基于蜜字的抗泄露身份认证协议研究

身份认证作为网络防护的第一道关口，是构建信息系统安全的基石，而实际信息系统中服务器存储的用户认证信息却面临严重的泄漏风险。现有身份认证协议研究主要针对传输安全等个别环节，未能解决认证服务器存储文件的泄漏问题。本项目拟针对基于蜜字的泄漏检测机制，采用形式化的方法，利用贝叶斯、可证明安全等理论，对抗泄露身份认证协议进行研究。拟实现3个目标：1)构建基于蜜字的服务器存储文件泄露检测机制；2)提出抗泄露口令认证密钥交换协议；3)建立针对抗泄漏身份认证协议的可证明安全理论及评估方法。拟重点解决：1)蜜字安全模型构建及生成算法构造问题；2)抗腐化的口令认证密钥交换协议构造问题；3)协议形式化安全模型构建和应用评估问题。课题的开展将开启抗泄露身份认证协议这一研究方向，为解决现有身份认证协议无法实现的口令泄露检测问题，提供重要的理论依据和技术参考，同时为用户相关隐私数据保护奠定基础。

Acting as the vanguard of network defense, identity authentication is the cornerstone of information system security. However, it has a drawback that user information used for authentication is usually stored in an authentication server without necessary protection, so that this sensitive information may suffer from malicious leakage. Most of the current researches on identity authentication focus on the use of individual links, such as transmission security, but fail to consider the leak detection of stored files on authentication servers. This project intends to start with the honeyword-based leak detection mechanism, adopt a formal method, and use Bayesian, provable security, and other information security techniques to conduct research on leakage-resistant identity authentication protocols. Three goals are planned to be achieved: 1) a honeyword-based leak detection mechanism for server storage file; 2) a leakage-resistant password-authenticated key exchange protocol; 3) a set of provable security theory and evaluation methods for leakage-resistant identity authentication protocols. To achieve the goals, the project will technically focus on: 1) the construction of the honeyword security model and the construction of the generation algorithm; 2) the construction of the anti-corruption password-authenticated key exchange protocol; 3) the construction of the formal security model of the protocol and the application evaluation scheme. The design and implementation yielded by this project will lead the research direction of the leakage-resistant identity authentication, provide important theoretical basis and technical reference for solving the problem of password leakage detection, which cannot be tackled by the existing authentication protocols, and at the same time build up the foundation for user-related privacy data protection.