Site password generation method, system and password manager

Abstract

The present invention provides a site password generation method, system and password manager, wherein the site password generation method includes: step 1) constructing first incentive data according to information including a user password; wherein the user password is used by the user in the application Log in the user account on the client of the program, the first incentive data is a binary string; step 2) input the first incentive data into the PUF and obtain the corresponding first response data from the PUF; wherein, the first A response data is a binary string; and, step 3) converting the first response data into a site password. The password generation method, system and password manager provided by the invention can resist off-line attacks and single-point failures, and at the same time improve the efficiency of generating site passwords.

Description

technical field [0001] The invention relates to the field of information security, in particular to a password management mechanism, in particular to a site password generation technology. Background technique [0002] Passwords are usually the main entrance to access user confidential information, and password verification is the main way to ensure security, but there are many problems in this way at present. On the one hand, users are required to use random and unique passwords, which are difficult for users to remember even though the entropy is relatively high. At the same time, with the increase of user accounts, the number of passwords managed by the user is also increasing, which will undoubtedly increase the memory burden of the user. In order to reduce the burden of memory, users often adopt insecure solutions - choose low-entropy passwords that are easy for attackers to guess, or reuse passwords on multiple sites, etc. On the other hand, day-to-day use of passwor...

AI Technical Summary

Problems solved by technology

[0004] Although password managers are able to generate high-entropy site passwords and provide users with a lot of convenience, they still have some security problems:

[0006] 2) Single point of failure cannot be avoided

There is often a single point of failure in some generative password managers introduced by the master password, through which an attacker can gain access to all of a user's accounts

Also note that many password managers do not provide protection against shoulder-snooping attacks, one of the ways attackers can obtain master passwords

Images