Multi-server safety certification method based on passwords capable of being memorized by people

Abstract

The invention discloses a multi-server safety certification method based on passwords capable of being memorized by people. The method includes the steps of registration, logging in and certification. A registration center generates a system private key of a server S<j> according to received registration information of the server S<j>, and the registration center generates a first parameter set according to the received registration information of a user U and writes a second parameter set onto a smart card of the user U, wherein the first parameter set comprises a password protection parameter A and a user uniqueness parameter D, and the second parameter set comprises the user uniqueness parameter D; the smart card performs local verification on the identity of the user, and if the identity of the user is verified to be correct, the smart card generates a third parameter set and sends the third parameter set to the server S<j>; the server S<j> judges whether login information of the user U to be in real time and correct, and if the login information is judged to be correct, the S<j> generates a fourth parameter set and sends the fourth parameter set to the user U; the smart card verifies the legitimacy of the server S<j>, if the legitimacy of the server S<j> is verified to be correct, the server S<j> verifies the legitimacy of the identity of the user, and if the legitimacy of the identity of the user passes the verification, the certification is successful. Due to the technical scheme, the method can resist off-line password conjecture attacks and user imitation attacks.

Description

technical field [0001] The invention relates to the technical field of information security and communication, in particular to a multi-server security authentication method based on human-memorable passwords. Background technique [0002] The multi-server environment means that under the background of the rapid development of Internet technology, a powerful online service provider can provide a variety of different services at the same time. [0003] Human-memorable password means that the password chosen by the user can be remembered by people. The selection of this type of password is generally related to the user's personal life, such as birthday, phone number, license plate number, etc. This means that the randomness of the password selected by the user is not high, that is, the entropy is not high, and it is easy to be obtained by an attacker using an offline dictionary or offline guessing attack. This type of cipher is studied in articles by Jonathan Katz and Rafail ...

AI Technical Summary

Problems solved by technology

[0007] In 2012, Wang and Ma et al. analyzed the security of Shao and Chin's method, and pointed out that their method cannot resist offline password guessing attacks, user imitation attacks, and cannot achieve user anonymity.

Images