Dynamic password based authentication identifying method

Abstract

This invention discloses a client authentication identifying method based on dynamic password which can the used in remote network register, data base access, electronic commercial service and electronic mails with the following characters: 1. not using the memory medium like IC card to avoid adding the extra cost to the clients. 2. capable of resisting the attacks from the media, intermediate person and dictionaries with security. 3. the scheme is simple, and easy for programming.

Description

technical field [0001] The invention relates to a method for security identification of a legal identity of a client based on a client / server mode in network communication. Background of the invention [0002] With the rapid development of Internet applications, especially e-commerce, the identification of network users becomes more and more important. At present, many identification methods have appeared, but the most popular and effective one is the identification method based on passwords. [0003] At present, the most commonly used method of a password-based identity authentication system is: the user registers his user name and password on the server side, and then the server keeps the user name and password in a password file. When the user logs in for identification, the user enters the user name and password and sends them to the server; the server compares the received information with the user name and password registered by the user; if the two are the same, the ...

AI Technical Summary

Problems solved by technology

[0004] But this method has two obvious defects: (1) if once the user password file that keeps in the server is lost, then the passwords of all users in the system may be embezzled by others, thereby making the whole system all insecure; (2) An illegal third party can intercept the user's password through the network during the password transmission process. Regardless of whether the password is encrypted or not, the illegal intruder can use the intercepted password to pretend to be a legitimate user to deceive the trust of the server and log in to the system. This is The so-called retransmission attack in cryptography

In other words, this method can solve problem 1 above, but still cannot solve problem 2

However, these methods all use storage media similar to IC cards, and have the following potential safety hazards and deficiencies: (1) there is the possibility of dictionary attacks

For ease of memory, user passwords generally only have 4-8 characters, and illegal third parties can intercept user password information transmitted online and perform dictionary traversal searches, thereby making dictionary attacks possible; Storage media such as IC cards will inevitably increase additional expenses; (3) no matter where the user goes in the world, he must bring a storage device similar to the IC card, otherwise he cannot log in online, which brings problems to the user. many inconveniences

Images