基于安全芯片的远程认证系统的研究

发布时间：2018-06-17 06:38

本文选题：USBKey + 身份认证　；参考：《西安电子科技大学》2015年硕士论文

【摘要】：随着互联网和电子商务的蓬勃发展,网络信息安全显得愈发重要。在“互联网+”的大背景下,人们的衣食住行都会发生在网上。在如此大背景下,信息安全问题引起了人们的高度关注。在高速信息化的现代化社会里面,不管国家的经济或者是军事都与互联网扯上了千丝万缕的关系。因此信息安全问题已经成为影响国家安全、经济发展和社会稳定的关键因素。身份认证系统是整个系统安全的大门,一个被攻破的认证系统内部所有信息也将不会处于安全的境地。因此,整个网络系统的第一道关卡无疑就是身份认证。本文的重点是通过构造新的USBKey认证模式,设计出一套安全的身份认证方案。本文在传统USBKey认证方案的基础上,结合当下流行的互联网,改进了USBKey的工作模式,主要做了如下的工作:本文通过对安全芯片A980的深入研究,利用A980芯片作为USBKey的内置芯片,结合USB通信,设计了一套基于A980的远程认证系统,实现技术方面客户端采用C、C#、java和JSP技术实现,服务器端采用Java和MySql技术。认证协议方面该系统采用了更加安全的认证机制:采用基于改进的挑战响应模式,基于静态口令和动态口令相结合,软件认证和硬件认证相结合,RSA和Hash函数相结合的认证方式。本文提出的方案提高了传统USBKey的安全性,在两种传统的USBKey认证模式的基础上,提出了一种新的认证模式。采用RSA加密代替传统的哈希算法,采用随机字串代替时间戳,这种模式是基于传统的挑战响应模式和数字证书模式改进的算法。在本方案中,即使用户丢失了USBKey,攻击者读取到里面的密钥(这种概率很小)并破解成功,也无法应用这个设备认证成功。因为本方案中的USBKey除了依靠PIN码进行保护外,还有一套和相应设备绑定的安全认证软件,软件内部包含了一个序列号,也是服务器端验证的重要条件之一,所以一个成功的认证必须具备USBKey、PIN和相应的认证软件。这三个必备条件的载体是不同的,攻击者想要同时获取三个条件基本是不可能的。
[Abstract]:With the vigorous development of internet and e-commerce, network information security becomes more and more important. In the context of the Internet, people's food, clothing, housing and transportation will occur on the Internet. Under such a background, the information security problem has aroused people's high attention. In the modern society of high-speed information, no matter the national economy or military, it is closely related to the Internet. Therefore, information security has become a key factor affecting national security, economic development and social stability. Identity authentication system is the gateway to the security of the whole system, and all the information inside a compromised authentication system will not be in a secure situation. Therefore, the first level of the entire network system is undoubtedly identity authentication. The emphasis of this paper is to design a secure authentication scheme by constructing a new USBKey authentication model. Based on the traditional USBKey authentication scheme and the current popular Internet, this paper improves the working mode of USBKey. The main work is as follows: this paper uses A980 chip as the embedded chip of USBKey through the in-depth study of the security chip A980. Combined with USB communication, a remote authentication system based on A980 is designed. The client side of the client is implemented with CSC#Java and JSP technology, and the server side with Java and MySQL technology. In terms of authentication protocol, the system adopts more secure authentication mechanism: based on improved challenge response mode, based on static password and dynamic password, software authentication and hardware authentication combined with RSA and Hash function. The scheme proposed in this paper improves the security of traditional USBKey, and proposes a new authentication mode based on two traditional USBKey authentication modes. RSA encryption is used to replace the traditional hash algorithm and random string to replace the time stamp. This model is based on the traditional challenge response mode and digital certificate mode. In this scheme, even if the user loses the USBKey, the attacker can not apply the device authentication successfully if he reads the key (this probability is very small) and successfully decrypts. Because USBKey in this scheme not only relies on PIN code for protection, but also has a set of security authentication software bound to the corresponding equipment, the software contains a serial number, which is also one of the important conditions of server side authentication. Therefore, a successful certification must have USB KeyPIN and the corresponding certification software. The carriers of these three prerequisites are different, and it is impossible for an attacker to obtain three conditions at the same time.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP393.08

【相似文献】