server generates a first random number, performs hash operation on the first random number and the original seed key found by searching to obtain a tenth hash data. 
         [0187]    Specifically, the authentication server can combine the first random number and the original seed key found by searching to be a tenth data, fill the tenth data to obtain a tenth message, group the tenth message and performs iterative compression on obtained grouping data and obtain the tenth hash data. 
         [0188]    In the present embodiment 1, the first random number can be data with length of 6 bytes; the original seed key found by searching can be data with length of 32 bytes; correspondingly, the tenth hash data obtained by performing hash operation on the first random number and the original seed key can be data with length of 32 bytes. 
         [0189]    For example, the first random number is “123456”; the original seed key is “000102030405060708090A0B0C0D0E0F1011121314 15161718191A1B1C1D1E1F”; the tenth hash data obtained by computing by the authentication server is “f12cf8c66ed35ca267886d737e1bc9ba846a4d1b316008d561b951ad4662bf54”. 
         [0190]    Step  705 , the authentication server performs bit interception on the tenth hash data, combines a sixth bit interception result and the first random number to obtain the activation code, sends the activation code to the client side. 
         [0191]    Specifically, the authentication server can group the tenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the sixth bit interception result. 
         [0192]    In the present embodiment 1, the tenth hash data is data with length of 32 bytes; the authentication server can group the eighth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the sixth bit interception result. 
         [0193]    For example, the tenth hash data obtained by computing by the authentication server is “f12cf8c66ed35ca267886d737e1bc9ba846a4d1b316008 d561b951ad4662bf54”; the sixth bit interception result is “792518”; the authentication server combines the sixth bit interception result “792518” and the first random number “123456” to obtain the activation code “123456792518”. 
         [0194]    It should be noted that after Step  705 , the client side can display the received activation code to the client. 
         [0195]    Step  706 , the authentication server performs hash operation on the activation code and the original seed key found by searching, stores an eleventh hash data obtained to be the working key corresponding to the identity information of the activation request; go back to Step  701 . 
         [0196]    Specifically, the authentication server can combine the activation code and the original seed key found by searching to be an eleventh data, fill the eleventh data to obtain an eleventh message, group the eleventh message and perform iterative compression on obtained grouping data and obtain the eleventh hash data. 
         [0197]    In the present embodiment 1, the activation code can be data with length of 12 bytes, the original seed key found by searching can be data with length of 32 bytes; the eleventh hash data obtained by performing hash operation on the activation code and the original seed key found by searching can be data with length of 32 bytes. 
         [0198]    Step  707 , the authentication server generates a second random number, stores the second random number as the logon challenge code corresponding to the identity information in the logon request, sends the logon challenge code to the client side; go back to Step  701 . 
         [0199]    In this case, the second random number can be data with length of 6 bytes, for example, “012345”. 
         [0200]    It should be noted that, after Step  707 , the client side displays the received logon challenge cod to the user. 
         [0201]    Step  708 , upon the identity information in the logon verification request, the authentication sever searches the working key corresponding to the identity information, performs hash operation on the working key found by searching and its self-stored first usage code, takes a twelfth hash data as a fourth computing key. 
         [0202]    Specifically, the authentication server can combine the working key found by searching and the first usage code to be a twelfth data, fill the twelfth data to obtain a twelfth message, group the twelfth message and perform iterative compression on obtained grouping data and obtain the twelfth hash data. 
         [0203]    In the present embodiment 1, the working key found by searching by the authentication server can be data with length of 32 bytes; the first usage code can be data of 4 bytes; the twelfth hash data obtained by performing hash operation on the working key found by searching and the first usage code can be data with length of 32 bytes. 
         [0204]    Step  709 , upon the identity information in the logon verification request, the authentication server searches the logon challenge code corresponding to the identity information. 
         [0205]    Step  710 , the authentication server obtains a fifth time information upon a token offset time and a system time, performs hash operation on the fourth computing key, the fifth time information and the logon challenge code found by searching to obtain a thirteenth hash data. 
         [0206]    Specifically, the authentication server can combine the fourth computing key, the fifth time information and the logon challenge code found by searching to be a thirteenth data, fill the thirteenth data to obtain a thirteenth message, group the thirteenth message and performs iterative compression on obtained grouping data and obtain the thirteenth hash data. 
         [0207]    In the present embodiment 1, the fourth computing key can be data with length of 32 bytes; the fifth time information can be data with length of 8 bytes; the logon challenge code found by searching can be data with length of 6 bytes; the thirteenth hash data obtained by performing hash operation on the fourth computing key, the fifth time information and the logon challenge code found by searching can be data with length of 32 bytes. 
         [0208]    Step  711 , the authentication server performs bit interception on the thirteenth hash data, takes a seventh bit interception result obtained as the logon password obtained by computing. 
         [0209]    Specifically, the authentication server can group the thirteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combine the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the seventh bit interception result. 
         [0210]    In the present embodiment 1, the thirteenth hash data is data with length of 32 bytes; the authentication server can group the thirteenth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the seventh bit interception result. 
         [0211]    Step  712 , the authentication server determines whether the logon password obtained by computing matches the logon password obtained from the logon verification request, if yes, execute Step  713 ; otherwise, execute Step  714 . 
         [0212]    Specifically, the logon password obtained by computing by the authentication server can be one password; correspondingly, the authentication server can determine whether the logon password obtained by computing is identical to the logon password obtained from the logon request, if yes, the logon password obtained by computing matches the logon password obtained from the logon verification request; otherwise, the logon password obtained by computing does not match the logon password obtained from the logon verification request. 
         [0213]    The logon password obtained by computing by the authentication server can include a plurality of passwords; correspondingly, the authentication server can determine whether the logon password obtained by computing includes the logon password obtained from the logon request; if yes, the logon password obtained by computing matches the logon password obtained from the logon verification request; otherwise, the logon password obtained by computing does not match the logon password obtained from the logon verification request. 
         [0214]    Step  713 , the authentication server sends a message indicating successful verification to the client side, go back to Step  701 . 
         [0215]    Step  714 , the authentication server send a message indicating failed verification to the client side, go back to Step  701 . 
         [0216]    Step  715 , the authentication server generates the signature challenge code, stores the signature challenge code as information corresponding to the identity information in the signature request and sends the signature challenge code to the client side; go back to Step  701 . 
         [0217]    Specifically, the authentication server can store part or all of business data as the signature challenge code corresponding to the identity information in the signature request; the authentication can generate a third random number, combine the third random number and part or all of the business data, store data obtained by combining as the signature challenge code corresponding to the identity information in the signature request; in this case, the signature challenge code can be data with length of 6 bytes, for example, “012345”. 
         [0218]    It should be noted that, after Step  715 , the client side can display the received signature challenge code to the user. 
         [0219]    Step  716 , upon the identity information in the signature verification request, the authentication server searches the working key corresponding to the identity information, performs hash operation on the working key found by searching and its self-stored second usage code and takes a fourteenth hash data obtained as a fifth computing key. 
         [0220]    Specifically, the authentication server can combine the working key found by searching and the second usage code to be the a fourteenth data, fill the fourteenth data to obtain a fourteenth message, group the fourteenth message and perform iterative compression on obtained grouping data and obtain the fourteenth hash data. 
         [0221]    In the present embodiment 1, the working key found by searching by the authentication server can be data with length of 32 bytes, the second usage code can be data with length of 4 bytes, the fourteenth hash data obtained by performing hash operation on the working key found by searching and the second usage code can be data with length of 32 bytes. 
         [0222]    Step  717 , upon the identity information in the signature verification request, the authentication server searches the signature challenge code corresponding to the identity information. 
         [0223]    Step  718 , the authentication server obtains a sixth time information upon the token offset time and the system time, performs hash operation on the fifth computing key, the sixth time information and the signature challenge code found by searching to obtain a fifteenth hash data. 
         [0224]    Specifically, the authentication server can combine the fifth computing key, the sixth time information and the signature challenge code found by searching to be a fifth data, fill the fifth data to obtain a fifteenth message, group the fifteenth message and perform iterative compression on obtained grouping data and obtain the fifteenth hash data. 
         [0225]    In the present embodiment 1, the fifth computing key can be data with length of 32 bytes; the sixth time information can be data with length of 8 bytes; the signature challenge code found by searching can be data with length of 6 bytes; the fifteenth hash data obtained by performing hash operation on the fifth computing key, the sixth time information and the signature challenge code found by searching can be data with length of 32 bytes. 
         [0226]    Step  719 , the authentication server performs bit interception on the fifteenth hash data, takes an eighth bit interception result obtained as the signature password obtained by computing. 
         [0227]    Specifically, the authentication server can group the fifteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the eighth bit interception result. 
         [0228]    In the present embodiment 1, the fifteenth hash data is data with length of 32 bytes; the authentication server can group the fifteenth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the eighth bit interception result. 
         [0229]    Step  720 , the authentication server determines whether the signature password obtained by computing matches the signature password obtained from the signature verification request; if yes, execute Step  721 ; otherwise, execute Step  722 . 
         [0230]    Specifically, the signature password obtained by computing by the authentication server can be one password; correspondingly, the authentication server can determine whether the signature password obtained by computing is identical to the signature password obtained from the signature verification request, if yes, the signature password obtained by computing matches the signature password obtained from the signature verification request; otherwise, the signature password obtained by computing does not match the signature password obtained from the logon verification request. 
         [0231]    The signature password obtained by computing by the authentication server can include a plurality of passwords; correspondingly, the authentication server can determine whether the logon password obtained by computing includes the logon password obtained from the logon request; if yes, the logon password obtained by computing matches the logon password obtained from the logon verification request; otherwise, the logon password obtained by computing does not match the logon password obtained from the logon verification request. 
         [0232]    Step  721 , the authentication server sends a message indicating successful verification to the client side, go back to Step  701 . 
         [0233]    It should be noted that, after Step  721 , the client side can display the received message indicating successful verification to the user. 
         [0234]    Step  722 , the authentication server sends a message indicating failed verification to the client side, go back to Step  701 . 
         [0235]    It should be noted that, after Step  722 , the client side can display the received message indicating failed verification to the user. 
         [0236]    Step  723 , upon the identity information in the synchronization request, the authentication server searches the working key corresponding to the identity information, performs hash operation on the working key and its self-stored third usage code and takes a sixteenth hash data obtained as a sixth computing key. 
         [0237]    Specifically, the authentication server can combine the working key found by searching and the third usage code to be a sixteenth data, fill the sixteenth data to obtain a sixteenth message, group the sixteenth message and perform iterative compression on obtained grouping data and obtain the sixteenth hash data. 
         [0238]    In the present embodiment 1, the working key found by searching by the authentication server can be data with length of 32 bytes, the third usage code can be data with length of 4 bytes; the sixteenth hash data obtained by performing hash operation on the working key found by searching and the third usage code to be data with length of 32 bytes. 
         [0239]    Step  724 , the authentication server performs hash operation on the sixth computing key and seventh time information to obtain a seventeenth hash data. 
         [0240]    Specifically, the authentication server can combine sixth computing key and seventh time information to be a seventeenth data, fill the seventeenth data to obtain a seventeenth message, group the seventeenth message and perform iterative compression on obtained grouping data and obtain the seventeenth hash data. 
         [0241]    In the present embodiment 1, the sixth computing key can be data with length of 32 bytes; the seventh time information can be data with length of 8 bytes; the seventeenth hash data obtained by performing hash operation on the sixth computing key and the seventh time information can be data with length of 32 bytes. 
         [0242]    Step  725 , the authentication server performs bit interception on the seventeenth hash data and takes a ninth bit interception result as a first synchronization password. 
         [0243]    Specifically, the authentication server can group the seventeenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the ninth bit interception result. 
         [0244]    In the present embodiment 1, the seventeenth hash data is data with length of 32 bytes; the authentication server can group the seventeenth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result and obtains the ninth bit interception result. 
         [0245]    Step  726 , the authentication server determines whether the first synchronization password matches the first synchronization code obtained from the synchronization request; if yes, execute Step  728 ; otherwise, execute Step  727 . 
         [0246]    Specifically, the first synchronization password can be one password; correspondingly, the authentication server can determine whether the first synchronization password is identical to the first synchronization code obtained from the synchronization request, if yes, the first synchronization password matches the first synchronization code obtained from the synchronization request; otherwise, the first synchronization password does not match the first synchronization code obtained from the synchronization request. 
         [0247]    The first synchronization password can include a plurality of passwords; correspondingly, the authentication server can determine whether the first synchronization password includes the first synchronization code obtained from the synchronization request, if yes, the first synchronization password matches the first synchronization code obtained from the synchronization request; otherwise, the first synchronization password does not match the first synchronization code obtained from the synchronization request. 
         [0248]    Step  727 , the authentication server sends a message indicating failed synchronization to the client side, go back to Step  701 ; 
         [0249]    It should be noted that, after Step  727 , the client side can display the received message indicating failed synchronization to the user. 
         [0250]    Step  728 , the authentication server performs hash operation on the sixth computing key and an eighteenth time information to obtain an eighteenth hash data. 
         [0251]    Specifically, the authentication server can combine sixth computing key and eighth time information to be a eighteenth data, fill the seventeenth data to obtain a seventeenth message, group the seventeenth message and perform iterative compression on obtained grouping data and obtain the seventeenth hash data. 
         [0252]    In the present embodiment 1, the sixth computing key can be data with length of 32 bytes, the eighth time information can be data with length of 8 bytes; the eighteenth hash data obtained by perform hash operation on the sixth computing key and the eighth time information can be data with length of 32 bytes. 
         [0253]    Step  729 , the authentication server performs bit interception on the eighteenth hash data and takes a tenth bit interception result as a second synchronization password. 
         [0254]    Specifically, the authentication server can group the eighteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result and obtains the tenth bit interception result. 
         [0255]    In the present embodiment 1, the eighteenth hash data is data with length of 32 bytes; the authentication server can group the eighteenth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result so as to obtain the tenth bit interception result. 
         [0256]    Step  730 , the authentication server determines whether the second synchronization password matches a second synchronization code obtained from the synchronization request, if yes, execute Step  731 ; otherwise, execute Step  727 . 
         [0257]    Specifically, the second synchronization password can be one password; correspondingly, the authentication server can determine whether the second synchronization password is identical to the second synchronization code obtained from the synchronization request, if yes, the second synchronization password matches the second synchronization code obtained from the synchronization request; otherwise, the second synchronization password does not match the second synchronization code obtained from the synchronization request. 
         [0258]    The second synchronization password can include a plurality of passwords; correspondingly, the authentication server can determine whether the second synchronization password includes the second synchronization code obtained from the synchronization request, if yes, the second synchronization password matches the second synchronization code obtained from the synchronization request; otherwise, the second synchronization password does not match the second synchronization code obtained from the synchronization request. 
         [0259]    Step  731 , the authentication server determines whether the time for successful verifying the second synchronization code is later than the time for successful verifying the first synchronization time, if yes, execute Step  732 ; otherwise, go back to Step  727 . 
         [0260]    Step  732 , the authentication server obtains a different value between the system time and the time for successful verifying the first synchronization time, stores the different value as the token offset time corresponding to the identity information in the synchronization request, sends message indicating successful synchronization to the client side; go back to Step  701 . 
         [0261]    It should be noted that, after Step  732 , the client side can display the received message indicating successful synchronization to the client. 
         [0262]    Step  733 , upon the identity information in the unlock request, the authentication server searches the working key corresponding to the identification, performs hash operation on the working key found by searching and its self-stored third usage code, takes the sixteenth hash data as the sixth computing key. 
         [0263]    Specifically, the authentication server can combine the working key found by searching and the third usage code to be the sixteenth data, fill the sixteenth data to obtain the sixteenth message, group the sixteenth message and perform iterative compression on obtained grouping data and obtain the sixteenth hash data. 
         [0264]    In the present embodiment 1, the working key found by searching by the authentication server can be data with length of 32 bytes, the third usage code can be data with length of 4 bytes; the sixteenth hash data obtained by performing hash operation on the working key found by searching and the third usage code to be data with length of 32 bytes. 
         [0265]    Step  734 , the authentication obtains an unlock request code from the unlock request, performs hash operation on the sixth computing key and the obtained unlock request code to obtain a nineteenth hash data. 
         [0266]    Specifically, the authentication server can combine the sixth computing key and the obtained unlock request code to be a nineteenth data, fill the nineteenth data to obtain a nineteenth message, group the nineteenth message and perform iterative compression on obtained grouping data and obtain the nineteenth hash data. 
         [0267]    In the present embodiment 1, the unlock request code obtained by the authentication server can be data with length of 6 bytes; the sixth computing key can be data with length of 32 bytes; the nineteenth hash data obtained by performing hash operation on the sixth computing key and the obtained unlock request code can be data with length of 32 bytes. 
         [0268]    Step  735 , the authentication server performs bit interception on the nineteenth hash data, takes an eleventh bit interception result as the unlock code and sends the unlock code to the client side; go back to Step  701 . 
         [0269]    Specifically, the authentication server can group the nineteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; the authentication server performs modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, performs modulo operation on the second preset value by using the obtained modulo result so as to obtain the eleventh bit interception result. 
         [0270]    In the present embodiment 1, the nineteenth hash data is data with length of 32 bytes; the authentication server can group the eighteenth hash data into 8 byte groups, each byte group contains 4 bytes, the 8 byte groups can be transformed into 8 binary data by shifting and combining the 4 bytes in respective byte groups. Further, the authentication sever obtains a result of adding all the 8 binary data, performs modulo operation on 232 by using the result to obtain a modulo result, performs modulo operation on 1000000 by using the obtained modulo result so as to obtain the eleventh bit interception result. 
         [0271]    It should be noted that, after Step  735 , the client side can display the received unlock code to the user. 
         [0272]    In the present embodiment 1 of the present invention, the authentication server obtains corresponding computing key upon different usage codes and uses the obtained computing key to verify the dynamic passwords of variety of application sites, which reduces the risks that the key is stolen and improves the security of the token authentication system. 
       Embodiment 2 
       [0273]    Embodiment 2 of the present invention provides structure of the dynamic token and the authentication server described in Embodiment 1. 
         [0274]      FIG. 5  presents a structural diagram of the dynamic token of Embodiment 2, which comprises: 
         [0275]    a storing module  910  configured to store the working key, the first usage code and the second usage code; 
         [0276]    an obtaining module  920  configured to obtain the logon challenge code and the signature challenge code input by the user; 
         [0277]    a detecting module  930  configured to detecting a press key; 
         [0278]    a first determining module  940  configured to, when the detecting module  930  detected that a press key is triggered, determine the press key which is triggered; 
         [0279]    a first hash module  950  configured to perform hash operation on the working key and the first usage code stored by the storing module  910  to obtain a first hash data when the first determining module  940  determines that the press key triggered is the first press key; perform hash operation on the working key and the second usage code stored by the storing module  910  to obtain a third hash data when the first determining module  940  determines that the press key being trigged is the second key; 
         [0280]    a second hash module  960  configured to take the first hash data, which is obtained by the hash operation performed by the first hash module  950 , as the first computing key, perform hash operation on the first computing key, the first time information and the logon challenge code obtained by the obtaining module  920  to obtain the second hash data; take the third hash data obtained by the first hash module  950  as the second computing key, perform the second computing key, the second time information and the signature challenge code obtained by the obtaining module  920  to obtain the fourth hash data; 
         [0281]    a bit intercepting module  970  configured to perform bit interception on the second hash data, which is obtained by the hash operation performed by the second hash module  960 , to obtain the first bit interception result; perform bit interception on the fourth hash data obtained by the second hash module  960  to obtain the second bit interception result; and 
         [0282]    a displaying module  980  configured to take the first bit interception result, which is obtained by bit interception performed by the bit intercepting module, as the logon password to display; take the second interception result, which is obtained by bit interception performed by the bit interception module, as the signature password to display. 
         [0283]    Specifically, the first hash module  950  specifically configured to combine the working key and the first usage code to be a first data, fill the first data to obtain a first message, group the first message and performs iterative compression on obtained grouping data and obtain the first hash data; combine the working key and the second usage code to be a third data, fill the third data to obtain a third message, group the third message and perform iterative compression on obtained grouping data and obtain the third hash data; 
         [0284]    the second hash module  960  configured to combine the first computing key, the first time information and the logon challenge code to be a second data, fill the second data to obtain a first message, group the second message and performs iterative compression on obtained grouping data and obtain the second hash data; combine the second computing key, the second time information and the signature challenge code to be a fourth data, fill the fourth data to obtain a fourth message, group the fourth message, perform iterative compression on obtained grouping data and obtain the fourth hash data. 
         [0285]    the bit interception module  970  configured to group the second hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the first bit interception result; group the fourth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the second bit interception result. 
         [0286]    Further, the storing module  910  is configured to store the third usage code; 
         [0287]    the first hash module  950  is further configured to perform hash operation on the working key and the third usage code, which are stored by the storing module  910 , to obtain the fifth hash data when the first determining module  940  determines that the press key triggered is the third press key; 
         [0288]    the second hash module  960  is further configured to take the fifth hash data, which is obtained by hash operation performed by the first hash module  950 , as the third computing key, perform the third computing key and the third time information to obtain the sixth hash data; perform hash operation on the third computing key and the fourth time information to obtain the seventh hash data; 
         [0289]    the bit interception module  970  is further configured to perform bit interception on the sixth hash data to obtain the third interception result; perform bit interception on the seventh hash data to obtain the fourth bit interception result; 
         [0290]    the displaying module  980  is further configured to take the third bit interception result and the fourth bit interception result as the first synchronization code and the second synchronization code to display. 
         [0291]    Specifically, the first hash module  950  is specifically configured to combine the working key and the third usage code into the fifth data, fill the fifth data to obtain the fifth message, group the fifth message and perform iterative compression on obtained grouping data and obtain the fifth hash data; 
         [0292]    the second hash module  960  is configured to combine the third computing key and the third time information into the sixth data, fill the sixth data to obtain the sixth message, group the sixth message and perform iterative compression on obtained grouping data and obtain the sixth hash data; combine the third computing key and the fourth time information into the seventh data, fill the seventh data to obtain the seventh message, group the seventh message and perform iterative compression on obtained grouping data and obtain the seventh hash data. 
         [0293]    The bit interception module  970  specifically is configured to group the sixth hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on the second preset value by using the obtained modulo result and obtain the third bit interception result; group the seventh hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on the second preset value by using the obtained modulo result so as to obtain the fourth bit interception result. 
         [0294]    Further, the storing module  910  is configured to store the original seed key and the third usage code; and 
         [0295]    the obtaining module  920  is configured to obtain an activation code input by the user. 
         [0296]    The dynamic token further comprises: 
         [0297]    a third hash module configured to perform hash operation on the activation code and the original seed key, store the ninth hash data as the working key; and 
         [0298]    a setting module configured to set the startup password after the third hash module stores the working key, store the startup password in the storing module  910 . 
         [0299]    Specifically, the third hash module specifically is configured to combine the activation code and the original see key to be the ninth data, fill the ninth data to obtain the ninth message, group the ninth message and perform iterative compression on obtained grouping data and obtain the ninth hash data. 
         [0300]    Further, the displaying module  980  is configured to prompt the user to input the startup password; and 
         [0301]    the obtaining module  920  is configured to obtain the startup password input by the user. 
         [0302]    Correspondingly, the dynamic token further includes: 
         [0303]    a second determining module configured to determine whether the startup password obtained by the obtaining module  920  is identical to the startup password stored by the storing module  910 ; 
         [0304]    a first initializing module configured to initialize times of startup failure when the second determining module determines that the startup password obtained by the obtaining module  920  is identical to the startup password stored by the storing module  910 ; 
         [0305]    a first updating module configured to update the times of startup failure when second determining module determines that the startup password obtained by the obtaining module  920  is not identical to the startup password stored by the storing module  910 ; 
         [0306]    a third determining module configured to determine whether the times of startup failure updated by the first updating module is equal to a first preset times; and 
         [0307]    a generating module configured to generate an unlock request code when the third determining module determines that the times of startup failure is equal to the first preset times. 
         [0308]    The displaying module  980  is further configured to display the unlock request code generated by the generating module and prompt the user to input an unlock code; 
         [0309]    the obtaining module  920  is further configured to obtain the unlock code input by the user; 
         [0310]    the first hash module  950  is further configured to perform hash operation on the working key stored by the storing module  910  and the third usage code to obtain the fifth hash data; 
         [0311]    the second hash module  960  is further configured to take the fifth hash data as the third computing key, perform hash operation on the third computing key and the unlock request code to obtain the eighth hash data; 
         [0312]    the bit interception module  970  is further configured to perform bit interception on the eighth hash data to obtain the fifth bit interception result; 
         [0313]    the fourth determining module is configured to determine whether the fifth bit interception result is identical to the unlock code; 
         [0314]    the displaying module  980  is further configured to display information of successful unlock when the fourth module determines that the fifth bit interception result is identical to the unlock code; display information of failed unlock when the fourth determining module determines that the fifth bit interception result is not identical to the unlock code; and 
         [0315]    the setting module is configured to reset the startup password and store the reset startup password when the fourth determining module determines that the fifth bit interception result is identical to the unlock code. 
         [0316]    Further, the dynamic token further comprises: 
         [0317]    a second initializing module configured to initialize the times of failed unlock when the fourth determining module determines that the fifth bit interception result is identical to the unlock code; 
         [0318]    a second updating module configured to update the time of failed unlock when the fourth determining module determines that the fifth bit interception result is not identical to the unlock code; 
         [0319]    a fifth determining module configured to determine whether the times of failed unlock equals a second preset times, trigger the generating module to generate the unlock request code when the fifth determining module determines that the times of failed unlock is not equal to the second preset times; and 
         [0320]    a clearing module configured to clear the original seed key and the working key stored in the storing module  910  when the fifth determining module determines that the times of failed unlock is equal to the second preset times; 
         [0321]    in which the displaying module  980  is further configured to display information that the token is self-destroyed when the fifth determining module determines that the times of failed unlock equals the second preset times. 
         [0322]    Further, the dynamic token further comprises: 
         [0323]    a sixth determining module configured to determine whether the dynamic token is locked when the dynamic token is powered up; trigger the generating module to generate the unlock request code when the sixth determining module determines that the dynamic token is locked; trigger the displaying module  980  to prompt the user to input the startup password when the sixth determining module determines that the dynamic token is not locked. 
         [0324]    Specifically, the first hash module  950  is configured to combine the working key and the third usage code into the fifth data, fill the fifth data to obtain the fifth message, group the fifth message and perform iterative compression on obtained grouping data so as to obtain the fifth hash data. 
         [0325]    the second hash module  960  is specifically configured to combine the third computing key and the unlock request code to be the eighth data, fills the eighth data to obtain the eighth message, group the eighth message and perform iterative compression on obtained grouping data and obtain the eighth hash data. 
         [0326]    The bite interception module  970  is specifically configured to group the eighth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on the second preset value by using the obtained modulo result and obtain the fifth bit interception result; 
         [0327]    In the embodiment 2 of the present invention, the dynamic token generates different computing keys (calculation keys) upon different usage code, dynamic passwords used in variety of application sites (application scenario) is generated upon different usage codes, which reduces risks that the key used for generating a dynamic password is being stolen and improves security of a token verification system. 
         [0328]      FIG. 6  shows structural diagram of authentication server of Embodiment 2 of the present invention, which comprises: 
         [0329]    a storing module  1001  configured to store the first usage code and the second usage code; 
         [0330]    a receiving module  1002  configured to receive a request of the client side; 
         [0331]    a first determining module  1003  configured to determine the request received from the receive module  1002 ; 
         [0332]    a first generating module  1004  configured to generate a logon challenge code and store the logon challenge code as information corresponding to the identity information when the first determining module  1003  determines that the received request is logon request; generate a signature challenge code and store the signature challenge code as information corresponding to the identity information in the signature request when the first determining module  1003  determines that the received request is a signature request; 
         [0333]    a sending module  1005  configured to send the logon challenge code and the signature challenge code, which are generated by the first generating module  1004 , to the client side; 
         [0334]    a searching module  1006  configured to search the working key and the logon challenge code in a logon verification request when the first determining module  1003  determines that the received request is the logon verification request; search for the working key and the signature challenge code corresponding to the identity information in a signature verification request when the first determining module  1003  determines that the request received is the signature verification request; 
         [0335]    a first hash module  1007  configured to perform hash operation on the working key, which is found by searching by the searching module  1006 , and the first usage code stored by the storing module  1001  to obtain the twelfth hash data; perform hash operation on the working key, which is found by searching by the searching module  1006 , and the second usage code stored by the storing module  1001  to obtain the fourteenth hash data; 
         [0336]    a second hash module  1008  configured to take the twelfth hash data, which is obtained by hash operation performed by the first hash module  1007 , as a fourth computing key, perform hash operation on the fourth computing key, the fifth time information and the logon challenge code, which is found by searching of the search module  1006  to obtain the thirteenth hash data; take the fourteenth hash data obtained by the hash operation performed by the first hash module  1007  as the fifth computing key, perform hash operation on the fifth computing key, the sixth time information and the searched signature challenge code to obtain the fifteenth hash data; 
         [0337]    a bit interception module  1009  configured to perform bit interception operation on the thirteenth hash data, which is obtained by performing hash operation by the second hash module  1008 , to obtain the seventh bit interception result; perform bit interception operation on the fifteenth hash data, which is obtained by performing hash operation by the second hash module  1008 , to obtain the eighth bit interception result; 
         [0338]    the second determining module  1010 , configured to take the seventh bit interception result, which is obtained by performing bit interception by the bit interception module  1009 , as a logon password obtained by computing, determine whether the logon password obtained by computing matches the logon password obtained in the logon verification request; take the eighth bit interception result, which is obtained by performing interception obtained by the bit interception module  1009 , as the signature password obtained by computing, determine whether the signature password obtained by computing matches the signature password obtained from the signature verification request; and 
         [0339]    the sending module  1005  further is configured to send information of successful verification to the client side when the second determining module  1010  determines that the logon password obtained by computing matches the logon password obtained from the logon verification request; send information of failed verification to the client side when the second determining module  1010  determines that the logon password obtained by computing does not match the logon password obtained from the logon verification request; send information of successful verification to the client side when the second determining module  1010  determines that the signature obtained by computing matches the signature password obtained from the signature verification request; send information of failed verification to the client side when the second determining module  1010  determines that the signature obtained by computing does not match the signature password obtained from the signature verification request. 
         [0340]    Specifically, the first hash module  1007  specifically is configured to combine the working key found by searching by the searching module  1006  and the first usage code to be the twelfth data, fill the twelfth data to obtain a twelfth message, group the twelfth message and performs iterative compression on obtained grouping data and obtain the twelfth hash data; combine the working key found by searching by the searching module  1006  and the second usage code to be the fourteenth data, fill the fourteenth data to obtain a fourteenth message, group the fourteenth message and perform iterative compression on obtained grouping data and obtain the fourteenth hash data; 
         [0341]    Specifically, the second hash module  1008  specifically is configured to combine the fourth computing key, the fifth time information and the logon challenge code found by searching to be the thirteenth data, fill the thirteenth data to obtain a thirteenth message, group the thirteenth message and performs iterative compression on obtained grouping data and obtain the thirteenth hash data; combine the fifth computing key, the sixth time information and the signature challenge code found by searching to be a fifteenth data, fill the thirteenth data to obtain a thirteenth message, group the thirteenth message and performs iterative compression on obtained grouping data and obtain the fifteenth hash data. 
         [0342]    The bit interception module  1009  specifically is configured to group the thirteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on the second preset value by using the obtained modulo result and obtain the seventh bit interception result; group the fifteenth hash data to obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on the first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on the second preset value by using the obtained modulo result and obtain the eighth bit interception result. 
         [0343]    Further, the searching module  1006  is configured to search an original seed key corresponding to the identity information in an activation request when the first determining module  1003  determines that the received request is the activation request; 
         [0344]    Correspondingly, the authentication server includes: 
         [0345]    a second generating module configured to generate a first random number when the first determining module  1003  determines that the received request is the activation request; 
         [0346]    the first hash module  1007  further configured to perform hash operation on the first random number and the original seed key found by searching by the search module  1006  to obtain a tenth hash data; and 
         [0347]    the bit interception module  1009  further configured to perform bit interception on the tenth hash data to obtain the sixth bit interception result. 
         [0348]    The authentication server further includes: 
         [0349]    a combining module configured to combine the sixth bit interception result obtained by bit interception performed by the bit interception module  1009  to obtain the activation code; 
         [0350]    the third hash module configured to perform hash operation on the activation code obtained by combining by the combining module and the original seed key found by searching by the searching module  1006  and store the eleventh hash data as the working key corresponding to the identity information in the activation request; and 
         [0351]    the sending module  1005  further configured to send the activation code generated by the combining module to the client side. 
         [0352]    Specifically, the first hash module  1007  specifically is configured to combine the first random number and the original seed key found by the searching by the searching module  1006  to the tenth data, fill the tenth data to obtain the tenth message, group the tenth message and perform iterative compression on obtained grouping data and obtain the tenth hash data. 
         [0353]    The bit interception module  1009  is configured to group the tenth hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the sixth bit interception result. 
         [0354]    Further, the storing module  1001  is configured to store the third usage code; 
         [0355]    the search module  1006  is further configured to search the working key corresponding to the identity information of the unlock request when the third determining module  1003  determines that the received request is the unlock request; 
         [0356]    the first hash module  1007  is further configured to perform hash operation on the working key searched by the search module  1006  and the third usage code stored by the storing module  1001  to obtain the sixth hash data; 
         [0357]    the second hash module  1008  further takes the sixteenth hash data obtained by performing hash operation by the first hash module  1007  as the sixth computing key, performing hash operation on the sixth computing key and the unlock request code obtained from the unlock request to obtain the nineteenth hash data; 
         [0358]    the bit interception module  1009  is further configured to perform bit interception on the nineteenth hash data to obtain the eleventh bit interception result; 
         [0359]    the sending module further is configured to take the eleventh bit interception result, which is obtained by performing bit interception by the bit interception module  1009 , as the unlock code and send the unlock code to the client side. 
         [0360]    Specifically, the first hash module  1007  specifically is configured to combine the working key found by searching and the third usage code to the sixteenth data, fill the sixteenth data to obtain the sixteenth message, group the sixteenth message and perform iterative compression on obtained grouping data and obtain the sixteenth hash data. 
         [0361]    the second hash module  1008 , specifically is configured to combine the sixth computing key and the obtained unlock request to be a nineteenth data; fill the nineteenth data to obtain the nineteenth message, group the nineteenth message and perform iterative compression on obtained grouping data and obtain the nineteenth hash data. 
         [0362]    The bit interception module  1009  specifically is configured to group the nineteenth hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the eleventh bit interception result. 
         [0363]    Further, the storing module  1001  is further configured to store the third usage code; 
         [0364]    the searching module  1006  is further configured to search for the working key corresponding to the identity information in a synchronization request when the first determining module  1003  determines that the received request is synchronization request; 
         [0365]    the first hash module  1007  is further configured to perform hash operation on the working key found by searching of the searching module  1006  and the third usage code stored by the storing module  1001  to obtain a sixteenth hash data; 
         [0366]    the second hash module  1008  is further configured to take the sixteenth hash data obtained by performing hash operation by the first hash module  1007  as the sixth computing key, perform hash operation on the sixth computing key and the seventh time information to obtain the seventeenth hash data; 
         [0367]    the bit interception module  1009  is further configured to perform bit interception on the seventeenth hash data to obtain the ninth bit interception result; 
         [0368]    the second determining module  1010  is further configured to take the ninth bit interception result, which is obtained by performing bit interception by the bit interception module  1009 , as a first synchronization password, determine whether the first synchronization password matches a first synchronization code obtained from the synchronization request; 
         [0369]    the sending module  1005  is further configured to send information of failed synchronization to the client side when the second determining module  1010  determines that the first synchronization password does not match the first synchronization code obtained from the synchronization request. 
         [0370]    The authentication server further comprises: 
         [0371]    a fourth hash module configured to perform hash operation on the sixth computing key and the eighth time information to obtain the eighteenth hash data when the second determining module  1010  determines that the first synchronization password matches the first synchronization code obtained from the synchronization request; and 
         [0372]    the bit interception module  1009  is further configured to perform bit interception on the eighteenth hash data to obtain a tenth bit interception result. 
         [0373]    The authentication server further comprises: 
         [0374]    a third determining module configured to take the tenth bit interception result, which is obtained by performing bit interception by the bit interception module  1009 , as the second synchronization password, determine whether the second synchronization password matches the second synchronization code obtained from the synchronization request; 
         [0375]    a fourth determining module configured to determine whether the time of successful verification of the second synchronization code is later than the time of successful verification of the first synchronization code when the third determining module determines that the second synchronization password matches the second synchronization code obtained from the synchronization request; 
         [0376]    the obtaining module configured to, when the fourth determining module determines that time of successful verification of the second synchronization code is later than the time of successful verification of the first synchronization code, obtain a different value between the obtained system time and the time of successful authentication of the first synchronization code and store the different value as the token offset time corresponding to the identity information of the synchronization request; and 
         [0377]    the sending module  1005  further configured to send a message of failed synchronization to the client side when the third determining module determines that the second synchronization password does not match the second synchronization code obtained from the synchronization request; send message of successful synchronization to the client side when the third determining module determines that the second synchronization password matches the second synchronization code obtained from the synchronization request; send message of failed synchronization to the client side when the fourth determining module determines that the time of successful verification of the second synchronization code is not less than the time of successful verification of the first synchronization code. 
         [0378]    Specifically, the first hash module  1007  specifically is configured to combine the working key found by searching by the authentication server and the third usage code to be a sixteenth data, fill the sixteenth data to obtain the sixteenth message, group the sixteenth message and perform iterative compression on obtained grouping data and obtain the sixteenth hash data. 
         [0379]    The second hash module  1008  is specifically configured to combine the sixth computing key and the seventeenth time information to be a seventeenth data, fill the seventeenth data to obtain the seventeenth message, group the seventeenth message and perform iterative compression on obtained grouping data and obtain the seventeenth hash data. 
         [0380]    The fourth hash module is specifically configure to combine the sixth computing key and the eighth time information to be an eighteenth data, fill the eighteenth data to obtain the eighteenth message, group the eighteenth message and perform iterative compression on obtained grouping data and obtain the eighteenth hash data. 
         [0381]    The bit interception module  1009  is specifically configure to group the seventeenth hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the ninth bit interception result; and 
         [0382]    group the eighteenth hash data, obtain a plurality of byte groups, transform respective byte groups into corresponding binary data by shifting and combining the bytes contained in the byte groups; perform modulo operation on a first preset value by using sum of all the binary data obtained by transforming to obtain a modulo result, perform modulo operation on a second preset value by using the obtained modulo result and obtain the tenth bit interception result. 
         [0383]    According to the present invention, the authentication server obtains corresponding computing key upon different usage codes, verifies dynamic passwords used in variety of application sites upon different usage codes, which reduces risks that the key used for generating a dynamic password is being stolen and improves security of a token verification system. 
         [0384]    It can be understood by those skilled in the art that all of or part of the steps in the above embodiments can be realized by a program instructing relevant hardware, and the program can be stored in a computer readable storage media, and the steps in the above embodiments are executed when the program is executed; while the storage media includes: each media which can store program codes, such as ROM, RAM, a magnetic disk or an optical disc. 
         [0385]    The described embodiments are only preferred embodiments of the application and the embodiments are not intended to limit the application. Any alternative solution or amended solution easily obtained by those skilled in the art based on the application should fall in the scope of protection of the application.