Method for realizing three-factor anonymous identity authentication based on SM2 algorithm

Abstract

The invention relates to a method for achieving three-factor anonymous identity authentication based on an SM2 algorithm. The method comprises the steps: system initialization: a server generates a private key d and a public key P, the private key d is kept secret, and the public key P is published to the outside; user registration; user offline pre-authentication; online bidirectional authentication and key negotiation; and updating of the user password. According to the method for realizing three-factor anonymous identity authentication based on the SM2 algorithm, mutual authentication and key negotiation security are realized by utilizing multiple means, so the problems of sensitive information leakage, offline dictionary attack, insufficient security strength of a cryptographic algorithm and the like in the prior art are solved.

Description

technical field [0001] The invention relates to the field of network information security, in particular to the field of SM2 algorithm, and specifically refers to a method for realizing three-factor anonymous identity authentication based on the SM2 algorithm. Background technique [0002] In order to ensure the communication security between the user client and the background server, identity authentication is an essential security measure. The current authentication scheme has the following problems. [0003] (1) Sensitive information protection [0004] The three-factor identity authentication formed by the combination of user ID password, user equipment, and biometrics can provide richer security attributes. However, if the user self-selected identification, password and biometrics are not properly transmitted or stored, such as plain text transmission, storage identification, password and biometrics, etc., it will lead to the leakage of sensitive information. It shoul...

AI Technical Summary

Problems solved by technology

[0005] On the other hand, if the result of each encryption of the same data is the same, such as using a symmetric cryptographic algorithm to encrypt data and the encryption key and data are the same in each encryption, the attacker can still pass the same encryption result between sessions Tracking users, leading to leakage of sensitive information such as user behavior

[0006] (2) Offline dictionary attack

[0009] Cryptographic operations are the core of identity authentication security, and the defects of cryptographic algorithms will cause security risks. For example, the inherent defects of the Chebyshev chaotic map can be used to recover the message from the given ciphertext

Images