一种在密码验证系统中保持用户匿名的方案  

A Scheme of Keeping User Anonymity in Password Authentication System

作　　者：陈金木[1] CHEN Jinmu(Xiamen Ocean Vocational College,Xiamen 361102,China)

机构地区：[1]厦门海洋职业技术学院,福建厦门361102

出　　处：《现代信息科技》2022年第2期107-110,共4页Modern Information Technology

摘　　要：通过采用一种基于密码的匿名验证系统,探讨了在匿名验证系统中针对第三方攻击者的用户匿名性的有效性。首先,在验证系统方案中展示了第三方攻击者可以指定哪个用户实际向服务器发送了访问请求,第三方攻击者可以根据此次攻击来链接到同一用户稍后发送的不同登录请求。其次,给出了一种有效的对抗这种攻击的方法,该方法因不需要存储用户的密码保护凭证,能更有效地保证用户访问的匿名性。By adopting an anonymous authentication system based on password,this paper discusses the effectiveness of user anonymity against third-party attackers in the anonymous authentication system.Firstly,the authentication system scheme shows that the third-party attacker can specify which user actually sent an access request to the server.The third-party attacker can link to different login requests sent by the same user later according to this attack.Secondly,an effective method against this attack is given.This method can more effectively ensure the anonymity of user access because it does not need to store the user’s password protection credentials.

关 键 词：用户匿名 密码 用户验证 密码凭证 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]