Mobile commerce identity authentication method

Abstract

The invention provides a mobile commerce identity authentication method. In the method, key negotiation is realized by the most efficient elliptic curve-based public key cryptosystem in public key cryptosystems. An elliptic curve algorithm has the characteristics of low calculated amount and high safety, so the elliptic curve algorithm is used for generating a public key and a private key, and a public key cryptosystem without a third-party is realized and applied to the two-way authentication service of a client and a server.

Description

technical field [0001] The invention belongs to the technical field of mobile commerce information security, and in particular relates to a mobile commerce identity authentication method and system. Background technique [0002] According to the security issues considered by traditional e-commerce and the characteristics of mobile commerce itself, the security of mobile commerce needs to meet the security of the mobile terminal itself, the security of the wireless communication network, and the identity authentication and non-repudiation of both parties in the mobile commerce. These four security requirements all take identity authentication as the basis for realizing the security requirements. It can be seen that the status of the identity authentication system in the security system is extremely important, and it is the most basic security service, and other security services must depend on it. Once the identity authentication system is breached, all the security measures...

AI Technical Summary

Problems solved by technology

Most of the existing identity authentication systems use public-key cryptography, and the public-key cryptography is mostly based on large number calculations, resulting in a huge computational load for the entire authentication system. This is the main reason why traditional authentication protocols cannot be directly applied to the mobile business environment. reason

[0006] (3) A limited-length password sequence or hash chain needs to be registered repeatedly

And if the fixed-length hash chain value is calculated once at the mobile terminal, since the length N is usually a large integer, multiple hashes will affect the authentication efficiency of the mobile terminal

[0007] (4) The password sequence method is vulnerable to decimal attacks

[0008] (5) The computing load of the challenge / response method may not meet the computing power of the mobile terminal

The challenge / response method is mostly used in PC calculations in fixed networks, and the overly complex response algorithm is not suitable for mobile terminals

[0009] (6) The time synchronization scheme is not easy to implement in the mobile network

Since the construction and development of trusted third-party certification bodies for mobile commerce are still inferior to fixed networks, the cost of using timestamps to achieve synchronization in mobile networks is huge

[0010] (7) Most OTP methods do not support two-way authentication

Images