一次性口令认证系统的研究  

Research on One-Time Password Authentication System

作　　者：张丽[1] 毕于深[2] 黄璐[3] 

机构地区：[1]沈阳化工学院计算机科学与技术学院,辽宁沈阳110142 [2]辽宁石油化工大学成人教育学院,辽宁抚顺113001 [3]大连水产学院信息工程学院,辽宁大连116023

出　　处：《辽宁石油化工大学学报》2007年第4期68-70,共3页Journal of Liaoning Petrochemical University

摘　　要：在传统的口令认证机制中,用户的口令多数以明文形式在网上传输并且固定不变。这使得攻击者可以通过窃听得到这些可重用的口令达到入侵系统的目的。一次性口令系统允许用户每次登录时使用不同的口令,很好地防止了口令重用攻击,增强了系统的安全性。介绍了S/key一次性口令认证系统,指出了S/key系统的安全漏洞,提出了一种增强型的一次性口令认证方案SOTP,并分析了新认证系统的安全性。In the traditional password authentication system, user＇s passwords are mostly transmitted through the Internet in the way of plaintext and keep constant, resulting in that attackers can get reusable passwords through wiretapping and invade the system. One-time password system lets users log in using different passwords every time, which can prevent effectively the attack of password reuse and enhance the security of system. The one-time password authentication system of S/key was introduced, and the security vulnerability of system was descrided. A one-time authentication scheme of strengthened SOTP was presented and the security of the new authentication system was analyzed.

关 键 词：身份认证 一次性口令 S/KEY 小数攻击 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]