车载自组织网络中基于椭圆曲线零知识证明的匿名安全认证机制

依据车载自组织网络的特点,提出了一种基于椭圆曲线零知识证明的匿名安全认证机制,利用双向匿名认证算法避免消息收发双方交换签名证书,防止节点身份隐私在非安全信道上泄露;利用基于消息认证码的消息聚合算法,通过路边单元协助对消息进行批量认证,提高消息认证速度,避免高交通密度情形下大量消息因得不到及时认证而丢失。分析与仿真实验表明,该机制能实现车辆节点的隐私保护和可追踪性,确保消息的完整性。与已有车载网络匿名安全认证算法相比,该机制具有较小的消息延迟和消息丢失率,且通信开销较低。     

可证安全的传统公钥密码-无证书公钥密码异构聚合签密方案

异构签密可以保证异构密码系统之间数据的机密性和不可伪造性。分析现有的异构签密方案,发现它们只针对单个消息,无法实现批验证。聚合签密能够把不同用户对多个消息产生的签密密文同时发送给接收者,而且可以提供批量验证,降低验证开销。该文提出一个传统公钥密码-无证书公钥密码异构聚合签密方案,该方案不仅能够保证传统公钥密码(TPKI)和无证书公钥密码(CLPKC)系统间通信的机密性和认证性,而且聚合验证时不需要双线性对。在随机预言模型下,基于间隙双线性Diffie-Hellman困难问题、计算Diffie-Hellman困难问题和离散对数问题,证明该方案满足自适应性选择密文攻击下的不可区分性和自适应选择消息下的不可伪造性。     

面向车载自组网的无证书聚合签名方案的安全性分析与改进

2018年,王大星和滕济凯提出了一种适用于车载自组织网络的无证书聚合签名方案,并在随机模型下证明该方案是存在不可伪造的。针对该方案的安全性,给出了3类伪造攻击:“honest-but-curious”的KGC攻击、恶意的KGC与RSU的联合攻击、内部签名者的联合攻击。分析结果表明,王大星等人设计的无证书聚合签名方案在这3类攻击下均是不安全的。为了抵抗这些攻击,进一步提出了一个改进的无证书聚合签名方案。所提方案不仅在自适应性选择消息攻击下满足存在不可伪造性,还能有效抵抗联合攻击。     

高效的可验证无证书可搜索加密方案

在云计算环境中，可搜索加密方案是一种实现数据隐私保护和关键词搜索的有效方法。目前，现有方案不仅难以实现高效验证与动态更新，同时也存在证书管理和密钥分配问题。为了解决上述问题，近期有相关学者提出了一种基于改进Merkle-Tree认证方法的可验证多关键词搜索方案，然而经过安全性分析，该方案不能满足密文的不可区分性。通过改进，提出了一种新的高效的可验证无证书可搜索加密方案。分析表明，所提方案不仅能够满足无证书环境下的密文不可区分性与签名的不可伪造性，还实现了更高的计算效率与更小的通信开销，更能适用于资源有限的终端设备。     

具有内部安全性的常数对无证书聚合签密方案

聚合签密不仅能够减少密文的验证计算量,而且能够保证数据的机密性和认证性。该文分析刘等人(2016)提出的无证书聚合签密(CLASC)方案,指出第2类攻击者可以伪造密文,刘方案不满足适应性选择密文攻击的不可区分性和适应性选择消息攻击的不可伪造性。为了提升CLASC方案的安全级别和聚合验证效率,该文提出CLASC的内部安全模型和具有内部安全性的CLASC方案。该方案聚合验证密文只需要3个双线性对,与现有同类方案相比,具有较高的验证效率。基于计算Diffie-Hellman困难假设,证明新方案在随机预言模型下,满足CLASC内部安全模型下的机密性和不可伪造性。     

匿名的无证书多接收者签密机制

为了满足广播通信环境下发送者的多消息发送需求,本文提出可证安全的无证书多接收者多消息签密机制,密文中不再包含接收者身份列表,实现对接收者身份等隐私信息的保护;同时发送者可在一次签密操作中完成多消息发送任务.相较与现有方案而言,除具有保密性和不可伪造性之外,本文机制具有较强的匿名性和较高的计算效率,满足广播通信环境中多消息的匿名发送需求.     

无证书密文等值测试签密方案

在云计算应用中,确保消息的机密性和不可伪造性,同时判断不同密文对应明文的等价性显得至关重要。具有密文等值测试功能的签密方案可以实现此类安全目标。该文基于无证书公钥密码环境,设计了一个具有密文等值测试功能的无证书签密方案(CLSCET)。首先,提出了无证书密文等值测试签密方案的框架和安全模型,定义了两类具有不同攻击能力的敌手和3类安全目标。然后构造了具体的无证书密文等值测试签密方案,并分析了方案的正确性。最后,基于随机预言模型,证明该文方案满足选择密文攻击下的单向性(OW-CCA)、选择密文攻击下的不可区分性(IND-CCA2)和选择消息攻击下的不可伪造性(EUF-CMA)安全。与现有近似方案相比,该文方案满足IND-CCA2的机密性、EUF-CMA的不可伪造性和OW-CCA的密文单向性。     

无证书密文等值测试签密方案

在云计算应用中,确保消息的机密性和不可伪造性,同时判断不同密文对应明文的等价性显得至关重要.具有密文等值测试功能的签密方案可以实现此类安全目标.该文基于无证书公钥密码环境,设计了一个具有密文等值测试功能的无证书签密方案(CLSCET).首先,提出了无证书密文等值测试签密方案的框架和安全模型,定义了两类具有不同攻击能力的敌手和3类安全目标.然后构造了具体的无证书密文等值测试签密方案,并分析了方案的正确性.最后,基于随机预言模型,证明该文方案满足选择密文攻击下的单向性(OW-CCA)、选择密文攻击下的不可区分性(IND-CCA2)和选择消息攻击下的不可伪造性(EUF-CMA)安全.与现有近似方案相比,该文方案满足IND-CCA2的机密性、EUF-CMA的不可伪造性和OW-CCA的密文单向性.     

出租车自组织网络拓扑特征的研究与评估

由于受到车流量、车辆数目及通信半径等诸多外界因素的影响,使得车辆自组织网络中节点不断移动,造成了网络拓扑结构复杂、变化频繁及网络节点分布不均匀,这对提高车辆自组织网络的可扩展性提出了挑战。文中基于上海市4300多辆出租车的车载装置GPS得到的实时数据,对车辆自组织网络的拓扑特性进行分析及研究,并结合复杂网络理论得出,车辆自组织网络中节点的度服从幂律分布,是无标度网络,且具有很强的异构性,但不具有小世界特征;在某些限定条件下,网络的连通性与节点的通信距离之间呈线性关系。     

可证安全的高效无证书有序多重签名方案

无证书有序多重签名可用于解决信任链推荐信息的认证问题。秦艳琳等提出一个高效的无证书有序多重签名方案,并在随机语言机模型下证明方案的安全性可归约为CDH（computational Diffie-Hellman）困难问题。对该方案的安全性证明过程进行分析,指出方案难以抵抗伪造攻击：攻击者已知某个多重签名,则可以伪造其他消息的多重签名。随后构造一个更加高效的无证书有序多重签名方案,方案使用更少的双线性对,且只有一个签名消息,占用更小的计算代价和通信代价。最后证明方案在随机预言机模型下具有不可伪造性。     

一种可证安全的车联网无证书聚合签名改进方案

车联网(VANETs)是组织车－X(X:车、路、行人及互联网等)之间的无线通信和信息交换的大型网络,是智慧城市重要组成部分。其消息认证算法的安全与效率对车联网至关重要。该文分析王大星等人的VANETs消息认证方案的安全不足,并提出一种改进的可证安全的无证书聚合签名方案。该文方案利用椭圆曲线密码构建了一个改进的安全无证书聚合认证方案。该方案降低了密码运算过程中的复杂性,同时实现条件隐私保护功能。严格安全分析证明该文方案满足VANETs的安全需求。性能分析表明该文方案相比王大星等人方案,较大幅度地降低了消息签名、单一验证以及聚合验证算法的计算开销,同时也减少了通信开销。     

Research on pairing-free certificateless batch anonymous authentication scheme for VANET

To solve the problem of security and efficiency of anonymous authentication in vehicular ad hoc network,a pairing-free certificateless batch anonymous authentication scheme was proposed.The public and private keys and pseudonyms were jointly generated by the trusted third party and vehicle,so the system security didn't depend on the tamper device.The scheme can realize authentication,anonymity,traceability,unforgeability,forward or backward security,and so on.Furthermore,under the random oracle model,the scheme can resist Type I and Type II attacks.Because there is no need to use certificates during authentication,the system storage load is effectively reduced.At the same time,the scheme realizes the batch message authentication on the basis of pairing-free operation,so the authentication efficiency is improved.Therefore,the scheme has important theoretical significance and application value in the resource-limited internet of things or embedded environment.     

车载自组网中可证明安全的无证书认证方案

认证协议的设计是目前车载自组网(VANET)安全领域的研究热点。现有的认证方案中普遍存在密钥托管带来的安全问题,以及使用计算量大的双线性对导致认证效率很低。针对以上问题,该文提出可证明安全的无证书批认证方案,方案中车辆的密钥由车辆自身和一个密钥生成中心共同生成,解决密钥需要托管给第三方维护的问题;方案的签名构造不使用计算量大的对运算,减少了计算开销;引入批认证来减少路边设施的认证负担,提高认证效率。基于求解椭圆曲线上的离散对数问题的困难性假设,在随机预言机模型中证明了该方案可以抵抗自适应选择消息和身份攻击,从而抵抗更改攻击和假冒攻击,并具有匿名性、可追踪性等特点。与现有方案相比,该方案实现了更高效的认证。     

Threshold password authentication against guessing attacks in Ad hoc networks

Password authentication has been accepted as one of the commonly used solutions in network environment to protect resources from unauthorized access. The emerging mobile Ad hoc network, however, has called for new requirements for designing authentication schemes due to its dynamic nature and vulnerable-to-attack structure, which the traditional schemes overlooked, such as availability and strong security against off line guessing attacks in face of node compromise. In this paper, we propose a threshold password authentication scheme, which meets both availability and strong security requirements in the mobile Ad hoc networks. In our scheme, t out of n server nodes can jointly achieve mutual authentication with a registered user within only two rounds of message exchanges. Our scheme allows users to choose and change their memorable password without subjecting to guessing attacks. Moreover, there is no password table in the server nodes end, which is preferable since mobile nodes are usually memory-restricted devices. We also show that our scheme is efficient to be implemented in mobile devices.     

一种后向撤销隐私安全的车载自组织网络快速匿名消息认证协议

该文提出适用于车载自组织网络的快速匿名消息认证协议。通过使用基于身份的签密技术,车辆行驶至某区域后,与该区域中心相互认证,获取其所维护的周期性群签名系统密钥材料。之后,该车辆能够使用获取的密钥材料对向网络中广播的携带有群签名的消息,实现消息的匿名认证。网络中的车辆收到其它车辆广播消息之后,仅需验证群签名的合法性,避免验证消息的签发者是否是撤销用户。此外,所采用的群签名算法支持批验证运算,能够快速处理短期内收到的多个消息。除了避免撤销验证特性之外,与已有的文献相比,文中的方案能够完善地保护撤销用户的后向隐私安全性。     

车联网环境下无证书匿名认证方案

通过信息共享,车联网(IoV)为车辆提供各种应用,以提高道路安全和交通效率.然而,车辆之间的公开通信导致了车辆隐私泄露和各种攻击.因而,安全且保护隐私的信息共享方法是非常必要的,并且对车辆间通信的安全性和保密性提出了更高的要求,所以该文提出了一种支持批量验证的非线性对的无证书匿名认证方案.在该方案中,首先,采用无证书签...     

MLAS: Multiple level authentication scheme for VANETs

The vehicular ad hoc network (VANET) is an emerging type of network which enables vehicles on roads to inter-communicate for driving safety. The basic idea is to allow arbitrary vehicles to broadcast ad hoc messages (e.g. traffic accidents) to other vehicles. However, this raises the concern of security and privacy. Messages should be signed and verified before they are trusted while the real identity of vehicles should not be revealed, but traceable by authorized party. Existing solutions either rely too heavily on a tamper-proof hardware device, or do not have an effective message verification scheme. In this paper, we propose a multiple level authentication scheme which still makes use of tamper-proof devices but the strong assumption that a long-term system master secret is preloaded into all tamper-proof devices is removed. Instead the master secret can be updated if needed to increase the security level. On the other hand, messages sent by vehicles are classified into two types – regular messages and urgent messages. Regular messages can be verified by neighboring vehicles by means of Hash-based Message Authentication Code (HMAC) while urgent messages can only be verified with the aid of RSUs nearby by means of a conditional privacy-preserving authentication scheme. Through extensive simulation, we show that our multiple level authentication scheme is much more efficient that those RSU-aided authentication scheme as long as the proportion of urgent messages is less than 100%. The verification delay required can be up to 110 times smaller than other protocols. Our implementation shows that batch verification may not be as efficient as expected. In case without batch verification, the verification delay required by our scheme can even be up to 173 times smaller.     

Conditional privacy protection authentication scheme based on bilinear pairings for VANET

To solve the problem of security and efficiency of anonymous authentication in the vehicle Ad-hoc network（VANET）, a conditional privacy protection authentication scheme for vehicular networks is proposed based on bilinear pairings. In this scheme, the tamper-proof device in the roadside unit (RSU) is used to complete the message signature and authentication process together with the vehicle, which makes it more secure to communicate between RSU and trusted authority (TA) and faster to update system parameters and revoke the vehicle. And this is also cheaper than installing tamper-proof devices in each vehicle unit. Moreover, the scheme provide provable security proof under random oracle model (ROM), which shows that the proposed scheme can meet the security requirements such as conditional privacy, unforgeability, traceability etc. And the results of simulation experiment demonstrate that this scheme not only of achieves high efficiency, but also has low message loss rate.     

区块链赋能的6G零信任车联网可信接入方案

6G网络将带来全场景按需服务泛在智能新范式,其中可信可靠网络服务是泛在智能的关键技术指标。该文面向6G零信任网络的通信需求,以区块链为“信任桥梁”,研究6G车联网边缘计算中的可信可靠接入管理方法。首先,采用基于2次剩余的零知识身份验证算法,在不暴露车辆隐私的前提下完成基站和车辆之间的相互验证与授权。然后,为提高验证效率并节省基站能耗,建立了基于契约理论的路侧冗余算力激励模型,将基站的一部分验证任务分配给边缘服务器或停泊车辆,再给予相应的报酬。最后,建立了基于双层区块链的6G零信任车联网架构,利用基站群维护的主链与边缘算力维护的辅链记录车联网身份验证的重要参数,实现零信任网络环境的可信接入。通过与现有方法比较,该文所述方法在不泄露车辆隐私的前提下显著提升了车辆验证效率,降低了基站能耗,具有更高的安全性。     

RPB-MD: Providing robust message dissemination for vehicular ad hoc networks

To improve traffic safety and efficiency, it is vital to reliably send traffic-related messages to vehicles in the targeted region in vehicular ad hoc networks (VANETs). In this paper, we propose a novel scheme, relative position based message dissemination (RPB-MD), to reliably and efficiently disseminate messages to the vehicles in the zone-of-relevance. Firstly, the relative position based (RPB) addressing model is proposed to effectively define the intended receivers in the zone-of-relevance. To ensure high message delivery ratio and low delivery delay, directional greedy broadcast routing (DGBR) is introduced to make a group of candidate nodes hold the message for high reliability. Moreover, to guarantee efficiency, the protocol time parameters are designed adaptively according to the message attributes and local vehicular traffic density. The protocol feasibility is analyzed to illustrate the robustness and reliability of RPB-MD. Simulation results show that RPB-MD, compared with representative existing schemes, achieves high delivery ratio, limited overhead, reasonable delay and high network reachability under different vehicular traffic density and data sending rate.