A graphical password authentication method and system resistant to multiple attacks and not limited by the number of authentication attempts

Abstract

The application discloses a kind of graphic password authentication method and system resistant to multiple attacks and not limited by authentication times, specifically: when user registration, select two password graphics from picture set, and select password point block from point block picture, generate authentication password using random number, server stores password information according to password information and current timestamp, and split random number and store in multiple storage servers;When user login, select two password graphics from picture set, select password point block from point block picture, change the point coordinate axis selected when registration into picture point coordinate by moving coordinate axis, obtain user password information, and obtain and restore random number from multiple storage servers, calculate authentication password and send to authentication server, and authentication server carries out login verification according to authentication password and current timestamp.The application has strong attack resistance, high security, solves the problem of repeated registration, and improves the convenience of user use.

Description

Technical Field

[0001] This invention relates to the field of computer security authentication technology, and in particular to a graphical password authentication method and system that resists multiple attacks and is not limited by the number of authentication attempts. Background Technology

[0002] User passwords are unique verification credentials used by users to authenticate their identity when accessing computer systems, network systems, applications, or resources; they are the core security carrier of the identity authentication system. Password management has long been a major problem for users. Under the common constraint of mandatory password complexity policies (such as requiring a combination of uppercase and lowercase letters, numbers, and special characters), users tend to adopt predictable construction patterns to cope with the inherent contradiction between memory burden and daily convenience. Empirical studies show that a considerable number of users prioritize and reorganize their personally identifiable information (PII), such as ID card numbers, dates of birth, and phone numbers, to generate passwords that meet complexity requirements and are easy to remember. However, this password generation strategy contains serious security risks. With the frequent occurrence of network data breaches, the privacy and security of personally identifiable information, as the user's preferred source of entropy, can no longer be guaranteed. In particular, static and highly sensitive data such as ID card numbers are easily obtained and associated in today's dark web transactions, credential stuffing attacks, and large-scale data breaches. Once personal information, a core component of a password, is leaked, the password constructed based on it loses its secrecy, leading to a very high risk that user accounts will be vulnerable to various authentication attacks such as brute-force attacks, credential stuffing, and identity theft.

[0003] In recent years, mobile internet has become deeply embedded in daily life, and mobile terminals have become the core carrier of personal digital identity. From financial payments to instant messaging, from corporate office work to social media, terminal transactions have permeated every aspect of people's daily lives. Security incidents surrounding the leakage of mobile phone passwords are escalating, exposing multiple and intractable risk gaps in the mobile security ecosystem. To break the dilemma of password complexity requirements and user memory limitations, and to move beyond the traditional approach of simply relying on coercive strategies, academia is committed to exploring an authentication method that does not involve users' personal information and conforms to cognitive laws. Graphical password authentication schemes are an important product of this exploration. They utilize the advantage of human memory for images, aiming to build a new authentication system that combines security and usability. Common graphical password authentication schemes include PassPoints, CCP, EvoPass, and GADL. The PassPoints scheme proposed by Wiedenbeck et al. generates a password by having the user select certain pixels in an image. Although this scheme avoids the drawback of relying on personal information and can resist dictionary attacks, its security is greatly reduced because users often choose hot spots. To address the hotspot issue, Chiasson et al. proposed the CCP scheme, which utilizes a multi-photo, multi-location strategy to avoid the vulnerability of hotspot location leakage. However, this scheme still has limitations in its application; it cannot resist shoulder spying attacks. To solve the shoulder spying attack problem, Yu et al. proposed the EvoPass scheme, which uses black and white sketches instead of images. Each time a user logs in, sketch dots randomly appear in various locations on the screen, and the number of sketch dots is also random. Nyang et al. proposed the two-thumbs-up scheme, which requires users to be aware of preventing shoulder spying and requires both hands to be placed simultaneously in designated positions before the password challenge information is displayed.

[0004] The GADL scheme, while satisfying the aforementioned attack model, introduces new requirements. It employs a combination of images and matrix attacks, along with a threshold signature algorithm, and can simultaneously resist dictionary attacks, spying attacks, screen recording attacks, and server disclosure attacks. The specific process of the GADL scheme is as follows:

[0005] Prerequisites:

[0006] Shared system parameters: ,in It is the public key parameter. It is a safe hash algorithm. Image collection A collection of blocks Maximum number of failed authentication attempts.

[0007] Registration phase:

[0008] (1) Input User Server detection Is it unique? If not unique, refuse registration; otherwise, proceed to the next step.

[0009] (2) When a user registers, the interface will randomly select from the image set. show Users can choose any two images to input their password. Click Next;

[0010] (3) The interface will randomly select from the set of squares. show The user selects one of the images as their location block image, and the image is divided into... There are several blocks; the user can choose any two blocks as their designated points. At this point, the user's graphical password information is obtained. Click Next;

[0011] (4) The system generates signature information and authentication password ,in It is a random number, and the system will generate it in a secure channel. and The authentication information is sent to the authentication server. After receiving the authentication information, the authentication server starts counting. Simultaneously store password information for Registration successful;

[0012] (5) After receiving a successful registration, the system will... Split into Using a deterministic threshold blind signature algorithm, Distributed storage On a storage server.

[0013] Certification phase:

[0014] (1) When a user logs in, the interface will still start from the image set. Display any text The user can swipe left and right on the images until both images selected during registration appear simultaneously on the screen. If you select both images again, the set of points for these two images will be displayed. Click Next;

[0015] (2) The interface will randomly select from the set of squares. Display h images, and the user selects one as their point block image. This image is still divided into... The interface differs from the registration interface in that it uses two coordinate axes: the right and top sides, and the left and bottom sides. This is because the coordinate axes at this time... , The order has been disrupted, requiring users to manually move the coordinate axes to reassemble the login point set. Move to the location selected during registration ( superior, Similarly, click Next;

[0016] (3) At this time The rows and columns are what was used during registration. The rows and columns are used to derive the user password. Click Next;

[0017] (4) From Get from storage servers A deterministic threshold blind signature recovery algorithm is used to obtain... , At this time Send to the authentication server;

[0018] (5) Server verification ,and Authentication successful. Otherwise, login will be refused.

[0019] However, the GADL scheme has the following drawbacks: (1) The number of uses exceeds the maximum authentication value. Afterwards, re-registration is required, which causes inconvenience to users; (2) A maximum authentication limit is set to resist dictionary attacks. However, it overlooked maliciously triggered distributed denial-of-service (DDoS) attacks. (3) Unable to resist replay attacks, once the authentication password is authenticated. If leaked during transmission, attackers can use the password for authentication indefinitely, posing a significant threat.

[0020] Therefore, there is an urgent need to invent a graphical password authentication method that can resist multiple attacks and is not limited by the number of authentication attempts. While resisting dictionary attacks, spying attacks, screen recording attacks, server leakage attacks, DDoS attacks, and replay attacks, it should also solve the problem of repeated registration required by existing methods and improve the convenience of user operation. Summary of the Invention

[0021] The purpose of this invention is to provide a graphical password authentication method and system that resists multiple attacks and is not limited by the number of authentication attempts. It uses timestamp technology to replace the ordinary counter in the GADL scheme. By introducing a timestamp verification mechanism, it fundamentally solves the problem of repeated registration caused by the maximum number of authentication attempts, while also achieving protection against DDoS attacks and replay attacks.

[0022] The technical solution to achieve the purpose of this invention is: a graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts, including a registration phase and an authentication phase;

[0023] The registration phase includes the following steps:

[0024] Step R1: The client inputs the user ID, along with the client's current time. Send to the server; the server checks the uniqueness of the ID and the time difference, and sends the ID if and only if the ID is unique and satisfies the following conditions. Proceed to the next step if necessary, otherwise registration will be rejected; The current time when the server received the request. This represents the maximum time difference allowed between the server and client systems.

[0025] Step R2: The client interface randomly selects images from the image set. Display in The user selects any two images as the password graphic input. ;

[0026] Step R3: The client interface randomly selects from the set of blocks. The image displayed is a point block image, which is divided into... There are several squares. The user can choose any two squares as point blocks, denoted as . Obtain user's graphical password information ;

[0027] Step R4: The system generates signature information. and the first authentication password , current timestamp and After establishing the connection, the second authentication password is obtained through encryption. The system stores the user ID and second authentication password in the secure channel. Send to the authentication server;

[0028] Step R5: After receiving the registration information, the server decrypts it to obtain... and Server-side verification Whether it is valid, among which The server's current time is used; if verification is successful, the authentication password is stored. Recorded as Registration successful;

[0029] Step R6: After receiving a successful registration, the system will generate a random number. Split into common Each share is distributed and stored in On a storage server;

[0030] The authentication phase includes the following steps:

[0031] Step L1: When a user logs in, the client interface changes from the image gallery. Display any text If the two images selected by the user during registration do not appear simultaneously on the interface, [the user will be able to view them]. If the user clicks refresh, the screen will display both images simultaneously; if both images are selected, the set of points for those two images will be displayed. ={( , ),( , )}, record the login location information for the current image;

[0032] Step L2: The user selects the image chosen during registration, and the image is divided into... The interface consists of several squares with coordinate axes arranged in a randomized order. Each coordinate axis can be manually moved. Users can manually move the coordinate axes to retrieve the points selected during registration. The coordinates are moved sequentially to the positions of the images selected during login. , ),( , The coordinates corresponding to )

[0033] Step L3: Obtain the user password information through the operations in step L2. ;

[0034] Step L4: From Get from storage servers Obtained using a recovery algorithm Calculate signature information and the first authentication password Second authentication password , the second authentication password Send to the authentication server;

[0035] Step L5: The server receives the login password. Then, calculate ,get and Server-side verification and Whether they are both true or false, among which The password information stored during registration. If both conditions are met, authentication is successful; otherwise, login is rejected.

[0036] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts.

[0037] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts.

[0038] Compared with the prior art, the significant advantages of this invention are:

[0039] (1) No limit on the number of authentications, no need for repeated registration: This invention uses timestamps Replacement of the ordinary counter in the GADL scheme and maximum number of authentications Time difference verification This method verifies the validity of the password without setting a limit on the number of authentication attempts. Users do not need to re-register after reaching the limit, which significantly improves the user experience.

[0040] (2) Effectively resists replay attacks: A timestamp is introduced into the authentication password. A symmetric encryption algorithm is used for each authentication. Will With current timestamp Encryption generation This ensures that an authentication password is generated for each login. It dynamically changes with the current time, achieving the effect of "one password at a time," even if an attacker intercepts the password during transmission. Since the timestamp has changed, replaying the password will not pass the server's time difference verification, thus effectively resisting replay attacks.

[0041] (3) Effectively resists DDoS attacks: The authentication password of this invention has an expiration time, and the server uses the current time during verification. Perform time difference verification Even if an attacker obtains the correct password, the server's verification time will be insufficient. With the timestamp carried in the password The difference exceeded the maximum allowed time difference. The server will still reject login requests, thus effectively resisting DDoS attacks;

[0042] (4) Further enhance security while maintaining the original security of the GADL scheme: This invention retains the threshold blind signature mechanism of image and matrix combination in the GADL scheme, inherits its protection against dictionary attacks, shoulder spying attacks, screen recording attacks and server leakage attacks, and adds protection against DDoS attacks and replay attacks, forming a more comprehensive security protection system. Attached Figure Description

[0043] Figure 1 This is a flowchart of the graphical password authentication method of the present invention, which resists various attacks and is not limited by the number of authentication attempts.

[0044] Figure 2 This is a schematic diagram of the interface where a user selects an image during registration in an embodiment of the present invention.

[0045] Figure 3 This is a schematic diagram of the interface when a user selects a point during registration in an embodiment of the present invention.

[0046] Figure 4 This is a schematic diagram of the interface where a user selects an image during login, as shown in an embodiment of the present invention.

[0047] Figure 5 This is a schematic diagram of the interface of the movable coordinate axis in an embodiment of the present invention.

[0048] Figure 6 This is a schematic diagram of the interface after the user moves the coordinate axis in an embodiment of the present invention. Detailed Implementation

[0049] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0050] like Figure 1 As shown, the present invention provides a graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts, including a registration phase and an authentication phase.

[0051] The registration phase includes the following steps:

[0052] Step R1: The client inputs the user ID, along with the client's current time. Send to the server; the server checks the uniqueness of the ID and the time difference, and sends the ID if and only if the ID is unique and satisfies the following conditions. Proceed to the next step if necessary, otherwise registration will be rejected; The current time when the server received the request. This represents the maximum time difference allowed between the server and client systems.

[0053] Step R2: The client interface randomly selects images from the image set. Display in The user selects any two images as the password graphic input. ;

[0054] Step R3: The client interface randomly selects from the set of blocks. The image displayed is a point block image, which is divided into... There are several squares. The user can choose any two squares as point blocks, denoted as . Obtain user's graphical password information ;

[0055] Step R4: The system generates signature information. and the first authentication password , current timestamp and After establishing the connection, the second authentication password is obtained through encryption. The system stores the user ID and second authentication password in the secure channel. Send to the authentication server;

[0056] Step R5: After receiving the registration information, the server decrypts it to obtain... and Server-side verification Whether it is valid, among which The server's current time is used; if verification is successful, the authentication password is stored. Recorded as Registration successful;

[0057] Step R6: After receiving a successful registration, the system will generate a random number. Split into common Each share is distributed and stored in On a storage server;

[0058] The authentication phase includes the following steps:

[0059] Step L1: When a user logs in, the client interface changes from the image gallery. Display any text If the two images selected by the user during registration do not appear simultaneously on the interface, [the user will be able to view them]. If the user clicks refresh, the screen will display both images simultaneously; if both images are selected, the set of points for those two images will be displayed. ={( , ),( , )}, record the login location information for the current image;

[0060] Step L2: The user selects the image chosen during registration, and the image is divided into... The interface consists of several squares with coordinate axes arranged in a randomized order. Each axis can be manually moved. Users can manually move the coordinate axes. ;

[0061] Step L3: Obtain the user password information through the operations in step L2. ;

[0062] Step L4: From Get from storage servers Obtained using a recovery algorithm Calculate signature information and the first authentication password Second authentication password , the second authentication password Send to the authentication server;

[0063] Step L5: The server receives the login password. Then, calculate ,get and Server-side verification and Whether they are both true or false, among which The password information stored during registration. If both conditions are met, authentication is successful; otherwise, login is rejected.

[0064] Furthermore, in step R1, system parameters are shared. ,in For public key parameters, For a secure hash algorithm, A collection of images. A collection of squares This represents the maximum number of failed authentication attempts. It is a symmetric encryption algorithm. To and The corresponding symmetric decryption algorithm, This represents the maximum time difference allowed between the server and client systems.

[0065] Furthermore, the signature information in step R4 and first authentication password The calculation uses the following formula:

[0066]

[0067]

[0068] in The system-generated random number. and For two different hash functions, the symbol This indicates a join operation.

[0069] Furthermore, in steps R4 and L4, the second authentication password The calculation uses the following formula:

[0070]

[0071] Aes is a symmetric encryption algorithm;

[0072] The second authentication password generated for each authentication It changes dynamically with the current time.

[0073] Further, in step R5, the calculation is performed. Obtained through a symmetric decryption algorithm and ,in To and The corresponding symmetric decryption algorithm.

[0074] Furthermore, in step R6, a deterministic threshold blind signature algorithm is used to... Distributed storage On any single storage server, a data breach on any one of the storage servers would prevent the recovery of complete random numbers. ;

[0075] In step L4, a deterministic threshold blind signature recovery algorithm is used to obtain... .

[0076] Furthermore, the image set in step R2 Number of images displayed In step R3, the number of squares into which each point block image is divided is... OK, There are 77 blocks in total.

[0077] A graphical password authentication system resistant to multiple attacks and not limited by the number of authentication attempts, the system being used to implement the aforementioned graphical password authentication method resistant to multiple attacks and not limited by the number of authentication attempts, the system comprising:

[0078] The client module is used to input the user ID, display image sets and block sets for the user to select and generate graphical password information during the registration phase, and to display images for the user to select, display a movable coordinate axis for the user to operate and generate an authentication password during the authentication phase.

[0079] The server module is used to verify the uniqueness of user IDs and time difference during the registration phase, receive and store registration information, and verify time difference and password consistency during the authentication phase.

[0080] Key storage module, including A storage server is used to process random numbers using a deterministic threshold blind signature algorithm. Split into common Each share is distributed and stored, with shares provided during authentication to recover random numbers. .

[0081] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts.

[0082] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts.

[0083] Example

[0084] This embodiment provides a graphical password authentication method that resists various attacks and is not limited by the number of authentication attempts, such as... Figure 1 As shown, the specific steps include:

[0085] Shared system parameters in steps 1 and R1 ,in For public key parameters, For a secure hash algorithm, A collection of images. A collection of squares This represents the maximum number of failed authentication attempts. It is a symmetric encryption algorithm. To and The corresponding symmetric decryption algorithm, This represents the maximum time difference allowed between the server and client systems.

[0086] Step 2: During user registration, the system first randomly displays multiple images from the image set, and the user randomly selects two as their password image input; then, it randomly displays one image from the block set as their location block image. This image is divided into multiple blocks, and the user randomly selects two blocks as their location block, as follows:

[0087] Step 2.1: On the registration page, the user enters their registration ID, such as their ID card number or mobile phone number. The system verifies whether the ID is unique. Otherwise, registration will be refused;

[0088] Step 2.2: The system randomly selects images from the image set. show Users can choose any two images to input their password. ,like Figure 2 As shown, the selected images at this time are "pig" and "smile", so ;

[0089] Step 2.3: The system randomly selects from the set of squares. The image displays a point block image, which is divided into... A square, such as Figure 3 As shown, the user randomly selects , Two squares, acting as their own point blocks, obtain the user's graphical password information. .

[0090] Step 3: The system uses random numbers to generate signature information and authentication passwords. After receiving the user's registration information, the server calculates the decrypted plaintext data, obtains the password information and the current timestamp, and verifies whether the current time difference between the server and the client is less than the maximum time difference allowed by the system. If so, the password information is stored and registration is successful; otherwise, registration failure is returned. After receiving the registration success information, the system splits the random number and distributes it across multiple storage servers, as follows:

[0091] Step 3.1: The system generates signature information. and authentication password : , , ,in It is a random number. and It is a hash function. It is the current timestamp;

[0092] Step 3.2: The system will transfer the ID and... The authentication information is sent to the authentication server. After receiving the authentication information, the authentication server calculates... ,get as well as Server-side verification ,in The server's current time is used, and the password information is also stored as follows. Registration successful;

[0093] Step 3.3: After receiving a successful registration, the system will generate a random number. Split into Using a deterministic threshold blind signature algorithm, Distributed storage On a storage server.

[0094] Step 4: When a user logs in, the system first randomly displays multiple images from the image set. The user selects two images chosen during registration. Then, the system selects the image chosen during registration from the block set. This image is also divided into multiple blocks. The right and top sides of the image interface, as well as the left and bottom sides, form two coordinate axes. The order of the coordinates on the two axes is randomly shuffled. The user manually moves the coordinate axes, replacing the coordinate axes of the points selected during registration with the coordinates of the image points. At this point, the image point coordinates are the same as the image point coordinates used during registration, and the user's password information is obtained, as follows:

[0095] Step 4.1: The system retrieves images from the image set. Display any text The user selects two images during registration. If neither image appears on the screen simultaneously, the refresh button is clicked until the user sees both images simultaneously. ,like Figure 4 As shown, when the user selects these two images, scrambled coordinates are displayed on the top and left borders of the screen, with the left side representing rows and the top side representing columns. The user then records the positions of these two images. ;

[0096] Step 4.2: The interface retrieves information from the username... The image selected during user registration is chosen and divided into 77 squares. The right and top sides of the interface, as well as the left and bottom sides, form two coordinate axes. The two coordinate axes... , The order is disrupted, such as Figure 5 As shown, green and blue each correspond to a point coordinate. The coordinate axes are movable at this point; the user can manually move the axes to the point selected during registration. The coordinate axes are changed to The location selected during registration The coordinate axes are changed to After the operation, the interface is as follows Figure 6 As shown;

[0097] Step 4.3, according to , The row and column where the number point is located are obtained during registration. , The rows and columns are used to derive the user password information. .

[0098] Step 5: The system retrieves the split random numbers from multiple storage servers, uses a recovery algorithm to obtain the random numbers, calculates the authentication password, and sends it to the authentication server. Upon receiving the user's authentication password, the server calculates the password information and the current timestamp. The server verifies whether the current time difference between the server and the client is less than the maximum time difference allowed by the system and whether the password information matches the password information stored on the server. If so, authentication is successful; otherwise, login is rejected. Details are as follows:

[0099] Step 5.1, the system from Get from storage servers A deterministic threshold blind signature recovery algorithm is used to obtain... , , , ;

[0100] Step 5.2, Send to the authentication server;

[0101] Step 5.3: The server receives the user's login password and calculates it. ,get as well as Server-side verification , The current time is the server time. If the authentication is successful, then login is successful; otherwise, login is refused.

[0102] This invention can resist dictionary attacks, spying attacks, screen recording attacks, and server leakage attacks, as well as DDoS attacks and replay attacks, demonstrating strong anti-attack capabilities and improving the security of password authentication. By using timestamps instead of ordinary counters, it solves the problem of needing to register repeatedly, improving user convenience.

[0103] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A graphical password authentication method that resists multiple attacks and is not limited by the number of authentication attempts, characterized in that, This includes the registration phase and the certification phase; The registration phase includes the following steps: Step R1: The client inputs the user ID, along with the client's current time. Send to the server; the server checks the uniqueness of the ID and the time difference, and sends the ID if and only if the ID is unique and satisfies the following conditions. Proceed to the next step if necessary, otherwise registration will be rejected; The current time when the server received the request. This represents the maximum time difference allowed between the server and client systems. Step R2: The client interface randomly selects images from the image set. Display in The user selects any two images as the password graphic input. ; Step R3: The client interface randomly selects from the set of blocks. The image displayed is a point block image, which is divided into... There are several blocks. The user can choose any two blocks as point blocks, denoted as... Obtain user's graphical password information ; Step R4: The system generates signature information. and the first authentication password , current timestamp and After establishing the connection, the second authentication password is obtained through encryption. The system stores the user ID and second authentication password in the secure channel. Send to the authentication server; Step R5: After receiving the registration information, the server decrypts it to obtain... and Server-side verification Whether it is valid, among which The server's current time is used; if verification is successful, the authentication password is stored. Recorded as Registration successful; Step R6: After receiving a successful registration, the system will generate a random number. Split into common Each share is distributed and stored in On a storage server; The authentication phase includes the following steps: Step L1: When a user logs in, the client interface changes from the image gallery. Display any text If the two images selected by the user during registration do not appear simultaneously on the interface, [the user will be able to view them]. If the user clicks refresh, the screen will display both images simultaneously; if both images are selected, the set of points for those two images will be displayed. ={( , ),( , )}, record the login location information for the current image; Step L2: The user selects the image chosen during registration, and the image is divided into... The interface consists of several squares with coordinate axes arranged in a randomized order. Each coordinate axis can be manually moved. Users can manually move the coordinate axes to retrieve the points selected during registration. The coordinates are moved sequentially to the positions of the images selected during login. , ),( , The coordinates corresponding to ) Step L3: Obtain the user password information through the operations in step L2. ; Step L4: From Get from storage servers Obtained using a recovery algorithm Calculate signature information and the first authentication password Second authentication password , the second authentication password Send to the authentication server; Step L5: The server receives the login password. Then, calculate ,get and Server-side verification and Whether they are both true or false, among which The password information stored during registration. If both conditions are met, authentication is successful; otherwise, login is rejected.

2. The graphical password authentication method according to claim 1, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... Shared system parameters in step R1 ,in For public key parameters, For a secure hash algorithm, A collection of images. A collection of squares This represents the maximum number of failed authentication attempts. It is a symmetric encryption algorithm. To and The corresponding symmetric decryption algorithm, This represents the maximum time difference allowed between the server and client systems.

3. The graphical password authentication method according to claim 2, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... Signature information in step R4 and first authentication password The calculation uses the following formula: in The system-generated random number. and For two different hash functions, the symbol This indicates a join operation.

4. The graphical password authentication method according to claim 3, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... In steps R4 and L4, the second authentication password The calculation uses the following formula: Aes is a symmetric encryption algorithm; The second authentication password generated for each authentication It changes dynamically with the current time.

5. The graphical password authentication method according to claim 4, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... In step R5, calculate Obtained through a symmetric decryption algorithm and ,in To and The corresponding symmetric decryption algorithm.

6. The graphical password authentication method according to claim 5, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... In step R6, a deterministic threshold blind signature algorithm is used to... Distributed storage On any single storage server, a data breach on any one of the storage servers would prevent the recovery of complete random numbers. ; In step L4, a deterministic threshold blind signature recovery algorithm is used to obtain... .

7. The graphical password authentication method according to claim 6, which resists multiple attacks and is not limited by the number of authentication attempts, is characterized in that... Image set in step R2 Number of images displayed In step R3, the number of squares into which each point block image is divided is... OK, There are 77 blocks in total.

8. A graphical password authentication system resistant to multiple attacks and not limited by the number of authentication attempts, characterized in that, This system is used to implement a graphical password authentication method as described in any one of claims 1 to 7 that resists multiple attacks and is not limited by the number of authentication attempts, the system comprising: The client module is used to input the user ID, display image sets and block sets for the user to select and generate graphic password information during the registration phase, and to display images for the user to select, display a movable coordinate axis for the user to operate and generate an authentication password during the authentication phase. The server module is used to verify the uniqueness of user IDs and time difference during the registration phase, receive and store registration information, and verify time difference and password consistency during the authentication phase. Key storage module, including A storage server is used to process random numbers using a deterministic threshold blind signature algorithm. Split into common Each share is distributed and stored, with shares provided during authentication to recover random numbers. .

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the graphical password authentication method as described in any one of claims 1 to 7, which resists multiple attacks and is not limited by the number of authentication attempts.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the graphical password authentication method as described in any one of claims 1 to 7, which resists multiple attacks and is not limited by the number of authentication attempts.

Images