基于公钥算法的短信动态口令研究

发布时间：2018-05-09 02:23

本文选题：动态口令 + 短信　；参考：《吉林大学》2017年硕士论文

【摘要】：保障信息安全是促进互联网正常发展的重要组成部分,在移动互联网高速发展的今天,信息安全显得尤为重要,它关乎我们每个人的隐私、财产和数据安全。作为使用互联网服务的第一扇大门,身份认证在信息安全中有至关重要的作用。使用静态密码认证的传统方式有较大的安全问题,我们需要一个更为安全的认证方案。尽管在身份认证方面,已经有了较为成熟的认证体系PKI,但是它需要事先对活动的所有参与方进行身份认证,网络服务的多样性、建立CA需要大量资源以及需要频繁传递证书导致这种方式并不适合在移动互联网上进行身份认证。伴随着智能手机的普及以及其功能的愈加强大,越来越多的互联网服务开始使用短信验证码验证用户的身份。相对于使用静态密码验证而言,短信验证码属于动态口令认证,在一定程度上提升了认证的安全性。但是安全问题依然存在——伪基站、钓鱼攻击和手机木马等危害用户安全的事件层出不穷。对短信动态口令的威胁主要体现在通信线路的安全、第三方安全和终端设备的安全,如果不能消除这些威胁很容易造成用户的损失。硬件的发展使得智能手机有更大的存储能力和计算能力,让我们能在移动终端上进行更为复杂的运算,使得短信动态口令能提供更高的安全性。论文首先分析了短信动态口令在认证中的优势以及面临的威胁,接着介绍了在论文方案中需要用到的理论知识,然后研究了使用手机实现动态口令的主要方案以及保证短信保密性的主要解决办法。最后提出了基于公钥算法的短信动态口令方案来加强认证的安全性。通过在用户端和服务器端共享参数,来实现服务器和用户之间的双向鉴别。该方式使用了认证因素中的“用户知道什么”。然后用公钥算法对短信动态口令进行加密来增强短信动态口令的安全性。短信动态口令使用了认证因素中的“用户有什么”。两种认证因素结合使用极大的提升了认证系统的安全性。在实现服务器和用户之间的双向鉴别时,改进并使用了基于时间和基于事件的同步算法。论文提出的方案能够让我们便捷安全的使用短信动态口令,能够保证消息的保密性和完整性,同时可以实现服务器和用户之间的双向认证,抵御钓鱼攻击和重放攻击,具有不可抵赖性。为网络提供安全性保障,促进互联网的健康发展。
[Abstract]:Information security is an important part of promoting the normal development of the Internet. Today, with the rapid development of mobile Internet, information security is particularly important. It relates to the privacy, property and data security of every one of us. As the first door to use Internet services, identity authentication plays an important role in information security. The traditional way of using static password authentication has great security problems, we need a more secure authentication scheme. Although there is a mature authentication system, PKI, it needs to authenticate all the participants in the activities in advance, and the diversity of network services. Setting up a CA requires a lot of resources and the need to transfer certificates frequently, so this method is not suitable for authentication on the mobile Internet. With the popularity of smart phones and their increasingly powerful functions, more and more Internet services begin to use short message verification code to verify the identity of users. Compared with using static password authentication, short message verification code belongs to dynamic password authentication, which improves the security of authentication to a certain extent. But security problems still exist-pseudo-base stations, phishing attacks and mobile phone Trojans and other incidents endangering users' security emerge in endlessly. The threats to SMS dynamic password are mainly reflected in the security of communication line, the security of third party and the security of terminal equipment. If these threats can not be eliminated, it is easy to cause the loss of users. With the development of hardware, the smart phone has more storage and computing power, so that we can perform more complex operations on the mobile terminal, so that the SMS dynamic password can provide higher security. This paper first analyzes the advantages and threats of SMS dynamic password in authentication, and then introduces the theoretical knowledge needed in the thesis. Then the main scheme of using mobile phone to realize dynamic password and the main solution to ensure the confidentiality of SMS are studied. Finally, a short message dynamic password scheme based on public key algorithm is proposed to enhance the security of authentication. The bidirectional authentication between the server and the user is realized by sharing the parameters between the client and the server. This approach uses "what does the user know" in the authentication factor. Then encryption of SMS dynamic password with public key algorithm is used to enhance the security of SMS dynamic password. SMS dynamic password uses "what does the user have" in the authentication factor. The combination of two authentication factors greatly improves the security of the authentication system. In order to realize the bidirectional authentication between server and user, the synchronization algorithm based on time and event is improved and used. The scheme proposed in this paper can make us use SMS dynamic password conveniently and safely, guarantee the confidentiality and integrity of the message, realize the two-way authentication between the server and the user, and resist the phishing attack and replay attack. Nonrepudiation. To provide security for the network, to promote the healthy development of the Internet.
【学位授予单位】：吉林大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309

【相似文献】