Simple password-based three-party authenticated key exchange without server public keys

Password-based three-party authenticated key exchange protocols are extremely important to secure communications and are now extensively adopted in network communications. These protocols allow users to communicate securely over public networks simply by using easy-to-remember passwords. In considering authentication between a server and user, this study categorizes password-based three-party authenticated key exchange protocols into explicit server authentication and implicit server authentication. The former must achieve mutual authentication between a server and users while executing the protocol, while the latter only achieves authentication among users. This study presents two novel, simple and efficient three-party authenticated key exchange protocols. One protocol provides explicit server authentication, and the other provides implicit server authentication. The proposed protocols do not require server public keys. Additionally, both protocols have proven secure in the random oracle model. Compared with existing protocols, the proposed protocols are more efficient and provide greater security.     

Java实现运用Kerberos协议的客户机／服务器程序

因特网的日益发展给人们提供了更多的机会和方便快捷,同时也带来了更多的安全隐患。Kerberos解决了这个问题。Kerberos是一种身份认证协议,提供了集中的身份验证服务器,提供了从服务器端验证用户、用户端验证服务器,以及用户和服务器之间加密报文传输的安全功能。文中研究了Kerberos身份认证协议,完成和分析了运用Kerberos协议实现身份认证和安全通信的客户机/服务器程序的Java实现。     

基于串空间理论的Kerberos协议分析

在介绍串空间理论基本概念、攻击者模型以及Kerberos协议的基础上,利用串空间理论得出Kerberos各协议参与主体和攻击者的迹,构造了协议的串空间,给出了Kerberos协议的丛图。在证明一个定理的基础上,使用启发式和反证法的思路,证明了认证服务器分配给客户端和应用服务器会话密钥的保密性,即攻击者从现有知识和构造能力无法推导出服务器分配给客户端和应用服务器的会话密钥;证明了客户端和认证服务器以及客户端和应用服务器能够相互认证,得出了Kerberos协议正确性的结论。     

标准模型下隐私保护的多因素密钥交换协议

多因素认证密钥交换协议融合多种不同的认证因素来实现强安全的身份认证和访问控制,在具有高级别安全应用需求的移动泛在服务中具有巨大的应用潜力.现阶段多因素协议的研究成果还不丰富,并且已有协议都是在随机预言模型下可证明安全的.以两方口令认证密钥交换协议、鲁棒的模糊提取器以及签名方案为基本组件提出了一个标准模型下可证明安全的多因素协议.本文的协议中服务器不知道用户的生物模板,因此实现了对生物信息的隐私保护.与已有的随机预言模型下的多因素协议相比,本文的协议在满足更高安全性的同时具有更高的计算效率和通信效率,因此更满足高级别安全的移动泛在服务的应用需求.     

安全域间信息资源访问的协议和方法

为了保护内部网络的安全，必须设置应用边界安全设备．Internet上不同的应用安全域间要实现信息资源的安全访问，首先需要认证．Kerberos是目前比较常用的认证协议，一般的应用边界安全设备（如SOcks5）中就应用了该认证协议，但应用该协议存在一定的缺陷：在应用边界安全设备链的认证过程中，资源域中的应用边界安全设备认证对象是主体域中的应用边界安全设备，而不是真正发起资源请求的客户端，因此资源域中的应用边界安全设备审计的对象是主体域中的应用边界安全设备，而不是真正的客户端．在Kerberos域间认证的基础上，给出了新的域间认证协议以及身份传递协议，使用新的协议不仅能够提供应用边界安全设备对用户访问请求的安全审计而且只需要两次域间的网络连接，这两次域间网络连接不需要主体和客体直接进行，而是通过应用边界安全设备完成的，提高了系统的通信效率，扩大了该系统的应用范围，适合于现有的企业网环境，能有效地解决企业网与企业网之间的信息安全传输．     

Full and partial deniability for authentication schemes

Deniable authentication is a type of authentication protocol with the special property of deniability. However, there have been several different definitions of deniability in authentication protocols. In this paper, we clarify this issue by defining two types of deniable authentication: In the first type of deniable authentication, the receiver of the authenticated message cannot prove to a third party that the sender has authenticated any message to him. We call this type of deniability full deniability. In the second type of deniable authentication, whilst the receiver can prove to a third party that the sender has authenticated some message to him, but he cannot prove to a third party that the sender has authenticated any particular message to the receiver. We call this type of deniability partial deniability. Note that partial deniability is not implied by full deniability, and that it has applications different from those of full deniability. Consequently, we present two identity-based authentication schemes and prove that one is fully deniable while the other is partially deniable. These two schemes can be useful in different scenarios.     

基于公钥密码体制的Kerberos协议的改进

随着计算机网络的发展,网络安全问题已变得日益重要,而身份认证在安全系统中的地位极其关键,是最基本的安全服务。Kerberos协议是基于私钥密码系统的身份认证协议。文中首先对Kerberos协议的认证原理进行分析;然后基于公钥体制的加密技术和Kerberos协议,提出了一个安全性更高的身份认证协议;最后分析了两种协议的异同。     

云计算中基于密文策略属性基加密的数据访问控制协议

云计算提供一种新兴的数据交互模式,实现了用户数据的远程存储、共享和计算。由于云计算的系统复杂性、网络开放性、资源集中性以及数据敏感性等特点,使得用户与云服务器的交互过程面临着严峻的安全威胁,成为云计算安全领域亟待解决的关键问题。文章首先介绍了云计算系统的系统组件、信任模型和攻击模型,针对云计算系统中的数据安全访问问题,提出了基于密文策略属性基加密的访问控制协议。该协议利用切比雪夫映射的半群特性实现了用户身份的合法性认证,并设计轻量级的属性加密算法实现用户数据的可靠性授权。同时,该协议主要引入身份认证、访问控制和前向安全性机制,实现用户身份真实性认证和数据可靠性访问。通过协议存储需求分析,表明该协议在数据属性集和密钥存储方面具有固定的存储空间需求,避免海量数据交互中用户存储空间的线性增长。通过分析,表明该协议具有较强的可靠性、灵活性和扩展性,适应于云环境中大规模数据交互的应用场景。     

具有高效授权的无证书公钥认证可搜索加密方案

设计了1个高效授权的无证书密码环境下的公钥认证可搜索加密方案的安全模型,并提出了具体的具有高效授权的无证书公钥认证可搜索加密方案。该方案中云服务器利用数据属主对密文关键词索引的签名进行数据属主的身份验证;其次,数据用户对授权服务器进行授权,授权服务器可以对数据用户进行验证,若数据用户合法,则协助数据用户对云服务器返回的密文执行有效性的验证;同时,数据属主与数据用户利用云服务器公钥生成的密文关键词索引与陷门搜索凭证,可以保证密文关键词索引与陷门搜索凭证满足公开信道中的传输安全。最后使用仿真验证了所提方案的效率。     

无证书密钥协商协议对跨域Kerberos的改进

针对Kerberos域间认证方案中存在的密钥数量庞大和系统安全性脆弱等问题,提出一种可认证的无证书密钥协商协议。该协议通过无证书密码学理论弥补原Kerberos域间认证的缺陷,只需一轮消息交换即可建立安全的域间会话密钥,并提供完善的前向安全性。安全性分析结果表明,改进的协议可以有效解决密钥的管理问题及第三方无举证窃听。     

基于指纹识别的云存储身份认证系统设计

针对WEB 云存储系统现有"静态口令+实时数据”的身份认证模式存在安全性能较低的问题,设计了基于指纹 识别技术的身份认证系统。该设计方案采用指纹识别的认证模式对云存储用户进行身份认证,提高了身份认证的安全性、可 靠性,解决了云存储用户账号非法访问、篡改等问题。提出了基于对称加密算法、非对称加密算法的混合加密算法,并将其作 为身份认证协议,有效提高了认证的效率,实现了海量数据的高效传输。实验结果表明,该方案在云存储身份认证系统中得到 很好的应用。     

Full and partial deniability for authentication schemes

Deniable authentication is a type of authentication protocol with the special property of deniability. However, there have been several different definitions of deniability in authentication protocols. In this paper, we clarify this issue by defining two types of deniable authentication: In the first type of deniable authentication, the receiver of the authenticated message cannot prove to a third party that the sender has authenticated any message to him. We call this type of deniability full deniability. In the second type of deniable authentication, whilst the receiver can prove to a third party that the sender has authenticated some message to him, but he cannot prove to a third party that the sender has authenticated any particular message to the receiver. We call this type of deniability partial deniability. Note that partial deniability is not implied by full deniability, and that it has applications different from those of full deniability. Consequently, we present two identity-based authentication schemes and prove that one is fully deniable while the other is partially deniable. These two schemes can be useful in different scenarios.     

Protecting Data Mobility in Cloud Networks Using Metadata Security

At present, health care applications, government services, and banking applications use big data with cloud storage to process and implement data. Data mobility in cloud environments uses protection protocols and algorithms to secure sensitive user data. Sometimes, data may have highly sensitive information, leading users to consider using big data and cloud processing regardless of whether they are secured are not. Threats to sensitive data in cloud systems produce high risks, and existing security methods do not provide enough security to sensitive user data in cloud and big data environments. At present, several security solutions support cloud systems. Some of them include Hadoop Distributed File System (HDFS) baseline Kerberos security, socket layer-based HDFS security, and hybrid security systems, which have time complexity in providing security interactions. Thus, mobile data security algorithms are necessary in cloud environments to avoid time risks in providing security. In our study, we propose a data mobility and security (DMoS) algorithm to provide security of data mobility in cloud environments. By analyzing metadata, data are classified as secured and open data based on their importance. Secured data are sensitive user data, whereas open data are open to the public. On the basis of data classification, secured data are applied to the DMoS algorithm to achieve high security in HDFS. The proposed approach is compared with the time complexity of three existing algorithms, and results are evaluated.     

一种轻量级的动态化密钥协商的物联网身份认证协议研究

针对物联网络在用户身份验证上存在的安全性问题,提出一种轻量级的动态化密钥协商的物联网身份认证协议(DLT)。该协议在用户进行登陆验证上使用了时间戳值,这使得恶意攻击者不能使用早期的消息,可以防范重放攻击以及拒绝服务攻击;在认证和密钥协商阶段采用了用户、服务器、控制服务器三者之间的互相验证,并且在公共信道上对服务器密钥和随机值进行了分离处理,使得攻击者无法窃听到其他用户的安全信息。协议安全性分析及仿真对比结果表明,DLT协议相比对比协议具有更多的安全功能,可以防范多种网络攻击,并且协议的能量代价更低。     

WSN中基于ECC的轻量级认证密钥协商协议

为解决无线传感器网络密钥管理与认证协议设计中由于节点频繁移动所带来的计算量、存储量等资源消耗过大问题,提出了一种基于ECC的轻量级认证密钥协商协议。该协议主要用于网络中任意用户节点之间,以及用户节点与网络之间的双向认证和会话密钥的协商。方案采用ECC进行会话密钥协商,结合AES对称密钥加密技术保证信息传输过程的保密性。与传统的密钥协商协议相比,能够在更小的密钥量下提供更大的安全性,并减少了对节点计算量和存储量的需求。该协议在ID-BJM安全模型下证明了其安全性。分析结果表明,该协议满足前后向安全性和PKG前向安全性。     

基于混沌映射的用户匿名三方口令认证密钥协商协议

在基于混沌的三方口令认证密钥协商协议中,用户通过低熵的口令实现相互认证和共享会话密钥,以避免在身份认证过程中公钥基础设施或存储用户长期密钥的安全威胁。通过分析Lee提出的基于混沌映射的口令认证密钥协商协议,发现其协议不能进行口令变更,而且仅适用于用户和服务器之间的两方通信。为了改进此方案,提出两个基于切比雪夫混沌映射的用户匿名三方口令认证密钥协商协议,包括基于时钟同步的密钥协商方案和基于随机数的密钥协商方案。其中基于时钟同步的用户匿名三方口令认证密钥协商协议通信量少,基于随机数的用户匿名三方口令认证密钥协商协议更容易实现。两个方案的优点是用户仅选择一个简单的口令进行相互认证和密钥协商,服务器不需要再保护用户口令表,避免了口令相关的攻击,而且在相互认证过程中用户使用临时身份和哈希函数,实现用户匿名性,在增强协议安全性的同时,减少了通信过程中消息的数量,提高了协议的执行效率,具有完美前向安全,并用BAN逻辑证明了其安全性。     

基于CC1100点对点无线数据采集

无线传感器网络有分布便捷、布网快速等特点。在自设计的Zigbee无线传感器网络简易节点的硬件平台上,实现了无线温度采集系统。温度数据以点对点的方式从发送节点传到接收节点,接收节点通过RS232串口将接收到的数据实时传递给计算机。     

Improving the security of ‘a flexible biometrics remote user authentication scheme’

Recently, Lin–Lai proposed ‘a flexible biometrics remote user authentication scheme,’ which is based on El Gamal's cryptosystem and fingerprint verification, and does not need to maintain verification tables on the server. They claimed that their scheme is secured from attacks and suitable for high security applications; however, we point out that their scheme is vulnerable and can easily be cryptanalyzed. We demonstrate that their scheme performs only unilateral authentication (only client authentication) and there is no mutual authentication between user and remote system, thus their scheme is susceptible to the server spoofing attack. To fill this security gap, we present an improvement which overcomes the weakness of Lin–Lai's scheme. As a result, our improved security patch establishes trust between client and remote system in the form of mutual authentication. Moreover, some standards for biometric-based authentication are also discussed, which should be followed during the development of biometric systems.     

Attribute-based authentication on the cloud for thin clients

We propose two new authentication schemes for the cloud that support private attribute-based authentication services. The basic scheme is non-anonymous attribute-based authentication scheme. The extended scheme of the basic scheme is fully anonymous attribute-based authentication scheme to realize full anonymity and unlinkability services. In the proposed schemes, a user is authenticated by the remote server if the intersection of the set of his/her assigned attributes and the server’s required attributes exceeds a satisfactory predefined level. Unlike existing attribute-based encryption and signature schemes that require the user to perform significant amount of elliptic curve bilinear pairings and modular exponentiations, and require the user to hold a significantly long decryption/signature key, in our schemes the user is not required to perform any bilinear pairings. With a fixed length private key, independent of the number of attributes, the cloud user performs only few exponentiations by which he/she is able to authenticate himself/herself to the remote server and establish a session key with the server with the condition that he/she satisfies a predefined level of the server’s attributes requirement. Therefore, our schemes are suitable for implementation on devices with limited resources. We provide the rigorous security of the proposed schemes and complexity analysis of our schemes. Finally, the security and performance comparisons of our schemes with the existing related schemes show that our schemes outperform other existing schemes.     

具有强匿名性的网关口令认证密钥交换协议

网关口令认证密钥交换协议允许用户和网关在服务器的协助下建立起一个共享的会话密钥,其中用户和服务器之间的认证通过低熵的口令来完成.已有的网关口令认证密钥交换协议对用户的匿名性研究不足.该文基于Diffie-Hellman密钥交换提出了具有强匿名性的网关口令认证密钥交换协议,并且在随机预言模型下基于标准的DDH假设证明了协议的安全性.新协议可以抵抗不可检测在线字典攻击并且计算效率高,安全性和计算效率都优于已有的同类协议.