提出了一个新型的基于生物特征和口令的双因子认证与密钥协商协议.该双因子协议利用用户的生物特征以及口令信息实现安全通信,用户不需要携带智能卡.利用模糊提取技术,服务器不再保存用户生物信息,避免了服务器被攻陷用户敏感信息丢失的风险.通过服务器的公钥保护用户的认证信息,避免了基于口令的认证协议可能遭受的离线字典攻击.基于椭圆曲线计算性Diffie-Hellman假设,在随机预言模型下证明了协议的安全性.性能分析表明,所提出的协议具有较高的安全属性.%A new two-factor authenticated key agreement protocol based on biometric feature and password was pro-posed. The protocol took advantages of the user's biological information and password to achieve the secure communica-tion without bringing the smart card. The biometric feature was not stored in the server by using the fuzzy extractor tech-nique, so the sensitive information of the user cannot be leaked when the server was corrupted. The authentication mes-sages of the user were protected by the server's public key, so the protocol can resist the off-line dictionary attack which often appears in the authentication protocols based on password. The security of the proposed protocol was given in the random oracle model provided the elliptic computational Diffie-Hellman assumption holds. The performance analysis shows the proposed protocol has better security.
展开▼
