基于数字签名的交互式用户身份鉴别方案

该文首先利用Harn数字签名方案建立了基于身份的交互式用户认证与双向认证方案,并首次将这种基于身份的交互式用户认证方案推广为基于身份的交互式共享认证方案,使得认证系统的n名验证者中t名以上验证者才能验证用户身份的有效性,从而可以有效地防止认证系统个别管理人员的作弊行为,提高了认证系统的安全级别与可用性。     

Grid authentication from identity-based cryptography without random oracles

As a critical component of grid security, secure and efficient grid authentication needs to be well addressed. However, the most widely accepted and applied grid authentication is based on public key infrastructure （PKI） and X.509 certificates, which make the system have low processing efficiency and poor anti-attack capability. To accommodate the challenge of grid authentication, this article aims at designing a secure and efficient method for grid authentication by employing identity-based cryptography （IBC）. Motivated by a recently proposed secure and efficient identity-based encryption （IBE） scheme without random oracles, an identity-based signature （IBS） scheme is first proposed for the generation of private key during grid authentication. Based on the proposed IBS and the former IBE schemes, the structure of a novel grid authentication model is given, followed by a grid authentication protocol described in detail. According to the theoretical analysis of the model and the protocol, it can be argued that the new system has improved both the security and efficiency of the grid authentication when compared with the traditional PKI-based and some current IBC-based models.     

基于身份的密码系统及其实现

基于身份的认证体制是一种以用户的身份信息作为公钥的认证体制,首先介绍了IBE技术的基础知识,并就IBE中所存在的公开问题作了较详细的分析,提出了一种基于中间公钥、门限和密钥隔离的IBE认证体制方案,解决了PKG密钥安全、私钥的安全传输、密钥托管、公钥撤销等问题,提高了IBE认证体制的安全性和实用性,还给出了系统的具体实现,并就其安全性作了具体分析。     

基于指纹细节点分类的安全身份认证方案

为解决传统指纹身份认证方案的一些问题,这里提出了一种保护指纹隐私信息的方案。方案采用普通指纹仪提取的指纹数字图像,使用指纹细节点的端点进行预对齐,指纹细节点的叉点应用模糊金库（Fuzzy Vault）方案进行密钥绑定,从而保护了指纹细节点的叉点信息。这里首次将指纹细节点分类的方法与Fuzzy Vault方案相结合。     

基于指纹特征数字水印算法的身份认证技术研究

本文利用指纹特征信息生成数字水印信号,并隐藏在身份证件之中.以身份证件作为指纹信息的载体,取代了传统指纹识别系统中的指纹特征参考信息数据库,提高整个自动指纹识别系统(AFIS)的安全性.同时,嵌入指纹特征信息的身份证件与用户存在本质联系,防止证件被盗用,实现对证件的保护.实验证明,使用含水印的证件在保证指纹识别系统正常工作的前提下,提高了验证的安全性,并且水印算法具有一定的鲁棒性.     

ID-Based User Authentication Scheme for Cloud Computing

In cloud computing environments, user authentication is an important security mechanism because it provides the fundamentals of authentication, authorization, and accounting (AAA). In 2009, Wang et al. proposed an identity-based (ID-based) authentication scheme to deal with the user login problem for cloud computing. However, Wang et al.'s scheme is insecure against message alteration and impersonation attacks. Besides, their scheme has large computation costs for cloud users. Therefore, we propose a novel ID-based user authentication scheme to solve the above mentioned problems. The proposed scheme provides anonymity and security for the user who accesses different cloud servers. Compared with the related schemes, the proposed scheme has less computation cost so it is very efficient for cloud computing in practice.     

一种基于指纹的远程双向身份鉴别方案

文中分析了Khan等人提出的基于指纹和智能卡的远程双向身份鉴别方案,指出原方案不能抵抗伪造服务攻击、不能及时验证用户输入口令的正确性。提出了基于Rabin密码体制和nonce的改进方案,改进方案克服了原方案中存在的安全漏洞,保留了原方案中对指纹和智能卡的使用,且具有更高的安全性。     

基于身份保护的高效3GPPAKA协议

针对3GPP AKA协议中存在的安全缺陷,在消息中加入访问网络的身份信息,利用秘密令牌机制,提出了一种可以防止重定向攻击、SQN同步缺陷和用户身份信息泄露的改进方案,并对其安全性和效率进行了分析。分析表明,本方案可以有效解决上述问题,以较少的资源开销就能获取协议效率和安全性能的提高。     

ZigBee网络抵御Sybil攻击的自适应链路指纹认证方案

该文针对ZigBee网络中Sybil攻击破坏节点身份唯一性的问题,提出一种抵御Sybil攻击的自适应链路指纹认证方案。方案首先基于无线链路特征设计了链路指纹,在此基础上,提出了反映信道质量的相干时间估测算法和适应子节点数量变化的保护时隙(GTS)动态申请算法,并给出了Sybil攻击认证流程。安全性分析及实验结果表明,方案在通信环境的安全边界条件下节点认证成功率可达97%以上,且链路指纹无需存储,具有较低的资源需求。     

Key distribution system based on identification information

A key distribution system (KDS) based on identification information (ID-based KDS) is presented. The system is founded on the Diffie-Hellman public key distribution scheme and has an identity authentication function. It uses an individual user's identification information instead of the public file used in the Diffie-Hellman scheme. It does not require any services of a center to distribute work keys or users to keep directories of key-encrypting keys. Therefore, key management in cryptosystems can be simplified by adopting the ID-based KDS. Two kinds of identity-based key distribution system are proposed and applied to actual communication networks. One uses two-way (interactive) communication to distribute work keys, while the other uses one-way communication. Modular exponentiations of large numbers, used in the systems, are implemented with digital signal processors.<>     

Digital images authentication scheme based on bimodal biometric watermarking in an independent domain

With the growing accessibility and usability of internet there is a growing concern over content protection of digital images. Recently, to eliminate the traditional use of passwords and to ensure that the access to the image is restricted only to legitimate users, security solutions are increasingly combined with biometrics. Consequently, biometric-based watermarking algorithms, that involve embedding the identity of the owner, are proposed to solve ownership disputes. This paper presents a new scheme for protecting and authenticating invisibly watermarked digital images. It applies Independent Component Analysis to the cover image and enables the insertion of two independent watermarks based on fingerprint and iris biometrics. In this approach biometric techniques are used for watermarks generation and for owners authentication. The main advantage of proposed algorithm is construction of ICA based watermarking domain to enable insertion of two independent watermarks, that improve authentication accuracy and makes scheme more robust.     

安全的无可信PKG的部分盲签名方案

利用gap Diffie-Hellman(GDH)群,在部分盲签名机制的基础上,提出了一个有效的基于身份的无可信私钥生成中心(PKG,private key generator)的部分盲签名方案.方案中PKG不能够伪造合法用户的签名,因为它只能生成一部分私钥.在随机预言模型下,新方案能抵抗适应性选择消息攻击和身份攻击下的存在性伪造,其安全性依赖于CDHP问题.该方案满足正确性和部分盲性,与Chow方案相比具有较高的效率.     

Secure and efficient token based roaming authentication scheme for space-earth integration network

Aiming at the problem of prolongation and instability of satellite and terrestrial physical communication links in the space-earth integration network,a two-way token based roaming authentication scheme was proposed.The scheme used the characteristics of the computing capability of the satellite nodes in the network to advance the user authentication process from the network control center (NCC) to the access satellite.The satellite directly verified the token issued by the NCC to verify the user's identity.At the same time,the token mechanism based on the one-way accumulator achieved the user's dynamic join,lightweight user self-service customization and billing,and the introduction of Bloom Filter enabled effective user revocation and malicious access management.Compared with the existing scheme,the scheme can guarantee the security of roaming authentication and significantly reduce the calculation and communication overhead of the authentication and key negotiation process.     

一种新的基于指纹与人脸特征级融合的模糊金库方案

针对基于生物特征的模糊金库易受相关攻击导致密钥和生物特征模板丢失以及基于单生物特征的模糊金库的认证性能不可靠的问题,提出了一种新的基于指纹与人脸特征级融合的模糊金库方案。该方案对指纹特征与人脸特征分别进行不可逆变换,并基于Diffie-Hellman算法在特征级变换后将指纹与人脸特征融合为一个模板。最后,将所得的融合模板用来构建模糊金库,通过更新随机矩阵使金库具备可撤销特性,有效抵御相关攻击,实现可靠的身份认证。实验结果表明,本文方案提高了系统的可靠性和多生物特征模板的安全性。     

适用于卫星网络的IBE安全密钥分发

分析了卫星网络的通信特点,提出一种基于身份加密体制的安全密钥分发方法,用于解决在卫星网络中基于身份加密体制的密钥托管问题。该方法将密钥生成中心的功能进行划分,并将划分后的子功能分别由不同实体完成,网络结点通过与不同实体交互计算出私钥,防止单个密钥生成中心获取网络结点的私钥。安全性分析和仿真分析表明,该方法具有良好的安全性,在卫星网络中具有较高运行效率。     

移动自组网中基于多跳步加密签名 函数签名的分布式认证

移动自组网Manet(Mobile Ad Hoc Network)是一种新型的无线移动网络,由于其具有网络的自组性、拓扑的动态性、控制的分布性以及路由的多跳性,所以,传统的安全机制还不能完全保证Manet的安全,必须增加一些新的安全防范措施.本文探讨了Manet所特有的各种安全威胁,提出了一种基于多跳步加密签名函数签名的安全分布式认证方案,即将移动密码学与(n,t)门槛加密分布式认证相结合,并采用了分布式容错处理算法和私钥分量刷新技术以发现和避免攻击者假冒认证私钥进行非法认证以及保护私钥分量和认证私钥不外泄.     

基于动态ID远程用户身份认证方案的改进

对Wang提出的动态ID远程用户身份认证方案进行了回顾和分析,指出了Wang方案中存在不能保护用户匿名和不能抗拒绝服务攻击的缺陷。针对此缺陷,在保留原方案优点的基础上提出了一种改进的动态ID远程用户身份认证方案,并通过对比分析说明了改进方案的安全性和有效性。     

Mobile device integration of a fingerprint biometric remote authentication scheme

Various user authentication schemes with smart cards have been proposed. Generally, researchers implicitly assume that the contents of a smart card cannot be revealed. However, this is not true. An attacker can analyze the leaked information and obtain the secret values in a smart card. To improve on this drawback, we involve a fingerprint biometric and password to enhance the security level of the remote authentication scheme Our scheme uses only hashing functions to implement a robust authentication with a low computation property. Copyright © 2011 John Wiley & Sons, Ltd.     

基于事件的一次性口令双向认证的实现

针对静态口令身份认证技术易受攻击的安全缺陷,在事件同步一次性口令产生机制的基础上,结合公钥密码体制,设计并实现了一种新的一次性口令双向认证方案。与传统的挑战／响应双向认证方案相比,该方案实现简单、执行效率高,适用于电子商务过程中的身份认证,能够实现网络环境下用户和服务器的双向认证,避免各种攻击,可以大大提高用户访问的安全性,有效保护用户信息。     

一种基于指纹的身份认证协议

提出一种基于指纹的身份认证协议,它对stolen-verifier(攻击者使用从认证服务器中盗窃的用户指纹信息冒充合法用户)和重发攻击 (Replay Attack)[1]是安全的,保证了用户指纹信息的保密性和真实性。认证用户可以从中获得的最大好处就是:当他们登录服务系统时,他们不需要除了指纹以外的其它任何东西。1