基于教育区块链与无证书签名的身份认证方案

针对当前教育资源共享安全性低和身份认证困难的问题, 提出了一种区块链技术与无证书签名相结合的可跨域身份认证方案, 将无证书签名技术的高安全性、无密钥托管问题等优点应用到区块链的分布式网络中, 实现了身份认证过程中用户安全、跨域认证、恶意用户可追溯、注册信息不可篡改. 首先, 基于教育区块链与无证书签名的身份认证方案是建...     

Biometrics: a tool for information security

Establishing identity is becoming critical in our vastly interconnected society. Questions such as "Is she really who she claims to be?," "Is this person authorized to use this facility?," or "Is he in the watchlist posted by the government?" are routinely being posed in a variety of scenarios ranging from issuing a driver's license to gaining entry into a country. The need for reliable user authentication techniques has increased in the wake of heightened concerns about security and rapid advancements in networking, communication, and mobility. Biometrics, described as the science of recognizing an individual based on his or her physical or behavioral traits, is beginning to gain acceptance as a legitimate method for determining an individual's identity. Biometric systems have now been deployed in various commercial, civilian, and forensic applications as a means of establishing identity. In this paper, we provide an overview of biometrics and discuss some of the salient research issues that need to be addressed for making biometric technology an effective tool for providing information security. The primary contribution of this overview includes: 1) examining applications where biometric scan solve issues pertaining to information security; 2) enumerating the fundamental challenges encountered by biometric systems in real-world applications; and 3) discussing solutions to address the problems of scalability and security in large-scale authentication systems.     

基于生物特征识别的门限身份认证方案

在传统生物特征身份认证系统中,针对重要目标的保护时,单一用户的身份认证方案存在用户权限过高的问题。为了解决此类问题,利用BGN半同态加密算法,结合Shamir秘密共享设计了一种基于生物特征识别的门限身份方案。主要使用在双线性对上BGN同态加密算法进行数据保护,利用第三方认证中心进行秘密分割,服务器在密文状态下对用户的身份进行认证,实现门限身份认证。通过性能分析验证了方案的安全性和高效性。     

Secure-OSCAR中基于PKI的生物身份认证的设计

个体的生物特征的唯一性和“不可伪造性”使得它很适合于身份认证。生物信息本来是不保密的,所以不能象使用口令一样来使用它,否则将不能提高反而会降低系统的安全性。公钥机制(PKI)也被广泛应用于用户身份认证中,但它是基于私钥的安全性的,不可避免地存在冒用私钥的威胁。论文提出一个结合生物技术与PKI技术的认证方式的设计,具体描述了它在Secure-OSCAR中的实现。     

Dynamic ID-based remote user password authentication schemes using smart cards: A review

Remote user authentication is a mechanism, in which the remote server verifies the legitimacy of a user over an insecure communication channel. Until now, there have been ample of remote user authentication schemes published in the literature and each published scheme has its own merits and demerits. A common feature among most of the published schemes is that the user's identity (ID) is static in all the transaction sessions, which may leak some information about that user and can create risk of identity theft during the message transmission. To overcome this risk, many researchers have proposed dynamic ID based remote user authentication schemes. In this paper, we have defined all the security requirements and all the goals an ideal password authentication scheme should satisfy and achieve. We have presented the results of our survey through six of the currently available dynamic ID based remote user authentication schemes. All the schemes are vulnerable to guessing attack except Khan et al.'s scheme, and do not meet the goals such as session key agreement, secret key forward secrecy. In the future, we hope an ideal dynamic ID based password authentication scheme, which meets all the security requirements and achieves all the goals can be developed.     

可变IP地址用户间通信支持系统的设计与实现

可变IP地址用户间通信支持系统主要用于解析接入内部网的用户信息,实现对用户的可变IP地址的动态管理,为内部网中的用户提供信息服务,以达到支持可变IP地址用户之间进行通信的目的。本文介绍了接入内部网的用户间通信的两种方法,着重介绍了可变IP地址用户间通信支持系统的设计与实现。     

Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem

Conventional single-server authentication schemes suffer a significant shortcoming. If a remote user wishes to use numerous network services, he/she must register his/her identity and password at these servers. It is extremely tedious for users to register numerous servers. In order to resolve this problem, various multi-server authentication schemes recently have been proposed. However, these schemes are insecure against some cryptographic attacks or inefficiently designed because of high computation costs. Moreover, these schemes do not provide strong key agreement function which can provide perfect forward secrecy. Based on these motivations, this paper proposes a new efficient and secure biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem (ECC) without verification table to minimize the complexity of hash operation among all users and fit multi-server communication environments. By adopting the biometrics technique, the proposed scheme can provide more strong user authentication function. By adopting the ECC technique, the proposed scheme can provide strong key agreement function with the property of perfect forward secrecy to reduce the computation loads for smart cards. As a result, compared with related multi-serve authentication schemes, the proposed scheme has strong security and enhanced computational efficiency. Thus, the proposed scheme is extremely suitable for use in distributed multi-server network environments such as the Internet and in limited computations and communication resource environments to access remote information systems since it provides security, reliability, and efficiency.     

一种基于多维特征分析的网页代理服务发现方法

网页代理提供了一种快捷的中继服务,与其它类型的代理服务相比,如隐匿网络/VPN服务/Socks代理等,用户可以不需要安装任何软件就免费使用。因此,网页代理在绕过访问限制、隐藏身份等方面的便利性上有其不可比拟的优势。然而,网页代理在获取个人隐私信息、推送垃圾广告、隐匿行踪等方面也给人们的网络生活带来严重的安全威胁。所以,如何快速有效地将它们与大量正常网页区分开来成为网络空间安全面临的一个重要挑战。针对这一问题,本文提出了一种基于多维特征分析的网页代理发现方法——ProxyMiner。在主动发现方面,引入了网页代理特有的结构特征和内容特征,通过机器学习的方法进行预测发现。在被动发现方面,基于用户访问网页代理特有的访问模式,通过构建二分图对代理用户进行谱聚类分析,获取代理用户群体访问的顶级域名,从而发现网页代理。此方法仅基于客户端IP地址和目标URL,不需要任何有关HTTP头（经常会被恶意修改）或数据包（通常是加密的或不可用的）的信息。实验结果表明,在相同数据集上,相比于传统检测方法,ProxyMiner可以显著提高网页代理检测效果,降低平均检测时间。     

生物特征识别综述*

对传统的身份鉴别手段和现代生物特征识别技术产生背景进行了综述,介绍目前典型的生物特征识别技术的原理和发展趋势,分析了实际应用中存在的优缺点,并探讨了基于个人生物特征融合的多生物特征识别技术和生物特征信息保护问题,强调了生物识别技术在身份认证领域的重要性。     

基于可信计算技术的认证方案研究

提出一个基于可信计算技术的应用于专网的强认证方案,通过该方案的实施,可以确保用户身份、设备凭证证书以及设备IP地址的绑定。该绑定过程可以分为两部分:绑定的初始状态的确认和绑定状态的维持。绑定初始状态的确认通过认证来实现,而绑定状态的维持通过使用交换机端口和IP地址的绑定来实现。通过对该认证方案的安全性进行分析,该方案具有很好的安全性。     

基于IPv6实名地址的可信通信机制

提出一个层次化的IPv6实名地址空间以解决实名上网中的身份标识问题,按照当前IP地址分配体系建立地址资源PKI对实名地址进行分配、管理和认证。基于第三方的实名地址资源PKI,设计并实现实名通信系统。实验结果表明,该机制能完成实名通信和隐私保护的设计目标。     

一种基于改进IKE的移动VPN密钥协商方案

对传统IKE协议进行了改进,改进后的协议在不降低安全性的前提下实现了移动用户远程安全接入,以便其获得内网信息;扩展了IKE的认证方式,使其具有更高的协商效率和更强的可控性;实现了相应的移动VPN接入系统,该系统既支持动态内网IP分配,又支持扩展用户身份认证,从而在接入服务器端可以方便地进行基于内网IP的访问控制管理。     

Cancellable biometrics and annotations on BioHash

Lately, the once powerful one-factor authentication which is based solely on either password, token or biometric approach, appears to be insufficient in addressing the challenges of identity frauds. For example, the sole biometric approach suffers from the privacy invasion and non-revocable issues. Passwords and tokens are easily forgotten and lost. To address these issues, the notion of cancellable biometrics was introduced to denote biometric templates that can be cancelled and replaced with the inclusion of another independent authentication factor. BioHash is a form of cancellable biometrics which mixes a set of user-specific random vectors with biometric features. In verification setting, BioHash is able to deliver extremely low error rates as compared to the sole biometric approach when a genuine token is used. However, this raises the possibility of two identity theft scenarios: (i) stolen-biometrics, in which an impostor possesses intercepted biometric data of sufficient high quality to be considered genuine and (ii) stolen-token, in which an impostor has access to the genuine token and used by the impostor to claim as the genuine user. We found that the recognition rate for the latter case is poorer. In this paper, the quantised random projection ensemble based on the Johnson–Lindenstrauss Lemma is used to establish the mathematical foundation of BioHash. Based on this model, we elucidate the characteristics of BioHash in pattern recognition as well as security view points and propose new methods to rectify the stolen-token problem.     

基于ZooKeeper的全网统一信任锚模型研究

由于现有的TCP/IP协议没有对地址、身份等信息进行认证,造成源地址欺骗、路由劫持等大量攻击的发生,严重威胁到网络安全。而现有基于PKI体系的CA认证机构的管理效率低、没有统一性,不适合在全网统一范围进行认证。为了能够高效地管理、认证和存储公钥信息,建立全网统一的网络层可信身份认证与管理机制,因此提出了基于ZooKeeper的全网统一信任锚模型。该模型利用ZooKeeper的负载均衡、数据一致性等优点,采用分布式架构来共同管理信任锚,以一种全网统一的ID标志信息来解决身份与地址真实性鉴别问题,实现网络的平等互联、安全可信。     

基于身份认证的IP地址管理方法研究

针对Intranet网络环境中IP地址管理混乱与盗用问题,讨论了基于身份认证、利用802．1x协议的IP地址管理方法。此方法不但可以灵活管理IP地址,而且可以实现人机结合认证,加强用户与主机的安全。     

一种面向车联网通信的条件隐私保护认证协议

车联网可有效提高交通的效率和安全性,但通信过程中存在的隐私泄露问题严重阻碍了其应用落地。提出一种面向车联网V2X通信的条件隐私保护认证协议。针对现有协议大多仅支持车辆认证的局限性,基于用户身份和车辆身份信息生成车与用户绑定的生物密钥,使协议支持单车多用户或单用户多车认证。在保护用户和车辆身份的条件下完成对消息发送方的身份认证,并在特定情况下追溯车辆和用户的真实身份,从而实现对车辆和用户的条件隐私保护。同时,在协议中添加批量验证功能以提高验证效率。形式化的安全性分析和性能评估结果表明,该协议是安全且高效的。     

Cancelable features using log-Gabor filters for biometric authentication

Wide spread use of biometric based authentication requires security of biometric data against identity thefts. Cancelable biometrics is a recent approach to address the concerns regarding privacy of biometric data, public confidence, and acceptance of biometric systems. This work proposes a template protection approach which generates revocable binary features from phase and magnitude patterns of log-Gabor filters. Multi-level transformations are applied at signal and feature level to distort the biometric data using user specific tokenized variables which are observed to provide better performance and security against information leakage under correlation attacks. A thorough analysis is performed to study the performance, non-invertibility, and changeability of the proposed approach under stolen token scenario on multiple biometric modalities. It is revealed that generated templates are non-invertible, easy to revoke, and also deliver good performance.     

A review on performance,security and various biometric template protection schemes for biometric authentication systems

Identifying a person based on their behavioral and biological qualities in an automated manner is called biometrics. The authentication system substituting traditional password and token for authentication and relies gradually on biometric authentication methods for verification of the identity of an individual. This proves the fact that society has started depending on biometric-based authentication systems. Security of biometric authentication needs to be reviewed and discussed as there are multiple points related to integrity and public reception of biometric-based authentication systems. Security and recognition accuracy are the two most important aspects which must be considered while designing biometric authentication systems. During enrollment phase scanning of biometric data is done to determine a set of distinct biometric feature set known as biometric template. Protection of biometric templates from various hacking efforts is a topic of vital importance as unlike passwords or tokens, compromised biometric templates cannot be reissued. Therefore, giving powerful protection techniques for biometric templates and still at that very moment preparing great identification accuracy is a good research problem nowadays, as well as in the future. Furthermore, efficiency under non-ideal conditions is also supposed to be inadequate and thus needs special attention in the design of a biometric authentication system. Disclosure of various biometric traits in miscellaneous applications creates a severe compromise on the privacy of the user. Biometric authentication can be utilized for remote user authentication. In this case, the biometric data of users typically called templates are stored in a server. The uniqueness and stability of biometrics ended it useful over traditional authentication systems. But, a similar thing made the enduring harm of a user’s identity in biometric systems. The architecture of the biometric system leads to several hazards that lead to numerous security concerns and privacy threats. To address this issue, biometric templates are secured using several schemes that are categorized as biometric cryptosystems, cancelable biometrics, hybrid methods, Homomorphic Encryption, visual cryptography based methods. Biometric cryptosystems and cancelable biometrics techniques provide reliable biometric security at a great level. However, there persist numerous concerns and encounters that are being faced during the deployment of these protection technologies. This paper reviews and analyses various biometric template protection methods. This review paper also reflects the limitations of various biometric template protection methods being used in present times and highlights the scope of future work.

     

跨平台、跨应用的单点登录算法设计与实现

校园网中存在多Web的应用系统,而每个Web应用服务器都有一个身份认证,给教师和学生在使用上带来很多不便.讲述了通过Session的分布式认证系统完成多平台单点登录的安全算法的实现过程.     

Trust-enhanced Security in Location-based Adaptive Authentication

We propose trust to enhance security in adaptive and non-intrusive user authentication in controlled and pervasive environments. In addition to who a user is (e.g., via biometrics) and what a user knows (e.g., a password, a PIN), recent authentication solutions evaluate what a user has. The user's identity is then derived from what detectable accredited items (e.g., badges, RFIDs) and personal devices (e.g., smart-phones, PDAs) the user shows when authenticating. The level of security of the access is set consequently. Position information is also considered in authentication; only those users carrying authorised items in proximity of certain places can benefit from available resources at those places. Unfortunately, items such as badges, mobile phones, smart phones, RFID-ed cards can be stolen, forgotten, or lost with a consequent risk of identity theft and intrusion. In controlled environment like buildings, where sensors can detect a wide range of different types of items, the security of authentication can be improved by evaluating the amount of trust that can be reposed on the user standing in the area from where he tries to access a resource. This piece of information can be calculated from the positions of all the items linkable to the requester as sensed along time by the different sensors available. Sensors are seen as recommenders that give opinions on a user being in a requested position depending on what they have perceived in the environment. We apply Subjective Logics to model recommendations that originate from different types of location detectors and to combine them into a trust value. Our solution has been tested to improve authentication in an intelligent coffee corner of our research institute. A user at the coffee corner can see, displayed on a wall screen, the position of his colleagues depending on the level of authentication he obtains. The user authentication level depends on the number and on the quality of tokens he provides when authenticating. We comment how the use of a location-based trust (on the requester standing at the coffee corner) improves the adaptability, the non-intrusiveness, and the security of the authentication process. We validate our proposal with a simulation that shows how location-based trust changes when a user device moves away from the coffee corner.