CN100431297C - Method for preventing user passwords from being stolen by adopting two-factor authentication protocol - Google Patents

Abstract

The method of using double authentication protocol to prevent user passwords from being stolen is to use computer, network and password technology to store two sets of authentication protocols in the authentication device of the client, one is the network authentication protocol, and the other is the authentication protocol of the authentication device. The static password is used as part of the key, and the other part of the key is automatically generated by the authentication protocol of the authentication device. The two are combined into an encryption key of a symmetric encryption algorithm to encrypt and decrypt the user certificate and the network authentication protocol to achieve authentication of the authentication device. At the same time, a network authentication protocol is also established on the network server side, which corresponds to the network authentication protocol of the client, and a symmetric or asymmetric encryption algorithm is used to generate a dynamic password that changes once to realize network authentication. User identification, thereby preventing user passwords from being stolen.

Description

Method for preventing user passwords from being stolen by adopting two-factor authentication protocol

Technical field:

The present invention relates to the field of information security, and uses computer, network and cipher technology to solve the problem of stolen passwords of network users. The technical method can strictly protect the passwords of users, and realize the authentication of authentication equipment and the security of the network. Login, and at the same time, put an end to the "stealing" phenomenon in industries such as e-government, e-commerce, online banking, and online games. The invention is applicable to various systems that require identification on the network.

Background technique:

At present, there are no technical methods and products that can completely solve the problem of network "stealing" at home and abroad. The anti-network "stealing" products produced by some manufacturers use smart cards and encryption technology to generate dynamic passwords that change once and for all to realize network identity authentication. However, if the user loses the smart card, it is easy to be stolen, and some manufacturers use two-factor network identity authentication, using the user's static password and the dynamic password generated by the authentication protocol to perform network identity authentication at the same time. Characteristic, the "stolen account" person can use the Trojan horse virus and analyze the user's authentication protocol to steal the user's static password and the dynamic password generated by the authentication protocol. In a word, the existing anti-network "stolen account" methods and products cannot satisfy the market demand.

Invention content:

The method to prevent user passwords from being stolen is to use computer, network and password technology to establish a network security identity authentication system, and set up a pair of identical encryption devices on the network server side and each client side, and the encryption algorithm uses a symmetric cryptographic algorithm or asymmetric cryptographic algorithm, the server and the client end establish a set of network authentication protocols respectively, and the network authentication protocol generates a one-time changing dynamic password to realize the identity authentication between the client computer and the network server; in the authentication device of the client computer Establish another set of authentication protocols for the identification of client-side authentication devices, using a symmetric encryption algorithm. The encryption key consists of two parts: one is the user's static password, and the other is the authentication protocol in the authentication device. Automatically generated, the two are combined into an encryption key, and the user certificate and some or all network authentication protocols are encrypted and decrypted to achieve the identification of the authentication device and the regulation of the network authentication protocol. When the user's static password passes the client After the terminal authentication device is identified, the network authentication protocol is decrypted to generate plaintext, and then the network authentication protocol is called to complete the identification of the network server, thereby preventing the user's password from being stolen. The whole process is realized by pure software or a combination of software and hardware. The specific method is as follows:

1. Establish a network authentication protocol at both ends of the network server and the client. The authentication protocol at the network server is stored in an encryption device, such as an encryption card, encryption machine, etc., or stored in the hard disk of the server, and the authentication protocol at the client is stored. In the authentication device, the authentication device refers to: smart card, U disk, CD, floppy disk, hard disk, etc.

2. The network authentication protocol is based on the symmetric or asymmetric encryption algorithm system, and the network authentication protocol on the client side generates a dynamic password K that changes once, where: K = 80-2000bit "0" and "1" numbers, And send the dynamic password and its authentication parameters to the network server. When the network server receives the dynamic password and authentication parameters, it will generate a dynamic password of the same length according to the network authentication protocol. By comparing whether the dynamic passwords at both ends are the same, the client can be judged. The identity of the end user.

3. When the network authentication protocol adopts symmetric encryption algorithm,

(1) The symmetric encryption key adopts the "key seed" technology. Under the control of the user's session key and time stamp, the encryption key N is randomly selected to generate a one-time pad, where: N=80~128bit "0" ", "1" numbers, which are used to encrypt the user certificate to generate the user's secret certificate, and define it as a dynamic password K. Since the encryption key changes every time, the generated dynamic password K changes every time.

(2) The user name or user number is composed of Y digits or English letters, among which: Y=4~12 digits, and the time stamp is 8 digits, respectively representing the year, month and day, generated according to the clock of the client computer system , the session key consists of N1=8~16 digits, N1 random digits generated by the network authentication protocol on the client side, the "key seed" is M1 groups of digits, M1=100~2000, the length of each group of digits is M2, M2=4~32bit "0" and "1" numbers, under the control of the session key and time stamp, select N1 group "key seeds" from the user's M1 group "key seeds" and synthesize a group Encryption key N.

(3) The network authentication protocol is to first generate a dynamic password that changes once by the client, and then send the password and authentication parameters to the network server. The user certificate on the server side is encrypted to generate the user's secret certificate, that is, a dynamic password, and the identity of the user is determined by comparing whether the dynamic passwords at both ends are the same. The authentication parameters include: user name or user number, session key and time stamp, etc.

4. When the network authentication protocol adopts asymmetric encryption algorithm,

(1) Store a group of user's private keys in the client terminal authentication device, its length is 1024 or 2048bit, store a group of user's public keys at the network server end, its length is also 1024 or 2048bit, set up random array S1, Among them: S1=100～2000, the length of each group of random numbers is S2=8～32bit "0" and "1" numbers, and the random array is selected under the control of the user's session key and time stamp. Select N1 sets of random numbers and synthesize a set of random numbers S, S = 80 ~ 2000bit "0" and "1" numbers, combine the random number S with the user's certificate as plaintext, and then use the user's private key to process it Encrypt to generate a set of ciphertext, which is defined as a dynamic password. Since the selected random number S changes once, the encrypted ciphertext also changes once, that is, the dynamic password changes once.

(2) The client generates a dynamic password that changes once, and then sends the password and authentication parameters to the network server. After receiving the password, the network server takes out the user's public key according to the authentication parameters to decrypt the dynamic password to generate plaintext , and then generate a random number SF according to the authentication parameters. At the same time, call out the user certificate stored on the network server side, compare the certificates at both ends, and compare whether the random number S and SF are identical to determine the identity of the user. The authentication parameters include: user Name or user ID, session key and timestamp, etc.

5. Establish an authentication protocol for identifying user identities in the authentication device on the client side,

(1) Using a symmetric encryption algorithm, the static password set by the user is used as part of the encryption key, and the other part of the encryption key is automatically generated by the authentication protocol. The two are combined into a complete set of encryption keys, and the user's certificate is encrypted and generated At the same time, encrypt part or all of the network authentication protocol to generate ciphertext, that is, the encrypted network authentication protocol, and store the user's certificate, the encrypted certificate, and the encrypted network authentication protocol in the authentication device.

(2) In the authentication protocol in the authentication device, set the static password as K1, K1 is composed of numbers or English letters between A ~ F, and the length is L1, L1 = 8 ~ 32 bits, and the authentication protocol further sets the L1 bit After the password changes from 1 to 4, L1=32~128bit.

(3) Another part of the encryption key automatically generated by the authentication protocol is set to K2, and its length is L2=80~128. K2 selects N1 from the user's "key seed" under the control of the time stamp and session key The group "key seed" is combined, and the two parts of the encryption key K1 and K2 are combined to generate a set of encryption key K3, which is used to encrypt the user certificate and encrypt and decrypt the network authentication protocol. Among them: the combination of K1 and K2 The method is: logical same or logical exclusive, and at the same time, the position where the two are combined is specified by the authentication protocol in the authentication device, and the length of the generated encryption key K3 is L2.

(4) Define the user's secret certificate as the authentication code of the authentication protocol in the authentication device, as a comparison parameter for the user to use the static password K1 to authenticate the authentication device, that is: another part automatically generated by the user's static password K1 and the authentication protocol Encryption key K2 together synthesizes a group of encryption key K3, encrypts the user's certificate with K3, generates the user's secret certificate, that is, the authentication code, and compares it with the user's secret certificate, that is, the authentication code stored in the authentication device, to realize the user's Identify the authentication device.

(5) After the user's static password is authenticated by the authentication device, the encryption key K3 generated by the static password is used to decrypt the encrypted network authentication protocol into plain text, that is, the network authentication protocol, and then call it to identify the network user; if the user If the static password fails to pass the authentication of the authentication device, the encryption key K3 generated by it cannot decrypt the encrypted network authentication protocol into correct plaintext, and the network authentication protocol cannot be called to identify the identity of the network user.

6. The user's static password is only used as part of the encryption key of the authentication protocol in the authentication device, not as the authentication comparison parameter in the two sets of authentication protocols. The user's static password is stored in the user's mind, and the user can change the static password. It can be modified at any time, and the user's static password is not stored in the authentication device and client, nor is it stored in the network server, and at the same time, it is not transmitted on the network.

7. The two authentication protocols stored in the authentication device on the client side include: the authentication protocol of the authentication device and the encrypted network authentication protocol. At the same time, it also stores the user name or user number, user certificate, user encryption Seed", as well as data such as time stamps and session keys that control the generation of the encryption key K2.

Description of drawings:

Figure 1: Authentication Protocol Flowchart for Authenticating Devices

Figure 2: Flow chart of user static password modification in the authentication protocol

Detailed ways:

The implementation steps of the method for preventing user passwords from being stolen are illustrated below in conjunction with the accompanying drawings:

Figure 1: Illustrates the authentication protocol process of the authentication device. First, after the user enters his static password to the authentication device, an encryption key is generated in the authentication device, and the encryption key is input into the symmetric encryption algorithm to encrypt the user's certificate to generate The encrypted certificate is: the authentication code, compare this set of authentication codes with the set of authentication codes pre-stored in the authentication device? If it is correct, the user's authentication of the authentication device is passed, and then use the generated encryption key to decrypt the encrypted network authentication protocol in the authentication device into plain text, that is, the network authentication protocol, and then call it to realize the network user identification, and It can be called repeatedly, and then shut down; if it is incorrect, it will prompt the user that the static password is wrong, please re-enter the static password or shut down.

Figure 2: Illustrates the process of the user modifying the user's static password in the authentication protocol. First, the user enters his current static password to the authentication device, and at the same time inputs the user's new static password, and repeats the new static password once, and compares the two in the authentication device. Are the new static passwords of the users entered last time the same? If not, re-enter the new static password twice or shut down; if the same, use the current static password to generate an encryption key, call the encryption algorithm to encrypt the user certificate to generate a secret certificate, that is, the authentication code, take it out and store it in the authentication device Another set of authentication codes for , are the two sets of authentication codes the same after comparison? If they are not the same, it will prompt that the current static password is wrong, re-enter the current static password or shut down, if the same, then call the encryption key generated by the current static password, decrypt the encrypted network authentication protocol to generate plaintext, that is, the network authentication protocol, and then use the The new static password generates a new encryption key, encrypts part or all of the network authentication protocol to generate ciphertext, that is: the new encrypted network authentication protocol, and replaces the original encrypted network authentication protocol, stores it in the authentication device, and then uses the new static password The generated encryption key encrypts the user certificate to generate a new encrypted certificate, that is, a new authentication code. The new authentication code replaces the original authentication code and is stored in the authentication device. At this point, the modification of the user's static password or shutdown can be repeated.

Claims (6)

1, adopting double verification protocol to prevent the method for user's pin from illegal use, is that utilization computer, network and cryptographic technique realize that implementation step is as follows:

In the authenticating device of client, deposit two groups of authentication protocols, one group is network authenticating protocol, one group is the authentication protocol of authenticating device, with static password as the part key, another part key is produced automatically by the authentication protocol of authenticating device, both are combined into the encryption key of symmetric encipherment algorithm, user certificate and network authenticating protocol are added, deciphering, reach to the identification of authenticating device with to the regulation and control of network authenticating protocol, simultaneously, also set up network authenticating protocol in network server end, corresponding with the network authenticating protocol of client, and adopt symmetry or rivest, shamir, adelman, generate the dynamic password of one time one change, realization is to the network user's identification, thereby, prevent user's pin from illegal use.

2, require described employing double verification protocol to prevent the method for user's pin from illegal use according to right 1, it is characterized in that:

(1) according to network authenticating protocol, the dynamic password that is generated one time one change by client-side automatically sends to the webserver, realizes network ID authentication;

(2), directly import static password by the user and realize identification authenticating device according to the authentication protocol of authenticating device.

3, require described employing double verification protocol to prevent the method for user's pin from illegal use according to right 1, it is characterized in that:

In the authentication protocol of authenticating device, user's static password is the part as key, a part of in addition key is produced automatically by the authentication protocol in the authenticating device, the encryption key of both synthetic symmetric encipherment algorithms, with this encryption key and symmetric encipherment algorithm, respectively user's certificate and part or all of network authenticating protocol are encrypted the generation ciphertext, prevent that user's static password is decrypted, prevent that also network authenticating protocol is stolen.

4, require described employing double verification protocol to prevent the method for user's pin from illegal use according to right 3, it is characterized in that:

Close certificate authentication authorization and accounting sign indicating number with the user, the reduced parameter of using static password that authenticating device is authenticated as the user, that is: another part encryption key that produces automatically with static password and authentication protocol synthesizes a set of encryption keys together, certificate to the user is encrypted, generate user's close certificate authentication authorization and accounting sign indicating number, with leave that user's close certificate authentication authorization and accounting sign indicating number compares in the authenticating device in, realize that the user discerns authenticating device.

5, require described employing double verification protocol to prevent the method for user's pin from illegal use according to right 3, it is characterized in that:

(1) fails authentication by authenticating device when user's static password, then can not call network authenticating protocol by force, because the network authenticating protocol that leaves in the authenticating device is a ciphertext;

(2) have only user's static password to pass through the authentication of authenticating device after, close network authenticating protocol could be decrypted into expressly, and call the identification that it carries out the network user.

6, require described employing double verification protocol to prevent the method for user's pin from illegal use according to right 3 and 4, it is characterized in that:

User's static password is not as the authentication reduced parameter in two groups of authentication protocols, user's static password is that memory is in user's brain, the user can make amendment at any time to its static password, user's static password does not leave in authenticating device and the client computer, do not leave in the webserver yet, simultaneously, also not in transmission over networks.

Images