WO2006002586A1

WO2006002586A1 - A verification mode of the interactive dynamic key instructed by integrating a formula key with graphics

Info

Publication number: WO2006002586A1
Application number: PCT/CN2005/000825
Authority: WO
Inventors: Zichen Tan
Original assignee: Zichen Tan
Priority date: 2004-07-01
Filing date: 2005-06-09
Publication date: 2006-01-12
Also published as: CN1716852B; CN1716852A

Abstract

A verification mode of the interactive dynamic key instructed by integrating a formula key with graphics is characterised in: calculating and obtaining a dynamic and irregular key by the formula key. After user has predetermined a formula key, a random coded tam e and/or a random prompting symbol is transmitted to user whenever user lands the verification system, and user applies the predetermined formula key and calculates and inputs the result according to the prompting symbol and the coded table. After randomly generating a prompting symbol and a coded tame, the verification system transforms the prompting symbol and the coded tame to a picture format and appropriately distorts it. The verification mode of the interactive dynamic key instructed by integrating a formula key with graphics runs according to flows. Among the input mode of the key, user can select keyboard input and conveniently and quickly directly clicking by mouse in the coded table of screen. This invention uses the above-mentioned technique , thereby entirely abandons any outside key generation device, creatively solves the problem puzzling stand-alone, network, the Internet user and the interrelated site in a long term.

Description

Interactive dynamic password verification mode with formula password combined with graphical prompt

Technical field

The invention relates to an interactive dynamic password verification mode combining a formula password and a graphic prompt. Background technique

In the field of Internet security technology, "account + static character password" is the most basic authentication mode commonly used today, from logging in to the Microsoft Windows 2003 Server; from logging in to the online banking.

The above model has played an effective role in the cooperation of safety knowledge education for a long time. However, as time goes by, the need for X-inch to address the many irreparable vulnerabilities in this model has become even more urgent.

The education of safety knowledge is very important, but it is also fatal because it violates the principle that the security system "7l is far from relying on the trust of natural persons". In other words, the more extensive the content of "education", the stronger the dependence on "natural people" and the greater the potential safety hazards. .

The facts also confirm this:

Although computer and network security education users should not use their own birthday, name and other characters that are easily guessed as their own code, but for the convenience of memory, many users will still use their familiar characters as their own password. The use of such low-quality passwords provides opportunities for such things as "Lenovo password cracking" and "dictionary password cracking".

Although computer and network security knowledge also educates users to change passwords frequently, in fact, most users rarely do this to avoid trouble. As a result, this static password provides an opportunity for such means as "violent password breaking".

Although computer and network security knowledge teaches users not to log in to sensitive websites on untrusted computers, this advice cannot be strictly enforced by all users. So, once you land on an untrusted computer, spyware such as keyboard monitoring can easily capture passwords.

In addition, because Internet communications use public lines, coupled with the gradual popularity of wireless networks, these are also possible for passwords to be intercepted midway.

In fact, "username + static character password" is now embattled...

There is no doubt that as long as the password is static, it can theoretically be cracked. For a long time, we have to rely on Depending on the quality of the password (ie increasing the length and complexity of the password) to delay the time the password is cracked, this method of boiling will surely encounter bottlenecks due to the physiological limits of human memory. On the other hand, the speed of computer cracking is theoretically unlimited. With the rapid advancement of computer computing speed, passwords that used to take 100 years to crack are now in one year. If you use 365 computers to crack together, you can reduce the crack time to only one day - no doubt The balance of human memory against the speed of computer cracking will slowly retreat in a dangerous direction.

As mentioned above, static character passwords are extremely insecure. There are three ways to improve this insecurity: 1. Increase the length of the password; 2. Increase the complexity of the password; 3. Increase the frequency of password update. Unfortunately, all three practices are limited by user habits and physical abilities, which requires us to develop a new mechanism to address this limitation.

On the other hand, we also see that even if the quality of the password is improved, the password is still intercepted. But like the intelligence warfare in the Second World War, it is not terrible if the secret electricity is intercepted by the enemy. Because any secret electricity needs to be decrypted through a confidential decryption process. Similarly, when our passwords are more easily intercepted by others, this also requires us to create a new model to improve the anti-hacking ability when the password is intercepted.

In the face of all the embarrassing situations and new requirements of the above static passwords, people naturally associate with "dynamic passwords". It is true that the so-called "dynamic passwords" are not new topics, and there are a considerable number of such products on the market. However, all of these prior art and products rely on an external password generation device to generate random passwords (eg, dynamic password cards, dynamic password receivers, and even cell phone text messages). For the user, the memory that needs to be remembered and used is still static characters, so this mode is still an extension of the "character password", but only a specified static character is changed to another specified static character when verifying. The mind does not actually jump out of the "character password" mode box. 'The drawbacks of the prior art will severely limit the security of computers and networks tomorrow. This "restriction" is not from the technology itself, but from the stagnation of ideas. Just like snoring is not only dependent on equipment, but also on warfare. Today's computer security technology has evolved very quickly. However, as a general user of the general public, its application mode was forced to stay in the cold weapon period of the "character code" in the 1980s, which is undoubtedly the biggest bottleneck of ours today.

After analyzing the memory physiology of humans, we can find that: After simply visiting the supermarket, the customer may not be able to remember the price of all the goods of interest, but can easily recall the location of the goods. This is because human strength lies in logical thinking, not memory. For humans, usually the rules of memory logic will be better than Recalling hard characters is easier. In fact, we are also using memory rules to remember most things around us.

For example: Remember the inventor's mobile number: "13809237751", usually not through rote memorization, but through skill. "1380" is the starting number given by the telecommunications company. "9" requires memory, "23" is the serial number, "775" is the year of birth of the inventor, and "1" repeats the first digit.

For another example, we forget something on a daily basis, but we can "think" with a little hint. This is because we put the "tips" into the rules we remember in our minds, so we get the result of our "thinking". All of these examples illustrate the nature of human beings who are good at memorizing rules and not hard data characters.

Since human beings are physiologically good at memorizing rules. Therefore, the inventors have proposed the following inventive concept of "character code", that is, "former password" 3⁄4 generation "character code". The content of the present invention

The object of the present invention is to provide a new mode of a stand-alone, network, or Internet security application field that does not rely on external password generating devices to generate random passwords, that is, an interactive dynamic password verification mode in which a formula password is combined with a graphical prompt. In fact, the inventors of the present invention pioneered and applied the concept of replacing "character ciphers" with "formula ciphers".

The above object of the present invention is achieved by the following technical solutions:

The interactive dynamic password verification mode of the formula password combined with the graphical prompt is characterized by:

The modes include:

A. The user remembers the "formula password" instead of the "character password";

B. Use and production of "interactive" robbery passwords;

C. Generate a dynamic password by nesting the "random prompt" and / or "random code table" into the "formula password";

D. Use a distorted picture instead of a character to pass the prompt and / or code table;

E. Combine "formula password" with "graphic hint".

According to the present invention, the user presets the formula password; the verification verifier will randomly generate a string of prompts and/or a code list, and calculate the expected password according to the user preset password; the checker will prompt and/or encode The table is sent to the user in a graphical format; after receiving the above prompt, the user sets the password into the personal preset formula to obtain the password, and enters; the verifier corrects the user's input password and the expected password and decides whether to accept the login.

Calculate the cloud by formula password: 3⁄4 state, and irregular password, its operation mode is: After the user presets the formula password, each login verification system will be sent a random code list and / or a string of random The prompt, and the user needs to use the preset formula password according to the prompt and / or code table to calculate the result and enter.

The password is verbose or short.

The "encoding table" and the "prompt" will be transmitted to the user in a graphical format each time, that is, each time the verification system randomly generates a prompt and/or a codelist, a character prompt will be displayed. And the encoding table becomes the image format, and is appropriately deformed.

The interactive dynamic password verification mode of the formula password combined with the graphic prompt runs according to the following process: a. The verification system locks the user account and randomly generates the coding table and/or prompt;

b. The verification system calculates a corresponding expected password according to the code table and/or the prompt and the preset formula password of the user;

c. The verification system converts the above code table and / or prompt into an image format, and will be moderately deformed or complicated;

The verification system sends the above picture encrypted to the client;

e. The user obtains the password according to the code table and/or prompt, combined with the preset formula password, and inputs;

The client transmits the user input password to the verification system for verification.

g. The verification system checks the received password against the expected password;

h. If it is, pass the authentication; if it does not, it will refuse to log in.

The "formula" in the "formula password" can be versatile, it can be a calculation of the prompt, or it can be

The combination of the indicators can be the value of the feature around the prompt (such as the date), can be an empty city meter (no rules only use static passwords), can also be other types of "rules", or for various rules The combination used.

In the password input mode, the user can choose to input through the keyboard, or directly and quickly click on the input on the coding table of the screen through the mouse.

Since the present invention adopts the above technical solution, it completely abandons any external password generating device, and creatively solves the problem that has long plagued a single machine, a network, the Internet, and related websites.

The present invention is a dynamic password generation and verification mode that does not require any external device participation at all. Compared with the prior art, the essential difference is: "Formula password" completely deviates from the original "character password" concept. For the user, after using the formula password system, the user wants to memorize and use the "character" which is no longer a hard one, but "algorithm" and "rule".

Simply put, the difference between the two is like the difference between "word" and "grammar". One is by random The dictionary is used to draw words to form different "static"sentences; the other is to abandon the dependence on the dictionary, constructing and combining real "dynamic" sentences everywhere through grammatical rules.

So far, 'the invention has not been proposed by others in any form of media, and is a new technology in the field of security.

The present invention has been designed based on the premise of high practicality. It can be used for stand-alone authentication, LAN authentication, Internet authentication, and even password verification for ATM ATMs. Overall, this mode can be a replacement and enhancement to all "static character password" modes.

All the techniques and operations involved in implementing the "Interactive Dynamic Password Verification Mode" are virtually workable. The current verification system can replace the old "static character password" mode with this mode without significantly increasing the additional investment. At the same time, ordinary users can also increase the additional purchase without increasing the physiological memory load. Benefit from this model.

The important practical significance of the present invention is reflected in its proactive nature.

The invention is not just a "commodity" but a "guidance model". As with the invention of the "www" URL pattern and the "@" email model, the invention of this guiding model is urgently needed in the future, but the need for this guiding model is urgent. Any related improvements cannot exceed the essence of the basic idea of the present invention.

Undoubtedly, the present invention has the following advantages:

1) Create a dynamic password with "Formula Password". Even if the password entered by the user is intercepted or intercepted, the listener/catcher cannot know what the next password is.

2) Since the encoded password is dynamic and random, it will be difficult for the attacker to achieve its intended purpose regardless of whether the attacker uses the brute force password or the association password cracking method.

3) With the "Formula Password" mode, users only need to remember simple rules to create lengthy and complex high-quality passwords, with less effort. . ―

4) Simultaneous use of the prompt and coding table can multiply the diversity of the password without significantly increasing the difficulty of the user. 'It is more difficult to capture the law.

5) Combining the "formula password" with a random "picture hint" mode will make the security performance even stronger. Because the randomly blurred picture characters are used as the prompting tool, even if the prompt picture is completely intercepted by the attacker, the attacker's calculation

It is also difficult for the computer to analyze the picture content, and it is even more difficult to analyze the formula password. The speed of manual analysis is far from being able to seriously harm security. ' 6) Avoid relying on any form of password-generating equipment from outside, and avoid potential hidden dangers such as theft, looting, destruction, loss, failure, etc. of such equipment.

The concept of "interactive dynamic password" is a bold subversion of the existing "static character password" mode, and it is also a relief from the existing need to rely on external devices to produce dynamic passwords. As the applicant has stated in the background art, the existing "username + static character password" mode has many terminally flawed defects, and over time, one day it will die. The "interactive dynamic password" generated by "combination of formula passwords combined with graphical prompts" can effectively reduce the memory of users and avoid the dependence on external devices. Replacing a "static password" with a "formula password" can greatly improve security and crack resistance; it can significantly enhance the anti-analysis capability once the information/password is intercepted.

Compared with the existing technology, the "analog dynamic password verification mode of formula password combined with graphic prompt" can be used under the premise of preserving the convenience of the original traditional character password verification mode (ie, all-weather use everywhere, without any external assistance). Make revolutionary progress. detailed description

The present invention is described in detail below in conjunction with specific embodiments.

An interactive dynamic password verification mode in which a formula password is combined with a graphical prompt, characterized in that: the mode includes:

B. Use and production of "interactive" dynamic passwords;

E. Combine "formula password" with "graphical hints".

According to the present invention, the user presets the formula password; the verification party randomly generates a string of prompts and/or a code list and calculates the expected password; the checker sends the prompt and/or the code table in a graphic format. To the user; after receiving the above prompt, the user puts the formula into the personal preset formula to obtain the password, and enters; the verifier corrects the user's password and the expected password and decides whether to accept the login.

The password is verbose or short, and relatively verbose is preferred.

The "encoding table" and the "prompt" will be transmitted to the user in a graphical format each time, that is, each time the verification system randomly generates a prompt and a coding table, the character prompt and encoding will be performed. The table becomes the image format and is appropriately deformed. The interactive dynamic password verification mode of the formula password combined with the graphic prompt runs according to the following process: a. The verification system locks the user account and randomly generates the coding table and/or prompt;

c The verification system converts the above code table and / or prompt into image format, and will be moderately deformed or complicated;

d. The verification system sends the above picture encrypted to the client;

e. The user obtains the password according to the coding table and/or prompt, combined with the preset formula password, and inputs; f. The user end encrypts the user input password and transmits it to the verification system for verification;

h. If it is, pass the authentication; if it does not, it will refuse to log in.

The "formula" in the "formula password" can be versatile, it can be a calculation of the prompt, a combination of the prompts, or a value of the surrounding features (such as a date). It can be an empty city meter (no rules only use static passwords), other types of "rules", or a combination of various rules.

For added security, the "encoding table" and "prompt" described above will be delivered to the user in a graphical format. That is, each time the verification system randomly generates the prompt and the encoding table, the character prompt and the encoding table are changed to the image format, and the appropriate deformation processing is performed.

For example, a user presets a "formula password" as follows - (#1) (#1) (T) (9) (#4+1) (#date)

Its meaning is:

Suppose the user receives the following graphical prompt, and the date of the day is June 18th.

GD 4 9 Through the calculation/combination of the above rules, the following results can be obtained:

G G T 9 0 1 8

Suppose the user also receives the following code table:

Then, the password that the user needs to submit the verification at this time should be changed according to the corresponding relationship in the above table:

N e N e 7 q 7 q. I D E I Z c It is obvious that a 14-bit high quality password can be obtained simply by an uncomplicated rule. Similarly, users can also preset more complex combined computing relationships for a more secure login. E.g-

(#1) (#4) (#3+2) (#3+3) (#2) (#date * 2) (#date +2) (P) (e) (t) This will be a Dynamic passwords of up to about 20 characters, mixed with repetition, addition, multiplication, date, positioning, static characters, etc., almost no possibility of being cracked.

At the same time, the user can also preset a simple formula password. E.g:

(1) (2) (#1) (#2)

According to the above code table and prompt, you can quickly get the password corresponding to this formula password should be -

I 1 4 N e 2 Y

Although the original formula password is extremely simple, the generated password has a higher quality. Moreover, since the password is dynamically changed in each login, it is still quite difficult to capture or crack it.

In the password input mode, the user can choose to type through the keyboard, or directly and quickly click on the input on the coding table of the screen through the mouse.

Note: The above example uses the more complicated approach of "formula password" combined with "prompt" and "code table". Users can also use a simpler way to combine "formula passwords" with "prompts" or combine common "character passwords" with "programs" to get lower quality dynamic passwords. .

Claims

Rights request

1. The interactive password-based dynamic password verification mode of the formula password combined with the graphic prompt is characterized by:

The modes include:

A. Remembered by the user. "Formula password";

B. Use and production of "interactive" dynamic passwords;

E. Combine "formula password" with "graphical hints".

2. The interactive dynamic password verification mode of the formula password combined with the graphic prompt according to claim 1, wherein: the user presets the formula password; the verification party randomly generates a prompt and/or an encoding during verification. Table, and calculate the expected password; the verifier sends the prompt and/or the code table to the user in a graphical format; after receiving the above prompt, the user puts the formula into the personal preset formula to obtain the password, and inputs; The verifier corrects the user's password and expects the password and decides whether to accept the login. .

3. The interactive dynamic cryptographic check mode of the formula cipher combined with the graphical cues according to claim 1, wherein: the password can be verbose or short.

4. The interactive dynamic password verification mode of the formula password combined with the graphic prompt according to claim 1, wherein: the "encoding table" and the "prompt" are transmitted in a graphic format each time. User, 艮卩, each time the verification system randomly generates a prompt and/or codelist, the character prompt and the encoding table are changed to the image format. ~

5. The interactive dynamic password verification mode of the formula password combined with the graphic prompt according to claim 1, wherein each time the verification system randomly generates a prompt and/or a code table, a character prompt is displayed. And the encoding table becomes the image format, and is appropriately deformed.

6. The interactive dynamic password verification mode according to claim 1, wherein the formula password combined with the graphical prompt interactive dynamic password verification mode is operated according to the following process: verifying system locking The code table and the prompt are randomly generated after the user account;

The verification system calculates a corresponding expected password according to the code table and/or the prompt and the formula password preset by the user;

The verification system converts the above code table and/or prompt into a picture format and will make a moderate deformation or complication Reason

The verification system sends the above picture encrypted to the client;

The user obtains the password according to the coding table and/or prompt, combined with the preset formula password, and inputs; 'The client encrypts the user input password and transmits it to the verification system to request verification;

The verification system checks the received password against the expected password;

If it is, pass the authentication; if it does not, it will refuse to log in.

7. The interactive dynamic password verification mode of the formula password combined with the graphic prompt according to claim 1, wherein: the "formula" in the "formula password" can be diverse, and it can be a prompt. The calculation can be a combination of the prompts, the value of the features around the prompt (such as the date), the empty city meter (without rules, only static passwords), or other types of "rules". Or use a combination of various rules.

8. The interactive dynamic password verification mode of the formula password combined with the graphic prompt according to claim 1, wherein: in the password input mode, the user can select the keyboard input, or the mouse can be conveniently and quickly displayed on the screen. Click on the input directly on the code list. '