基于动态口令的增强身份认证  

Enhanced authentication with one-time password

作　　者：章思宇[1] 黄保青[1] 白雪松[1] 姜开达[1] 

机构地区：[1]上海交通大学网络信息中心,上海200240

出　　处：《华东师范大学学报（自然科学版）》2015年第B03期246-251,共6页Journal of East China Normal University(Natural Science)

摘　　要：传统基于口令的身份认证易受弱口令、暴力猜解和重放的攻击.基于动态口令的增强身份认证系统通过多因子认证,在静态口令泄漏后依然能提供账户安全保护.基于开放标准OATH-TOTP构建的动态口令认证系统与统一身份认证集成,支持硬件令牌和手机软件令牌,并通过定制的RADIUS服务器提供静态和动态口令组合输入验证.独立的应用密码为Email等应用客户端提供向后兼容,防止动态口令绕过,并避免明文协议泄露单点登录口令.该系统能有效提高统一身份认证系统及各应用系统的安全性.Traditional password-based authentication is vulnerable to weak password,brute force and replay attacks.Enhanced multi-factor authentication（MFA）with one-time password（OTP）provides protection even after the password is compromised.Our OTP authentication system uses OATHTOTP,an open standard,and is well integrated with web-based SSO.Both hardware and software tokens on mobile phones are supported,and a modified RADIUS server implementation is built to support concatenated password and OTP.Separate application passwords are designed for backward compatibility with client software（e.g.email clients）,avoiding MFA bypasses or password sniffing on clear-text network traffic.Our OTP-based authentication system significantly enhanced the security level of SSO and related information systems.

关 键 词：动态口令 身份认证 多因子认证 令牌 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]