Smart card password authentication and password modification method

Abstract

The invention discloses a password authentication and password changing method combining a smart card, and is widely applied in security guaranty mechanisms of e-commerce and other social networking services. The method combining the smart card and the password authentication comprises four complete stages including user registration, server authentication, user authentication and user password changing, among which, a lightweight efficient and secure cryptographic protocol and an algorithm are designed. The function that a remote server does not store a user password is achieved; the risks that the user password is stolen at the server end are reduced; and meanwhile, as a timestamp and a counter are added into a password authentication protocol, replay attacks and information interception attacks can be effectively prevented, and a user can freely change the password without an application to the server.

Description

technical field [0001] The invention relates to the technical fields of information security and cryptography, in particular to a password authentication and password modification method combined with a smart card. Background technique [0002] In the fast-paced urban life, online transactions and online recharge undoubtedly save people more time. However, the more humans rely on information systems, the more prominent information security issues will be. Since the vigorous development of e-commerce, cases of stealing users' property through the Internet have occurred from time to time, and the issue of information security has become a problem that cannot be ignored in the process of social information development. [0003] In order to solve the above problems, people have designed a variety of authentication mechanisms using symmetric encryption and asymmetric encryption in modern cryptography. Among them, password authentication is more concise and convenient than other...

AI Technical Summary

Problems solved by technology

[0005] (1) Use the user password to encrypt the private key and store it on the user device. This method is now widely used in various fields, but it is difficult to resist dictionary attacks

[0006] (2) Use hardware devices such as smart cards and USBKEY to strengthen private key protection, but if the smart card is lost, user information may be leaked

[0007] (3) Using the block cipher system and the public key encryption system, the communication parties will establish a session key and protect the user password at the same time, avoiding dictionary attacks, but the block cipher encryption speed is slow and there is a hidden danger of ciphertext transmission errors

[0008] (4) One-time password authentication, such as MD5, so that the user password is different every time you log in, but the use of security tokens has to face the trouble of running out of battery power

Images