A Double Verification Method for Remote User Password Based on Smart Card

Abstract

The invention discloses a remote user password dual-verification method based on an intelligent card, which comprises the steps of registration, login and authentication, wherein the register step further comprises the step that registration information provided by a user is stored in the intelligent card through the intelligent card and a server after being converted; the login step further comprises the step that local legality verification is performed to the identification of the user through the intelligent card, and if the identification is legal, the intelligent card generates first verification data and sends the data to the server; the authentication step further comprises the step that local legality verification is performed to the identification of the user through the server, if the identification is legal, second verification data is generated and sent to the intelligent card, the intelligent card performs legality verification to identification of the server, if the identification of the server is legal, third verification data is generated and sent to the server, a conversation secret key is generated at the same time, and the server performs secondary verification to the identification of the user, if the identification is legal, the conversation secret key is generated. The user anonymity is realized, the lose attack of the intelligent card can be resisted, and server attack is avoided.

Description

technical field [0001] The invention relates to the technical fields of information security and communication, in particular to a method for double verification of remote user passwords based on smart cards. Background technique [0002] In 1990, Hwang, Chen and Laih et al proposed a password authentication method based on smart cards. In their method, the user information is stored in the smart card, and the remote server does not need to store the password table containing the user's private information. [0003] In 1993, Chang-Wu introduced a smart card-based public key cryptographic authentication method, which not only requires a public key directory, but also has a large amount of calculation. Later, many researchers successively proposed many authentication methods based on smart card without public key cryptography. However, the above methods usually store the secret parameters directly in the smart card. Once the parameters are leaked, the user is vulnerable to o...

AI Technical Summary

Problems solved by technology

[0005] However, Khan et al. found that the method proposed by Wang et al. still has security flaws, and proposed an improved method

In 2010, He et al. pointed out that the method proposed by Khan et al. is still not resistant to three attack types

In fact, the method proposed by Qi Xie cannot achieve user anonymity, and cannot resist replay attacks, denial of server attacks, and smart card loss attacks.

Images