Identity authentication method and system based on EAP-MD5 improved protocol

Abstract

The invention relates to an identity authentication method and system based on an EAP-MD5 improved protocol. In the identity authentication method, hash processing is carried out on Challenge and a user name, and a result is subjected to exclusive OR with a user password, so that the Challenge is protected, the problem that a Challenge value cannot be directly cracked by adopting a violent or dictionary cracking method after data is intercepted due to the fact that a hacker does not know the password in plaintext transmission is avoided, and the difficulty of cracking the hash by violent forceis improved. Meanwhile, the password is included in a hash value in an exclusive OR mode instead of a plaintext combined mode, the cracking difficulty and complexity are increased, the password use safety is improved, and a timestamp is introduced to serve as a judgment basis for time replay in subsequent authentication. According to the identity authentication method and the system, in the process of identity authentication, the probability that the protocol is violently cracked is effectively reduced, the replay attack of the data packet is effectively prevented, and the security of authentication is improved.

Description

technical field [0001] The invention relates to the technical field of computer communication, in particular to an identity authentication method and system based on the improved EAP-MD5 protocol. Background technique [0002] Extensible Authentication Portocol (EAP) is an authentication framework that supports multiple authentication methods and is used for port-based 802.1X access control. EAP-MD5 is the most basic and the first EAP type used in WLAN, and is widely used in port authentication in wired or wireless networks. However, the traditional EAP-MD5 protocol has several disadvantages, so EAP-MD5 is not recommended in some high-security authentication environments. The major disadvantages are: [0003] 1. The user key is easy to be brute force cracked by the MD5 dictionary: the username and authentication challenge number of the requesting party are always visible in plain text, so the MD5 hash value composed of username + password + challenge number is easily deciph...

AI Technical Summary

Problems solved by technology

However, the traditional EAP-MD5 protocol has several disadvantages, so EAP-MD5 is not recommended in some high-security authentication environments. The major disadvantages are:

[0003] 1. The user key is easy to be brute force cracked by the MD5 dictionary: the username and authentication challenge number of the requesting party are always visible in plain text, so the MD5 hash value composed of username + password + challenge number is easily deciphered by offline dictionary attacks out user password

[0004] 2. It is prone to replay attacks. Even if the MD5 hash value is not cracked, all the data packets of the last authentication are replayed to the authentication server. Since the server cannot judge the time relationship of the data packets, the authentication process may also be completed

Images