Three-side password authentication key exchange method

Abstract

The invention discloses a three-side password authentication key exchange method, comprising the following steps: a message for requesting communication, a first Diffie-Hellman key component message and a verification message which is used for certifying the self legal identity to a server S are respectively computed and sent by an user device A and an user device B; the verification message is verified by the server S, if the verification is successful, second Diffie-Hellman key component messages of the user device A and the user device B are respectively computed and sent to opposite end users by the server S, a verification message which is used for certifying the self legal identity of the server S to the user device A and the user device B is computed and sent by the server S; the verification messages which is used for certifying the self legal identity of the server S are respectively verified by the user device A and the user device B, if the verification is passed, session keys are respectively generated by the user device A and the user device B through computing.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a three-party password authentication key exchange method. Background technique [0002] With the development and popularization of Internet technology, the network has become a major means of communication. Due to the openness of the Internet, not only ordinary legal users can conduct business through the network, but malicious users can also carry out various attacks such as eavesdropping, impersonation, and tampering through the network, which poses a great threat to the business security of legitimate users. In order to protect the important business of legitimate users, it is necessary to use key establishment technology to establish a secure channel to protect the confidentiality and integrity of user data. [0003] A key exchange protocol is a key establishment technique in which two or more parties jointly provide information to derive a session key whose outcome ...

AI Technical Summary

Problems solved by technology

However, there are few achievements in the study of three parties or more than three parties, and the current results are not perfect enough.

[0005] In 2005, a general construction method for constructing a three-party password-authenticated key exchange protocol through a two-party password-authenticated key exchange protocol was proposed. However, it was found that the general structure could not resist undetectable online dictionary attacks. In 2005, a new An efficient three-party password-authenticated key exchange protocol. The protocol only uses passwords to establish session keys, so it is vulnerable to password leaking and masquerading attacks, that is, the user's password is leaked, and the adversary can not only masquerade as the user, but also reversely masquerade as the user. server to spoof the user

[0006] Through the research on the prior art, the inventor found that: the existing three-party password authentication key exchange protocol cannot resist the undetectable online dictionary attack and the password leakage and masquerade attack, so that the security of communication cannot be guaranteed, which brings great harm to users Large loss, besides, the communication efficiency of the existing technology is low

Images