Site password generation method and system, and password manager

Abstract

The invention provides a site password generation method and system and a password manager, wherein the site password generation method comprises the following steps: step 1) constructing a first excitation data according to the information including a user password, wherein the user password is used for logging in a user account by the user on a client side of the application program, and the first excitation data is a binary string; step 2) inputting the first excitation data into the PUF and obtaining corresponding first response data from the PUF; Wherein the first response data is a binary string. The password generation method and system and the password manager provided by the invention can resist offline attacks and single point failures, and simultaneously improve the efficiency of generating the site password.

Description

technical field [0001] The invention relates to the field of information security, in particular to a password management mechanism, in particular to a site password generation technology. Background technique [0002] Passwords are usually the main entrance to access user confidential information, and password verification is the main way to ensure security, but there are many problems in this way at present. On the one hand, users are required to use random and unique passwords, which are difficult for users to remember even though the entropy is relatively high. At the same time, with the increase of user accounts, the number of passwords managed by the user is also increasing, which will undoubtedly increase the memory burden of the user. In order to reduce the burden of memory, users often adopt insecure solutions - choose low-entropy passwords that are easy for attackers to guess, or reuse passwords on multiple sites, etc. On the other hand, day-to-day use of passwor...

AI Technical Summary

Problems solved by technology

[0004] Although password managers are able to generate high-entropy site passwords and provide users with a lot of convenience, they still have some security problems:

[0006] 2) Single point of failure cannot be avoided

There is often a single point of failure in some generative password managers introduced by the master password, through which an attacker can gain access to all of a user's accounts

Also note that many password managers do not provide protection against shoulder-snooping attacks, one of the ways attackers can obtain master passwords

Images