基于图形口令的认证方案及其在电子商务中的应用

A Graphic Password Based Authentication Scheme and Applications in E-Commerce

提出一种新的图形口令认证方案,用于解决电子商务网站中用户登录认证过程不安全和二次验证过程繁琐的问题.针对文本口令易受攻击的特点,使用基于图形口令的认证方案,并且在选择图形口令时增加文字提示,解决图形记忆困难的问题.另外,使用随机模糊图形认证方案来抵制猜测攻击.实验结果表明,该认证方案在注册时间、登录成功率、认证时间和尝试次数方面明显优于传统方案.猜测攻击实验和理论分析结果表明,该认证方案可有效解决文本口令安全性低和二次验证过程繁琐的问题,符合电子商务网站的安全强度需求,同时具有安全、便易的特点.

In order to simplify the complexity of authentication and re-certification process in electronic commerce,a new authentication scheme based on graphical password was proposed.To overcome the problem of being easy attacked in text authentication,agraphical password was used along with text prompts for identifying and memory in the authentication process.And a random fuzzy graphics authentication scheme was used to resist educated guess attacks.Experiment results show that,the authentication scheme based on random fuzzy graphics is safe and easy to operate in re-certification and to resist guessing attacks in the electronic commerce websites.Results also demonstrate that the proposed scheme is superior to the traditional scheme in terms of the time of registration,the success rate of login,the authentication time and the number of attempts.Thus it is efficient,effective,and suitable in E-commerce applications.