改进的基于RTT口令认证协议  

Novel password authentication protocol based on RTT

作　　者：何涛[1] 曹天杰[1,2] 翟朔[1] 

机构地区：[1]中国矿业大学计算机学院,江苏徐州221116 [2]东南大学移动通信国家重点实验室,江苏南京210096

出　　处：《计算机工程与设计》2011年第7期2233-2236,共4页Computer Engineering and Design

基　　金：江苏省自然科学基金项目(BK2007035);中国矿业大学科技基金项目(013080309);东南大学移动通信国家重点实验室开放研究基金项目(W200817)

摘　　要：传统的口令认证方案面临自动程序实施的在线字典攻击威胁,为了解决这个问题,Pinkas和Sander提出了一个基于RTT的口令认证协议,虽然该协议有很高的安全性,但是该协议存在已知函数攻击和缺少对恶意用户的惩罚措施的不足,针对以上不足,提出了一种新的改进方案。改进后的协议不公避免了原有协议的不足,且能更好地防止在线字典攻击。在.NET平台下编程实现了改进后的协议,实验结果表明,该协议有很好的可用性和可扩展性。The traditional password authentication protocol mainly face the online dictionary attacks, which is implemented by the auto-mated programs. To solve this problem, a RTT-based password authentication protocol is proposed, which had good security, analysis found that the protocol had shortcomings： Existing attack of known function and the lack of punitive measures against malicious users, in order to overcome the shortcomings, the paper proposes a novel scheme. The novel protocol avoids the shortcomings ofthe original protocol, so it is better to prevent online dictionary attacks. Finally, programming implements the improved protocol under the .Net platform, experiment shows that the novel protocol has good availability and scalability.

关 键 词：在线字典攻击 逆向图灵测试 口令认证 判定函数 图形验证码 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]