无人机网络中基于多因子的认证密钥协商协议研究

随着无人机技术的发展,无人机网络日益普及,无人机网络安全也越来越受到人们的关注。解决无人机网络的安全问题,研究和设计安全、高效且轻量级的认证密钥协商协议至关重要。2021年,HUSSAIN等人提出一种基于椭圆曲线加密算法的无人机网络认证密钥协商协议,但该协议存在无人机伪装攻击、会话密钥泄露等安全问题。基于此,文章提出一种基于多因子的认证密钥协商协议,利用安全概略算法和椭圆曲线加密算法解决HUSSAIN等人协议的安全威胁,且可实现访问控制。安全分析、安全证明及仿真实验表明,该协议的计算开销和通信开销虽然略有增长,但安全性更高。     

5G移动边缘计算场景下的快速切换认证方案

5G万物互联为用户带来极致网络体验的同时也提出了新的挑战,用户的超低时延体验、移动状态下无顿感的获取业务以及安全防护问题备受关注。移动边缘计算能够满足5G低时延、大连接、高带宽的严苛要求,作为一种多信任域共存的计算范式,多实体之间、跨信任域之间互联互通频繁,身份认证作为安全防护的第一道关口尤为重要。通过对现有边缘计算范式下的身份认证机制研究,提出了一种通过构建信任域的基于预认证的轻量级快速切换认证方案,不同区域间移动的用户能实现快速安全的切换认证。所提方案将服务和计算由云端下沉到边缘侧,生物指纹技术被用于用户端以抵御终端被盗攻击,不同区域的边缘服务器采用预认证的方式来满足快速切换需求,用户与边缘服务器采用实时协商共享会话密钥的方式建立安全通道,认证方案以异或和哈希运算来保证轻量级。对所提方案从安全性与性能两方面进行评估,其中,安全性从理论设计分析和形式化工具验证两方面进行。采用形式化分析工具AVISPA验证了在存在入侵者的情况下所提方案的安全性,与其他方案相比所提方案更安全。性能主要从认证方案的计算成本和通信成本进行评估,仿真表明,所提方案在通信成本上有较好的优势,计算开销能够满足资源...     

一种匿名认证密钥协商协议*

大多数的认证密钥协商协议没有考虑用户的匿名性,在分析已有MAKAP协议的基础上,提出了一种具有用户匿名性的认证密钥协商协议AKAPA,为用户提供隐私保护。在随机预言机模型下证明其安全性,并就增强的安全属性进行了分析,表明AKAPA具有完美前向安全性,能够抗未知共享密钥攻击和完善拒绝服务攻击等。性能分析表明效率优于已有协议,具有较高的实用性。     

面向天地一体化网络的认证与密钥协商协议

天地一体化网络具有通信模式复杂和动态性、开放性、资源受限等特点,本文针对现有认证与密钥协商协议需要多因子参与认证、计算与通信开销大等问题,分析天地一体化网络安全需求与性能需求,提出一种面向天地一体化网络的认证与密钥协商协议.为适应天地一体化网络的多层级架构,协议采用树状结构,共包括相邻节点认证与密钥协商和跨节点认证与密钥协商两个阶段.在相邻节点认证与密钥协商过程中完成各节点的组网认证,形成认证表格,为后续通信提供认证数据;采用透明传输的思想,基于切比雪夫混沌映射技术实现跨节点认证与密钥协商,保证会话密钥协商的安全性.针对节点高度动态变化的特点,设计认证预测机制,预测节点的运动轨迹,提前完成节点认证数据的迁移,实现不同通信模式无缝切换,提高通信效率.安全性分析和性能分析表明,与同类型的协议相比,本文协议在安全性上具有明显优势,并且降低了通信与计算开销,满足天地一体化网络的轻量级需求.     

一种轻量级的Ad Hoc网络会话密钥建立方案

Ad Hoc网络是一种不依赖于任何固定基础设施、没有中心控制节点,计算资源受限的新型无线移动网络.本文基于SCHNORR签名方案,提出了一个新的适用于Ad Hoc网络的基于口令认证和口令进化的轻量级双方密钥协商方案.新方案具有抗中间人攻击、抗重放攻击、密钥独立和前向安全等多种安全特性.     

基于身份的可认证非对称群组密钥协商协议

非对称群组密钥协商协议(asymmetric group key agreement,AGKA)能使群组内部成员安全地传递信息.随着大规模分布式网络协同计算的发展,参加安全协同计算的成员可能来自于不同领域、不同时区、不同云端及不同类型的网络.现有的AGKA不能满足来自于跨域及异构网络之间群组成员的安全信息交换,且安全性仅局限于抗被动攻击.提出一种基于身份的可认证非对称群组密钥协商协议(identity-based authenticated asymmetric group key agreement,IB-AAGKA),该协议实现一轮非对称群组密钥协商,解决群组成员因时区差异而不能保持多轮在线密钥协商的问题;可实现匿名性与可认证性;支持节点的动态群组密钥更新,实现了群组密钥向前保密与向后保密安全性.在decisional bilinear Diffie-Hellman(DBDH)困难假设下,证明了协议的安全性,并分析了协议的性能.     

一种基于双线性配对的移动自组网密钥协商协议

移动自组网是一种无固定网络基础设施、能量和计算资源有限的分布式动态网络,由于其无线传输链路的开放性,使得它非常需要一种计算和通信开销较小的密钥协商方案.本文基于椭圆曲线上双线性配对的概念,提出了一种适用于移动自组网的可认证密钥协商方案,既实现了邻居节点组成员身份认证的匿名性,也实现了需建立会话的节点之间的可认证密钥协商.分析表明,我们所提出的方案计算和通信开销比较小,安全性较好,非常适合于资源有限的移动自组网.     

一种异构传感网认证密钥协商方案

把集合论思想引入异构传感网认证密钥方案设计中,提出一种基于双线性对动态累加器的异构传感网认证密钥协商方案.已往基于经典随机图等理论的安全方案主要实现了节点间密钥协商,使身份认证和密钥协商割裂开来;新方案则从集合论的角度把异构传感网认证密钥协商转化为集合元素关系认证,实现了身份认证和密钥协商的有效融合.方案包括异构传感网身份认证、密钥协商和广播认证这3 部分.节点通过交换 ID 与证人信息相互验证身份合法性;合法节点协商生成共享密钥;利用广播消息动态增加/删除节点,更新节点证人信息.实验分析表明,该方案不但实现了身份认证、密钥协商和广播认证的有效融合,而且具有良好的安全性、扩展性和网络结构变化的自适应性,适用于节点性能和安全性需求较高的场景中.     

天地一体化网络中基于预认证与群组管理的安全切换方案

针对天地一体化网络中卫星节点高速移动过程的卫星接入点频繁切换问题,利用卫星轨迹可预测的特点,提出了基于组的多移动节点安全切换方案。该方案针对网络中卫星节点和地面移动节点的移动特性,对多移动节点切换过程中的交互信息进行有效汇聚;利用卫星节点运动轨迹可预测的特性,提前通过安全上下文完成预认证与会话密钥协商。和已有方案相比,所提切换方案在保证切换所必备的安全性的同时,显著减小了切换延时以及认证和密钥协商过程中节点的通信、计算负担,适用于卫星节点能量受限的天地一体化网络环境。     

基于身份的可认证多方密钥协商新方案

认证密钥协商协议允许通信方在公开的网络环境里进行认证,并协商一个安全的共享会话密钥。在McCullagh-Barreto方案的基础上,提出了一个基于身份的可认证多方密钥协商新方案。引入密钥种子更新临时公私钥对,实现了认证功能,提高了安全性,成功抵抗了Reveal查询攻击和密钥泄漏扮演攻击,且具有无密钥控制、等献性等特性。     

基于随机运算符的轻量级匿名射频识别系统双向认证协议

针对无线射频识别（RFID）系统容易遭受无线信道中的恶意攻击以及标签所有者隐私时常收到侵犯的问题,提出了一种支持匿名的轻量级RFID认证协议。首先,使用了随机数发生器生成不可预测的序列以指定参与协议的轻量级运算符;然后,通过指定种子以实现阅读器与标签之间的密钥协商;最后,实现双向认证与信息更新。通过与部分典型的轻量级方案的对比可知,所提出的方案相较同类的轻量级协议最多节省近42%的标签存储开销,同时其通信开销维持在同类方案的低水平位置,且能够支持多种安全需求。所提方案适用于低成本RFID系统。     

A secure and privacy-preserving lightweight authentication protocol for wireless communications

In wireless networks, seamless roaming allows a mobile user (MU) to utilize its services through a foreign server (FS) when outside his home server (HS). However, security and efficiency of the authentication protocol as well as privacy of MUs are of great concern to achieve an efficient authentication protocol. Conventionally, authentication involves the participation of three entities (MU, HS, and FS); however, involving an HS in the authentication process incurs heavy computational burden on it due to huge amount of roaming requests. Moreover, wireless networks are often susceptible to various forms of passive and active attacks. Similarly, mobile devices have low processing, communication, and power capabilities.

In this paper, we propose an efficient, secure, and privacy-preserving lightweight authentication protocol for roaming MUs in wireless networks without engaging an HS. The proposed authentication protocol uses unlinkable pseudo-IDs and lightweight time-bound group signature to provide strong user anonymity, and a cost-effective cryptographic scheme to achieve security of the authentication protocol. Similarly, we implement a better billing system for MUs and a computationally efficient revocation scheme. Our analysis shows that the protocol has better performance than other related authentication protocols in wireless communications in terms of security, privacy, and efficiency.     

Remote user authentication and key agreement for mobile client–server environments on elliptic curve cryptography

In recent years, with the rapid advance of wireless mobile networks, secure and efficient authentication mechanisms that can operate over insecure wireless channels have become increasingly essential. To improve the efficiency in the energy-limited mobile devices, many authentication schemes using elliptic curve cryptography (ECC) have been presented. However, these schemes are still inefficient in terms of computation cost and communication overhead. Moreover, they suffer from various attacks, making them impractical due to their inherent design. To address their weaknesses, we propose a more efficient ID-based authentication scheme on ECC for mobile client–server environments with considering security requirements. The proposed scheme not only provides mutual authentication but also achieves session key agreement between the client and the server. Through a rigorous formal security proof under random oracle model, it has been indicated that the proposed protocol is secure against security threats. The informal security analysis shows that our scheme can resist well-known attacks and provides user anonymity. Performance analysis and comparison results demonstrate that our scheme outperforms the related competitive works and is more suitable for practical application in mobile client–server environments.     

A simple and robust handover authentication between HeNB and eNB in LTE networks

There are two types of base stations in the Long Term Evolution (LTE) wireless networks, Home eNodeB (HeNB) and eNodeB (eNB). To achieve seamless handovers between the HeNB and the eNB is critical to support mobility in the LTE networks. A handover from an eNB/HeNB to a new eNB/HeNB, suggested by the third Generation Partnership Project (3GPP), requires distinct procedures for different mobility scenarios with a complex key management mechanism, which will increase the system complexity. Besides, it cannot achieve backward security in handover procedures. Furthermore, the existing handover schemes for other wireless networks are not suitable for the mobility scenarios in the LTE networks due to their inherent features. In this paper, we propose a fast and secure handover authentication scheme, which is to fit in with all of the mobility scenarios in the LTE networks. Compared with other handover schemes, our scheme cannot only achieve a simple authentication process with desirable efficiency, but also provide several security features including Perfect Forward/Backward Secrecy (PBS/PFS), which has never been achieved by previous works. The experimental results and formal verification by using the AVISPA tool show that the proposed scheme is efficient and secure against various malicious attacks.     

5G异构网络中基于群组的切换认证方案

随着5G网络的发展,各类网络服务质量极大提升的同时网络环境也愈加复杂,从而带来了一系列安全挑战。切换认证可以解决用户在不同类型网络间的接入认证问题,但现存方案仍存在一些不足,还需要解决如全局切换认证、密钥协商、隐私保护、抵抗伪装攻击、抵抗中间人攻击、抵抗重放攻击以及群组用户切换效率等问题。针对这些问题,提出了一个5G异构网络中基于群组的切换认证方案。在所提出的方案中,注册域服务器在区块链上为每个用户存入一个通行证,任何实体都可以利用该通行证对用户进行认证,从而实现全局切换认证。对于群组用户,各用户分别设置可聚合的认证参数,验证者通过验证聚合签名实现对群组用户的批量验证。新方案不仅提升了群组用户切换时的效率,同时还满足上述安全性要求。基于形式化分析软件AVISPA的分析结果表明,所提出的方案是安全的。性能分析表明,所提出的方案执行批量验证时的效率比现存方案至少提升了89.8%。     

Efficient handover authentication with user anonymity and untraceability for Mobile Cloud Computing

Various wireless communication technologies have been generated and deployed on account of mass requirements. These enable cloud computing with integration with mobility and Mobile Cloud Computing (MCC) becomes the trend of future generation computing paradigm. In this paper, we address a challenging issue of MCC technology—security and privacy of the handover process. We propose a new design of handoff authentication for heterogeneous mobile cloud networks, which provides user anonymity and untraceability. Compared with previous protocols, our proposed mechanism achieves comprehensive features of universality, robust security and efficiency.     

A DoS and fault-tolerant authentication protocol for group communications in ad hoc networks

In this paper, a novel authentication protocol is proposed, which satisfies both security and reliability requirements for group communications in ad hoc networks. The security features include identity anonymity and location intracability, periodic one-way session key and pseudonym identity refreshment with implicit authentication, dynamic joining and leaving an in-progress communication session, and data encryption. The reliability features include efficient Denial of Service tolerance for broadcasting refreshment messages, fault-tolerance for recovering lost refreshment messages, robustness for resisting the clock skews among member nodes and seamless key switch without disrupting ongoing data transmissions. The performance and security analysis show that the communication and computation overhead of the proposed protocol is similar to the existing one, while the security can be enhanced significantly. The simulation results demonstrate the robustness of the proposed protocol under severe Denial of Service attack and poor wireless channel quality.     

An AAA scheme using ID-based ticket with anonymity in future mobile communication

An AAA protocol is an information protection technology that systematically provides authentication, authorization and accounting functions not only in existing wired networks, but also in rapidly developing wireless networks. Currently, standardization of various applied services is in progress and involves AAA standardization for a mobile user in a wireless network. Various studies have considered using AAA with a roaming service in a mobile IPv6 network, between heterogeneous networks. In this paper, we proposed an ID-based ticket for user authentication with a mobile device in a ubiquitous environment. Service is seamless, even when a mobile device moves from the home network to a foreign network. In addition, since the ticket is renewed from the foreign network, the overhead of the home authentication server is reduced, and the anonymity ID guarantees anonymity during service.     

基于假名的智能交通条件隐私保护认证协议

在智能交通、无人驾驶等场景中,车辆节点与路边设施进行数据交换以实现车路协同,有助于提高交通安全、缓解交通拥堵.但该场景下的数据交换面临很多安全问题,隐私泄露是其中的主要安全风险之一.现有智能交通隐私保护方案多涉及复杂度较高的运算或需配置高成本的防篡改设备,效率较低,不能满足无人驾驶等智能交通应用的实时要求.为此,文章提...     

面向多网关的无线传感器网络多因素认证协议

无线传感器网络作为物联网的重要组成部分,广泛应用于环境监测、医疗健康、智能家居等领域.身份认证为用户安全地访问传感器节点中的实时数据提供了基本安全保障,是保障无线传感器网络安全的第一道防线;前向安全性属于系统安全的最后一道防线,能够极大程度地降低系统被攻破后的损失,因此一直被学术及工业界视为重要的安全属性.设计面向多网关的可实现前向安全性的无线传感器网络多因素身份认证协议是近年来安全协议领域的研究热点.由于多网关无线传感器网络身份认证协议往往应用于高安全需求场景,一方面需要面临强大的攻击者,另一方面传感器节点的计算和存储资源却十分有限,这给如何设计一个安全的多网关无线传感器网络身份认证协议带来了挑战.近年来,大量的多网关身份认证协议被提出,但大部分都随后被指出存在各种安全问题.2018年,Ali等人提出了一个适用于农业监测的多因素认证协议,该协议通过一个可信的中心(基站)来实现用户与外部的传感器节点的认证;Srinivas等人提出了一个通用的面向多网关的多因素身份认证协议,该协议不需要一个可信的中心,而是通过在网关之间存储共享秘密参数来完成用户与外部传感器节点的认证.这两个协议是多网关无线传感器网络身份认证协议的典型代表,分别代表了两类实现不同网关间认证的方式:1)基于可信基站,2)基于共享秘密参数.分析指出这两个协议对离线字典猜测攻击、内部攻击是脆弱的,且无法实现匿名性和前向安全性.鉴于此,本文提出一个安全增强的可实现前向安全性的面向多网关的无线传感器网络多因素认证协议.该协议采用Srinivas等协议的认证方式,即通过网关之间的共享秘密参数完成用户与外部传感器节点的认证,包含两种典型的认证场景.对新协议进行了BAN逻辑分析及启发式分析,分析结果表明该协议实现了双向认证,且能够安全地协商会话密钥以及抵抗各类已知的攻击.与相关协议的对比结果显示,新协议在提高安全性的同时,保持了较高的效率,适于资源受限的无线传感器网络环境.