Identity verification method for resisting password-guessing replay attack

Abstract

The invention relates to the technical field of identity authentication, in particular to an identity verification method for resisting a password-guessing replay attack. The identity verification method related by the invention comprises the following steps: first of all, carrying out time synchronization on a server and a user browser which needs identity verification; then obtaining a shared key by the user browser via an https mechanism; obtaining a current timestamp; carrying out encryption on a usename and the timestamp together with a password by employing the shared key by the user browser; then encrypting whole identity verification information with the shared key again; then carrying out two times of decryption by a server side to obtain two pieces of identity verification information; then making a comparison respectively, and if the two pieces of the identity verification information are completely consistent, comparing the timestamp with a current time; and at last, verifying whether a usename and password combination in the information is consistent with the usename and password combination stored in a system, and if yes, executing the verification is passed. According to the identity verification method related by the invention, the identity verification via the password-guessing attack is avoided; and the identity verification method can be used in the identity verification of a Web application.

Description

technical field [0001] The invention relates to the technical field of identity authentication, in particular to an identity authentication method against password guessing and replay attacks. Background technique [0002] With the log development and wide application of computer technology and Internet technology, people feel more and more strongly that the non-regional and real-time network digital flow is changing the way of information dissemination in an all-round way, making it faster and more efficient. more efficient. However, the problem of information security has become a bottleneck restricting the application of computer networks, and with the rapid development of computer networks, it has become increasingly prominent. [0003] Under the current trend that Web applications are the mainstream, the identity verification system is the most important part of protecting information security. Username / password mechanisms account for the vast majority of authenticati...

AI Technical Summary

Problems solved by technology

[0005] 1. Use a password generator to generate a strong password. At this time, the cost of cracking will be greatly increased so that it cannot be successfully cracked within a limited time. However, a strong password is often difficult to remember. For users, it is possible to forget Password, it may also happen that the user stores the password in other places and the password is leaked, which is not conducive to information security;

[0006] 2. Use randomly generated verification codes, but this is only suitable for page-type applications, not for interface-type applications, and the current image recognition technology can already identify verification codes in pictures, and this type of attack can also be automated ;

[0007] 3. Limit the number of consecutive attempts of incorrect passwords, and lock user accounts that exceed the limit. This method can resist password guessing attacks, but it introduces another attack method. Attackers continue to try and fail by guessing user names, which may cause a large number of User accounts are locked, greatly affecting the usability of the application

Images