Dynamic signature method, client using the same and server

Abstract

The invention discloses a dynamic signature method, a client using the same and a server. The method comprises steps that: an authentication request is sent to the server through the client; after the server receives the authentication request, an authentication request response message carrying a challenging value is sent to the client; the client selects a signature algorithm according to the challenging value in the authentication request response message, signs the generated authentication response message by using the selected signature algorithm and sends the authentication response message to the server; and the server receives the authentication response message, selects the signature algorithm according to the challenging value, and verifies the signature of the response message. If the verification is passed, the authentication is passed, or else an error is reported. According to the invention, a random signature algorithm is adopted, and even if a user key is leaked, an attacker does not know the signature algorithm and fails to forge the response message, so safety is improved.

Description

technical field [0001] The application belongs to the technical field of identity authentication, and in particular relates to a dynamic signature method in the identity authentication process and a client and a server applying the method. Background technique [0002] Replay attack means that the attacker sends a data packet that the destination host has accepted to achieve the purpose of deceiving the system. It is mainly used in the identity authentication process and destroys the correctness of the authentication. Replay attack is one of the attack methods commonly used by hackers in the computer world. In order to resist replay attack, current identity authentication generally adopts a challenge-response method. [0003] The challenge response method is to send a request first when the user applies to log in to the system on the client side for identity authentication. After receiving the request, the system server sends a challenge value to the client. The client calcu...

AI Technical Summary

Problems solved by technology

[0004] However, the existing technology uses a fixed algorithm for signature. If the signature key leaks, the attacker can forge the response message, resulting in the theft of the user account or authentication failure.

Images