信息安全作业5 身份认证(Information security operation 5 identity authentication)

需求:设计一款基于手机的app,用于快递小哥验证身份,顾客领取快递。认证方法不限,简单易行。

(1)给出:app包含哪些部分以及每部分的功能;

(2)模仿kerberos的写法,描述交互过程,并加说明。

app主要目的是帮助快递员和顾客进行相互的身份认证,现在比较通行的就是二维码的认证,可以通过即时生成的二维码来确认顾客的身份。

app的功能主要包括顾客和快递员的用户登陆,用户端需要有生成取件的二维码的功能,以及快递员需要扫码的功能。当快递签收成功时,app应当给收件人传达信息

在顾客和快递员之间,顾客的身份是比较可能存在风险的一方,第三方的认证服务器可以着重查验用户的身份。

快递员/顾客的登陆:

快递员/顾客->后台服务器:(Username||Password)

后台服务器->快递员/顾客:Ek(Ticket||Message)

顾客生成取件码:

顾客->后台服务器:(IDmessage||Ticket||Time)

后台服务器->顾客:Ek(IDmessage||Time)

当快递员查验顾客二维码时:

快递员(从顾客二维码中获取信息)->后台服务器:Ek(IDmessage||TicketB)||Time//通过QRcode

后台服务器->快递员:(Message||Time)//顾客的身份是否正确

快递员->后台服务器:(Message||TicketB||Time)//是否完成了快递的交付

后台服务器->顾客:(Message)//通过短信和APP告知收件人已经完成快递的签收

————————

Requirements: design a mobile phone based app to verify the identity of the express brother, and customers receive the express. The authentication method is not limited and simple.

(1) Give: which parts of the app and the functions of each part;

(2) Imitate the writing method of Kerberos, describe the interaction process and explain it.

The main purpose of app is to help the courier and the customer conduct mutual identity authentication. Now the more popular one is the two-dimensional code authentication, which can confirm the customer’s identity through the two-dimensional code generated in real time.

The functions of the app mainly include the user login of customers and couriers. The user end needs to have the function of generating the QR code for picking up parts, and the function of couriers to scan the code. When the express sign in is successful, the app should convey the information to the recipient

Between the customer and the courier, the customer’s identity is the party that may be at risk. The third-party authentication server can focus on checking the user’s identity.

< strong > login of courier / Customer: < / strong >

Courier / customer – & gt; Background server: (username | password)

Background server – & gt; Courier / Customer: EK (ticket message)

< strong > customer generated pick-up Code: < / strong >

Customer – & gt; Background server: (idmessage ticket time)

Background server – & gt; Customer: EK (idmessage | time)

< strong > when the courier checks the customer’s QR Code: < / strong >

Courier (get information from customer QR code) – & gt; Background server: EK (idmessage | ticketb) | time / / through QRcode

Background server – & gt; Courier: (message | time) / / is the customer’s identity correct

Courier – & gt; Background server: (message | ticketb | time) / / has the delivery of express been completed

Background server – & gt; Customer: (message) / / inform the recipient through SMS and app that the express delivery has been signed