两个基于智能卡口令认证方案的改进  

IMPROVING TWO SMARTCARD-BASED PASSWORD AUTHENTICATION SCHEMES

作　　者：赵广强[1] 凌捷[1] 

机构地区：[1]广东工业大学计算机学院,广东广州510006

出　　处：《计算机应用与软件》2015年第5期278-282,共5页Computer Applications and Software

基　　金：广东省战略性新兴产业核心技术攻关项目(2012A010701004);广东省自然科学基金重点项目(S2012020011071);广东省教育部产学研合作项目(2012B091000037;2012B091000041)

摘　　要：对两个基于智能卡的口令认证方案的安全性进行分析。发现除了薛锋等人针对这两个方案指出的安全性缺陷外,其中一认证方案在口令更改阶段也存在设计缺陷。同时,两个方案都不能抵御劫取连接攻击。在以上基础上,分别对两个方案进行了改进,改进后的方案分别采取散列函数和双线性对计算来抵御劫取连接攻击,同时克服了协议中存在的安全性问题。通过理论分析证明可以有效地抵御Do S攻击、DDo S攻击、内部攻击和离线猜测攻击。提高了原方案的安全性。We analyse the security of two smartcard-based password authentication schemes. Apart from the security defect pointed out by Xue Feng et al. on them two, we root out that one of the authentication schemes also has the design defect in password change phase. Moreover, both schemes cannot resist the attacks of jacking connection. On the basis of the above, we improve them separately, the improved schemes use the hash function computation and the bilinear pairing computation respectively to withstand the jacking connection attack, and at the same time they also overcome the security problem in protocols. It is proved through theoretical analysis that the effective resistance on DoS attack, DDoS attack, insider attack and off-line guessing attack can be achieved. The security of original schemes is improved as well.

关 键 词：智能卡 口令认证 劫取连接攻击 双线性对 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]