摘要
针对远程安全访问中的用户鉴别问题 ,本文提出利用一次性口令认证产生的散列结果作为IKE协议使用的共享密钥 ,然后将该散列结果进行再散列后作为一次性口令计算结果 ,安全网关则采用相同的运算步骤 ,如果安全网关计算的一次性口令结果和用户传来的一次性口令相同 ,则安全网关将共享密钥加载到安全网关中进行安全关联的协商 .此方法成功解决了对于大量远程用户的共享密钥分配问题 ,同时该方法不对一次性口令的安全性产生任何影响 .
Aimed at the problem of user authentication on remote secure access, this paper presents a method that takes the hash-result of OTP as the share-key of IKE and rehashes the hash-result sent to Secure Gateway (SG) and then SG takes the same steps above. When the hash-result of OTP calculated by SG is equal with what was transferred from users , SG loads the hash-result to IKE modules and proceeds to negotiate with the Security Association. The method successfully solves the problems of distribution of secret keys under a vast amount of remote users by means of distributing the users only usernames and passwords while distribution of a large number of share-keys is avoided. Consequently, authentication and management of remote users turns to be facilitated. At the same time, it is proved that no effect on security of OTP was produed.
出处
《小型微型计算机系统》
CSCD
北大核心
2003年第12期2086-2087,共2页
Journal of Chinese Computer Systems
基金
国家自然科学基金 (60 0 730 4 6)资助
