Method and device for security authentication

Abstract

Embodiments of the invention disclose a method and device for security authentication. The method comprises the following steps: performing password authentication with a server based on a transmittedpassword authentication message to obtain a password authentication result; sending an authentication request message to the server when determining that the password authentication result characterizes password authentication success; and performing security authentication by the way of digitally signing all interaction messages through the server, and performing digital signature verification through the client, or by way of performing public key encryption by the client on the local random numbers and all the interaction messages, and verifying the random numbers returned by the server. Thus, the identity correctness of both communication parties is ensured by the way of combining the password authentication with digital signature, or combining the password authentication with public key encryption, thereby avoiding network attacks such as message leakage and malicious information tampering during the communication, improving the reliability of network authentication, and guaranteeing the user's communication security.

Description

technical field [0001] The present application relates to the technical field of network security, in particular to a security authentication method and device. Background technique [0002] With the development of Internet technology, network attacks are becoming more and more serious. When users use the Internet for communication and transactions, there are problems such as information leakage and malicious tampering of transaction information. The user's network security is greatly threatened, which brings great inconvenience to the user. [0003] In the prior art, communication security is usually guaranteed through security authentication. Among them, security authentication mainly adopts the following two methods: [0004] The first method is: the client and the server use the shared password as a security authentication credential, so as to perform security authentication through the shared password. [0005] Specifically, when the client receives the response mess...

AI Technical Summary

Problems solved by technology

[0009] However, in this way, the already deployed password authentication system needs to be completely replaced and modified, which wastes the resources of the existing authentication system, increases the cost of using the authentication system, and is not practical

Images