基于标识的无线Mesh网络接入认证协议

为解决无线Mesh网络节点高效、安全入网认证的问题,提出了一种新的基于标识认证的无线Mesh网络接入认证协议.该协议针对无线Mesh网络的特点,将标识认证体制引入到无线Mesh节点接入认证当中,并在标识认证的基础上一次性完成了入网节点的双向身份认证、网络认证和空口密钥的建立3个步骤.简化了认证的流程,减少了认证的时延,达到了分布式认证的效果,为大规模的节点接入提供了一种新的认证方案.通过BAN逻辑形式化方法证明了协议的安全性,通过效率分析说明了协议的高效性.     

Design of certification authority using secret redistribution and multicast routing in wireless mesh networks

Wireless mesh networks (WMNs) should provide authentication and key management without a trusted third party because of their self-organizing and self-configuring characteristics. Several solutions to this problem have been proposed in mobile ad hoc networks (MANETs). But they are not optimal for WMNs because WMNs are with stationary mesh routers (MRs) that do not suffer from the limited power problem. In this paper, we design an architecture of mesh certification authority (MeCA) for WMNs. In MeCA, the secret key and functions of certification authority (CA) are distributed over several MRs. For secret sharing and redistribution, we develop the fast verifiable share redistribution (FVSR) scheme, which works for threshold cryptography and minimizes the possibility of secret disclosure when some shareholders are compromised by adversaries. MeCA adopts the multicasting based on Ruiz tree, which is optimal in reducing the operation overhead. It can update, revoke, and verify certificates of WMN nodes in a secure and efficient manner. Simulation results show that MeCA does not disclose its secret key even under severe attacks while incurring low overhead compared to other existing schemes in MANETs.     

无线传感器网络中的广播认证协议

在总结广播认证协议理想属性的基础上,对现有基于数字签名技术和对称加密技术的广播认证协议优缺点进行了分析讨论,并指出其对无线传感器网络广播认证协议设计的借鉴价值。将广播认证协议中的参数初始化和密钥更新等与密钥管理相关的问题归结为认证系统的完备性问题,并指出现有技术方案在解决该问题时存在的缺陷。初步探讨了无线传感器网络广播认证协议分级安全功能支持的意义,并给出了相应的方案设计思路。     

具有可扩展性的无线Mesh网络接入方法

分析了无线Mesh网络的特点和安全机制,给出了无线Mesh客户端的接入过程,通过面向方面编程AOP、依赖注入DI和软插件技术实现接入系统的认证协议、密钥协商协议和物理网络适配能力的可扩展性。设计了双向身份认证协议和会话密钥协商协议,能够抵抗反射攻击并保证会话的前向保密性。     

Provably Secure Three-Party Authenticated Quantum Key Distribution Protocols

This work presents quantum key distribution protocols (QKDPs) to safeguard security in large networks, ushering in new directions in classical cryptography and quantum cryptography. Two three-party QKDPs, one with implicit user authentication and the other with explicit mutual authentication, are proposed to demonstrate the merits of the new combination, which include the following: 1) security against such attacks as man-in-the-middle, eavesdropping and replay; 2) efficiency is improved as the proposed protocols contain the fewest number of communication rounds among existing QKDPs; and 3) two parties can share and use a long-term secret (repeatedly). To prove the security of the proposed schemes, this work also presents a new primitive called the unbiased-chosen basis (UCB) assumption     

Design of a password-based authenticated key exchange protocol for SIP

The Session Initiation Protocol (SIP) is a signaling communications protocol, which has been chosen for controlling multimedia communication in 3G mobile networks. In recent years, password-based authenticated key exchange protocols are designed to provide strong authentication for SIP. In this paper, we address this problem in two-party setting where the user and server try to authenticate each other, and establish a session key using a shared password. We aim to propose a secure and anonymous authenticated key exchange protocol, which can achieve security and privacy goal without increasing computation and communication overhead. Through the analysis, we show that the proposed protocol is secure, and has computational and computational overheads comparable to related authentication protocols for SIP using elliptic curve cryptography. The proposed protocol is also provably secure in the random oracle model.     

基于Weil对的成对密钥协商协议

为了实现网络安全,一个重要的方法是网络用户传送加密和可鉴定的消息.此时,用来加密和鉴定的密钥应该由网络中的用户协商得到.提出了3个基于Weil对的成对密钥协商协议.在协议中,所有用户共享一个秘密信息,通过较少的步骤,同时实现密钥协商和用户认证.提出的协议满足如下的安全特性:部分密钥泄漏的安全性、完备的前向安全性、个人密钥泄漏的安全性、无不明的密钥共享和无法控制密钥等.     

Ad Hoc网络中的组密钥生成协议

由于AdHoc网络缺少基础通信设施的支持,网络拓扑的动态变化,使得传统的基于可信任第三方的CA认证方案不再适用,而基于门限加密的分布方案有其固有的假设条件,在具体实施时也有很大的困难。区别于分布方案,该文介绍的组密钥协议不需要有安全信道的假设,所有的节点都参与密钥的生成。该文分类分析了几种协议的前后向安全性,容错性和密钥生成时的认证功能。并在此基础上对协议的复杂度做了比较,给出了进一步完善协议需解决的问题。     

普适计算的信任认证

在普适计算环境中,用户能够在任何时间、任何地点访问资源,获得服务。但是这种无处不在性和移动性的环境带来了新的安全问题。资源的拥有者和请求者一般互相不知道。认证是安全的基石,没有认证,系统的保密性、完整性和可用性都将受到影响。可是传统认证是基于身份的认证,不适合普适环境中对陌生实体的认证。本文在分析普适计算的认证要求后,指出了在普适计算环境中应该先在陌生的实体间建立信任关系,然后可以用几乎所有的标准密钥交换协议进行安全认证。提出了用资源限制信任协商技术在陌生人之间建立信任关系。由于它避免了大量的公钥密码操作所带来的计算负担,因此比较适合计算能力有限的设备之间建立信任关系。     

无线传感器网络节点间认证及密钥协商协议

无线传感器网络的特性使它面临着比传统无线网络更大的安全挑战,其安全解决方案必须兼顾安全性和系统性能等因素。节点间认证及密钥协商是构建安全网络最基本的协议,是密钥管理协议和安全路由协议等的实现基础。很明显,包括传统Adhoc在内的各种无线网络领域中的安全认证及密钥协商机制都无法适用于无线传感器网络。为此,在充分考虑无线网络攻击方法和无线传感器网络自身特点的基础上,结合基于ID的公钥密码技术,提出了椭圆曲线双线性对上的无线传感器网络节点安全认证及密钥协商协议。分析发现,该协议不仅满足安全性要求,同时,能够适合无线传感器网络的特殊应用要求。     

Reliable and fully distributed trust model for mobile ad hoc networks

A mobile ad hoc network (MANET) is a wireless communication network which does not rely on a pre-existing infrastructure or any centralized management. Securing the exchanges in MANETs is compulsory to guarantee a widespread development of services for this kind of networks. The deployment of any security policy requires the definition of a trust model that defines who trusts who and how. Our work aims to provide a fully distributed trust model for mobile ad hoc networks. In this paper, we propose a fully distributed public key certificate management system based on trust graphs and threshold cryptography. It permits users to issue public key certificates, and to perform authentication via certificates' chains without any centralized management or trusted authorities. Moreover, thanks to the use of threshold cryptography; our system resists against false public keys certification. We perform an overall evaluation of our proposed approach through simulations. The results indicate out performance of our approach while providing effective security.     

面向机顶盒的数字版权管理模型

提出一种面向机顶盒的数字版权管理安全模型。将数字内容与版权相分离,通过内容加密密钥保护数字内容,利用与客户设备信息相关的设备密钥保护每一份许可证,在用户与服务器之间实现双向认证。实验结果表明,该模型利用加解密技术、数字签名技术和授权管理等技术,能实现对高清内容、MTV、TV媒体杂志等数字内容的控制和管理。     

面向多网关的无线传感器网络多因素认证协议

无线传感器网络作为物联网的重要组成部分,广泛应用于环境监测、医疗健康、智能家居等领域.身份认证为用户安全地访问传感器节点中的实时数据提供了基本安全保障,是保障无线传感器网络安全的第一道防线;前向安全性属于系统安全的最后一道防线,能够极大程度地降低系统被攻破后的损失,因此一直被学术及工业界视为重要的安全属性.设计面向多网关的可实现前向安全性的无线传感器网络多因素身份认证协议是近年来安全协议领域的研究热点.由于多网关无线传感器网络身份认证协议往往应用于高安全需求场景,一方面需要面临强大的攻击者,另一方面传感器节点的计算和存储资源却十分有限,这给如何设计一个安全的多网关无线传感器网络身份认证协议带来了挑战.近年来,大量的多网关身份认证协议被提出,但大部分都随后被指出存在各种安全问题.2018年,Ali等人提出了一个适用于农业监测的多因素认证协议,该协议通过一个可信的中心(基站)来实现用户与外部的传感器节点的认证;Srinivas等人提出了一个通用的面向多网关的多因素身份认证协议,该协议不需要一个可信的中心,而是通过在网关之间存储共享秘密参数来完成用户与外部传感器节点的认证.这两个协议是多网关无线传感器网络身份认证协议的典型代表,分别代表了两类实现不同网关间认证的方式:1)基于可信基站,2)基于共享秘密参数.分析指出这两个协议对离线字典猜测攻击、内部攻击是脆弱的,且无法实现匿名性和前向安全性.鉴于此,本文提出一个安全增强的可实现前向安全性的面向多网关的无线传感器网络多因素认证协议.该协议采用Srinivas等协议的认证方式,即通过网关之间的共享秘密参数完成用户与外部传感器节点的认证,包含两种典型的认证场景.对新协议进行了BAN逻辑分析及启发式分析,分析结果表明该协议实现了双向认证,且能够安全地协商会话密钥以及抵抗各类已知的攻击.与相关协议的对比结果显示,新协议在提高安全性的同时,保持了较高的效率,适于资源受限的无线传感器网络环境.     

一种WIA-PA网络的密钥分配方案

密钥分配是WIA-PA网络通信安全的基础,由于WIA-PA用于工业现场环境恶劣、节点资源非常受限、mesh与star双层拓扑结构等特点,传统的基于公钥和可信任的密钥分配中心等方式不能实用;针对WIA-PA网络特点,提出用对称加密算法和单向哈希函数的密钥管理方案,并可满足前向和后向安全性;与目前使用的随机密钥分配相比,方案不仅具有较好的效率,并且更适合于WIA-PA网络。     

Simple password-based three-party authenticated key exchange without server public keys

Password-based three-party authenticated key exchange protocols are extremely important to secure communications and are now extensively adopted in network communications. These protocols allow users to communicate securely over public networks simply by using easy-to-remember passwords. In considering authentication between a server and user, this study categorizes password-based three-party authenticated key exchange protocols into explicit server authentication and implicit server authentication. The former must achieve mutual authentication between a server and users while executing the protocol, while the latter only achieves authentication among users. This study presents two novel, simple and efficient three-party authenticated key exchange protocols. One protocol provides explicit server authentication, and the other provides implicit server authentication. The proposed protocols do not require server public keys. Additionally, both protocols have proven secure in the random oracle model. Compared with existing protocols, the proposed protocols are more efficient and provide greater security.     

一种基于非对称密码学的分布式认证方案

网络安全技术,特别是网络环境中的身份认证协议及系统,对于应用的安全起着非常重要的作用,并已经成为影响网络进一步发展的重要因素。在开放网络中真正安全可靠的是密码学身份认证协议,根据密码学基础可分为基于对称密码和非对称密码两大类。通过对经典的kerberos系统的分析,给出了与非对称密码系统结合的改进方法,增强了其安全性和可扩展性。     

大规模延迟容忍网络中基于分级身份的认证密钥协商协议

大规模延迟容忍网络具有覆盖范围广、链路间歇性连通及通信时延长等特点, 这使得现有认证密钥协商协议存在系统管理瓶颈及通信时延长等问题。设计了一种适用于大规模延迟容忍网络环境下的认证密钥协商协议, 依赖基于分级身份的密码机制, 通过密钥分级派生, 减少系统管理瓶颈, 同时消除对证书的依赖, 减少协商时延。与现有通用环境下基于分级身份的同类协议相比, 该协议的通信开销及双线性对计算开销较小, 且均为常量, 不受节点层次数影响, 可扩展性更强, 并且具有密钥派生控制功能。最后, 在标准模型下证明了协议的安全性。     

A User Authentication Protocol Combined with the Trust Model,Biometrics and ECC for Wireless Sensor Networks

In this article, a new user authentication protocol using trust model, elliptic curve cryptography and biometrics for WSNs is submitted. The result of the trust model analysis indicates that the model can improve the model’s ability of withstanding attacks from the malicious nodes. The results of safety analysis and performance analysis for our proposed user authentication protocol demonstrate that this protocol can be flexible to all sorts of common known attacks and performs similarly or better compared with some active user authentication protocols. It is suitable for WSNs which have a prominent request for the security and the performance.     

无线传感器网络基于身份的密钥建立协议综述

无线传感器网络(WSN)的高度自治和资源严重受限等特点,使其安全问题比传统Ad hoc网络面临更大的挑战.密钥管理是WSN安全的一个基本问题,密钥建立作为密钥管理的重要内容,必须兼顾安全性和性能等方面因素.综述了WSN基于身份的密钥建立协议.介绍了基于身份密码体制的基本要素,给出了基于身份的密钥协商协议的安全属性和安全模型,详细分析比较了现有的WSN基于身份的密钥建立协议,指出了它们安全性和性能方面的不足,并对未来的研究方向进行了探讨.     

基于门限完全分布式密钥管理方案

adhoc网络作为一种无线移动网络正成为网络研究中的热点之一。针对移动adhoc网络的特性和对目前已有的移动adhoe网络密钥管理方案的分析,提出了一种基于信任图和门限密码技术的全分布、自组织的移动adhoc网络密钥管理新方案。该方案允许节点发布公钥证书并且通过证书链实施认证,有效地解决了网络节点之间的信任,同时又阻止恶意节点发布错误公钥证书欺骗认证服务。该方案具有较高的可靠性、扩展性和安全性,适用于大规模移动ad hoc网络。