| Identity authentication is an important part of information security.At present,most Web systems use password-based authentication.In order to avoid the successful crack of a user's password in one system exposing his accounts in other systems,people are usually required to set different passwords for different Web systems.As complicated passwords are hard to remember,people often add their personal identity information in the passwords,such as birthday etc.,which are susceptible to password attacks.In general,the Password-based authentication is easy to realize but often applied in the systems with lower security requirements.Systems with high security requirements often employ public key infrastructure(PKI),but PKI requires users to perform certificate related operations manually,and needs to develop different browser plug-ins for different kinds of browsers to implement client-side cryptographic operations.Portable cryptographic hardware devices such as USB Keys are commonly used to store the users' private keys,and implement cryptographic operations.The cryptographic hardware devices usually connect to the user's computer via USB cable,and the data for authentication can be transmitted directly to the computer through the USB port,which is more secure than through the Internet.But in practical application,the USB ports of the computer may not available for some privacy reasons.Meanwhile,these devices impose additional costs on users.Aiming at these problems,this thesis starts with the study on the implementation principles of Identity Based Cryptography(IBC)and selects identities as the data for user authentication.Because of the openness of the identity itself,the efforts of password attacks would be nullified,so it can effectively improve the security of the system.At the same time,this approach allows the user to use the same identity to realize secure logon in different Web systems.The user doesn't need to memorize different complicated passwords for different Web systems,therefore,this approach is more user-friendly.This thesis adopts mobile terminals instead of USB Keys to implement key managements and cryptographic operations,and can call the cryptographic operations in the mobile terminal through remote communication.It solves the problem of poor applicability of USB Keys,and avoids the external cost of buying USB Keys.For different application requirements,this thesis proposes a secure system logon approach based on IBC in three different schemes for different application requirements,and illuminates the content and procession of each scheme in detail.The innovations of this thesis are as follows.(1)Applying the IBC technology to the secure system logon of Web system,and choosing one of the user's public identities as the user's public key.This approach avoid using digital certificate and more user-friendly than the systems based on PKI.Because of the identities are public,the user doesn't need to memorize different complicated passwords for different Web systems.And the efforts of password guess and theft would be nullified.(2)The three schemes adopt mobile terminals instead of cryptographic hardware devices to implement key managements and cryptographic operations.The mobile terminals are convenient to carry and can reduce extra cost for users.(3)According to different application requirements,this thesis proposes three schemes for secure system logon of Web system.Without using browser plug-ins,these schemes are easier to develop. |
