动态口令认证方案的研究与改进  

Study and amend dynamic password authentication scheme

作　　者：王滨[1] 刘刚[1] 

机构地区：[1]信息工程大学电子技术学院

出　　处：《计算机工程与设计》2007年第12期2806-2808,共3页Computer Engineering and Design

摘　　要：研究了动态口令技术,分析了文献[1]中的一个可抵御劫取连接攻击的新的动态口令认证方案,原方案中由于对关键信息//的保护不够,尽管方案中的口令是动态的,但实际上原方案不能抵抗冒充服务器攻击。利用Diffie-Hellman密钥交换算法对原方案进行了修改,修改后的方案克服了原方案存在的安全漏洞,保留了原方案的所有安全特性,具有更高的安全性,并且降低了计算量。By studying the dynamic password authentication scheme and analyzing the new dynamic password authentication scheme which can resist jacking connection attack mentioned in Ref. [1 ], the way which protects the key information g^PIN/PW is not good enough, although the password in this scheme is dynamic, this scheme can not resist the imitate server attack. To solve those problems, a improved scheme is proposed using Diffie-Hellman key exchange algorithm, the new scheme not only can conquer the security problem of the original scheme but also holds all security characteristics of the original scheme. So the computational complexity is decreased greatly, and the security characteristics is increased.

关 键 词：冒充服务器攻击 动态口令认证 密码协议 劫取连接攻击 Diffie-Hellman密钥交换算法 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]