面向多网关的无线传感器网络多因素认证协议

无线传感器网络作为物联网的重要组成部分,广泛应用于环境监测、医疗健康、智能家居等领域.身份认证为用户安全地访问传感器节点中的实时数据提供了基本安全保障,是保障无线传感器网络安全的第一道防线;前向安全性属于系统安全的最后一道防线,能够极大程度地降低系统被攻破后的损失,因此一直被学术及工业界视为重要的安全属性.设计面向多网关的可实现前向安全性的无线传感器网络多因素身份认证协议是近年来安全协议领域的研究热点.由于多网关无线传感器网络身份认证协议往往应用于高安全需求场景,一方面需要面临强大的攻击者,另一方面传感器节点的计算和存储资源却十分有限,这给如何设计一个安全的多网关无线传感器网络身份认证协议带来了挑战.近年来,大量的多网关身份认证协议被提出,但大部分都随后被指出存在各种安全问题.2018年,Ali等人提出了一个适用于农业监测的多因素认证协议,该协议通过一个可信的中心(基站)来实现用户与外部的传感器节点的认证;Srinivas等人提出了一个通用的面向多网关的多因素身份认证协议,该协议不需要一个可信的中心,而是通过在网关之间存储共享秘密参数来完成用户与外部传感器节点的认证.这两个协议是多网关无线传感器网络身份认证协议的典型代表,分别代表了两类实现不同网关间认证的方式:1)基于可信基站,2)基于共享秘密参数.分析指出这两个协议对离线字典猜测攻击、内部攻击是脆弱的,且无法实现匿名性和前向安全性.鉴于此,本文提出一个安全增强的可实现前向安全性的面向多网关的无线传感器网络多因素认证协议.该协议采用Srinivas等协议的认证方式,即通过网关之间的共享秘密参数完成用户与外部传感器节点的认证,包含两种典型的认证场景.对新协议进行了BAN逻辑分析及启发式分析,分析结果表明该协议实现了双向认证,且能够安全地协商会话密钥以及抵抗各类已知的攻击.与相关协议的对比结果显示,新协议在提高安全性的同时,保持了较高的效率,适于资源受限的无线传感器网络环境.     

天地一体化网络中基于预认证与群组管理的安全切换方案

针对天地一体化网络中卫星节点高速移动过程的卫星接入点频繁切换问题,利用卫星轨迹可预测的特点,提出了基于组的多移动节点安全切换方案。该方案针对网络中卫星节点和地面移动节点的移动特性,对多移动节点切换过程中的交互信息进行有效汇聚;利用卫星节点运动轨迹可预测的特性,提前通过安全上下文完成预认证与会话密钥协商。和已有方案相比,所提切换方案在保证切换所必备的安全性的同时,显著减小了切换延时以及认证和密钥协商过程中节点的通信、计算负担,适用于卫星节点能量受限的天地一体化网络环境。     

An efficient design and validation technique for secure handover between 3GPP LTE and WLANs systems

Future generations wireless systems, which integrate different wireless access networks together, will support a secured seamless mobility and a wide variety of applications and services with different quality of service (QoS) requirements. Most of the existing re-authentication protocols during vertical handover still have certain limitations such as man in the middle, eavesdropping and session hijacking attacks, and unacceptable delay for real time applications. In this article, we propose two re-authentication schemes to secure handover between 3GPP LTE and WLANs systems: Initial Handover Re-authentication Protocol, and Local Re-authentication Protocol. The second proposed protocol is executed locally in a WLAN network without contacting the authentication server of the home network for credentials verification. In fact, after a successful execution of the Initial Handover Re-authentication Protocol, the local key (LK) is shared between USIM and the authentication server of the WLAN. It is then used for securing handover and traffic in WLAN networks. Performance evaluation results obtained using simulation analysis show that the proposed re-authentication protocol enhances handover parameters such as handover latency, handover blocking rate and packet loss rate. Additionally, the proposed enhanced fast re-authentication protocol has been modeled and verified using the software AVISPA and is found to be safe.     

SE-AKA: A secure and efficient group authentication and key agreement protocol for LTE networks

To support Evolved Packet System (EPS) in the Long Term Evolution (LTE) networks, the 3rd Generation Partnership Project (3GPP) has proposed an authentication and key agreement (AKA) protocol, named EPS-AKA, which has become an emerging standard for fourth-generation (4G) wireless communications. However, due to the requirement of backward compatibility, EPS-AKA inevitably inherits some defects of its predecessor UMTS-AKA protocol that cannot resist several frequent attacks, i.e., redirection attack, man-in-the-middle attack, and DoS attack. Meanwhile, there are additional security issues associated with the EPS-AKA protocol, i.e., the lack of privacy-preservation and key forward/backward secrecy (KFS/KBS). In addition, there are new challenges with the emergence of group-based communication scenarios in authentication. In this paper, we propose a secure and efficient AKA protocol, called SE-AKA, which can fit in with all of the group authentication scenarios in the LTE networks. Specifically, SE-AKA uses Elliptic Curve Diffie-Hellman (ECDH) to realize KFS/KBS, and it also adopts an asymmetric key cryptosystem to protect users’ privacy. For group authentication, it simplifies the whole authentication procedure by computing a group temporary key (GTK). Compared with other authentication protocols, SE-AKA cannot only provide strong security including privacy-preservation and KFS/KBS, but also provide a group authentication mechanism which can effectively authenticate group devices. Extensive security analysis and formal verification by using proverif have shown that the proposed SE-AKA is secure against various malicious attacks. In addition, elaborate performance evaluations in terms of communication, computational and storage overhead also demonstrates that SE-AKA is more efficient than those existing protocols.     

5G异构网络中基于群组的切换认证方案

随着5G网络的发展,各类网络服务质量极大提升的同时网络环境也愈加复杂,从而带来了一系列安全挑战。切换认证可以解决用户在不同类型网络间的接入认证问题,但现存方案仍存在一些不足,还需要解决如全局切换认证、密钥协商、隐私保护、抵抗伪装攻击、抵抗中间人攻击、抵抗重放攻击以及群组用户切换效率等问题。针对这些问题,提出了一个5G异构网络中基于群组的切换认证方案。在所提出的方案中,注册域服务器在区块链上为每个用户存入一个通行证,任何实体都可以利用该通行证对用户进行认证,从而实现全局切换认证。对于群组用户,各用户分别设置可聚合的认证参数,验证者通过验证聚合签名实现对群组用户的批量验证。新方案不仅提升了群组用户切换时的效率,同时还满足上述安全性要求。基于形式化分析软件AVISPA的分析结果表明,所提出的方案是安全的。性能分析表明,所提出的方案执行批量验证时的效率比现存方案至少提升了89.8%。     

下一代高速铁路异构网络切换安全认证

近年来,随着高速铁路无线通信技术的快速发展, GSM-R无线通信系统将逐步向LTE-R系统演进。在此演进过程中存在GSM-R和LTE-R长期共存的局面,如何实现高速铁路无线通信异构网络之间的快速切换和安全认证成为铁路无线通信研究的热点问题。针对高速铁路无线通信异构网络切换认证过程中,存在安全性低和认证开销高等问题,提出了一种适用于下一代高速铁路异构网络的轻量级切换安全认证方案。首先,采用哈希函数等操作生成切换请求Token和异构网络切换认证码PASS,实现了用户身份匿名性和可追溯性等安全要求,并且高速列车无需多次注册就可实现异构网络间的无缝切换。其次,设计了基于椭圆曲线密钥交换的轻量级切换算法,完成了高速列车与目标基站的相互认证和密钥协商,降低了计算开销和通信开销,实现了会话协商密钥的前后向安全性。最后,采用形式化方式BAN逻辑进行了安全性验证,并使用朔黄铁路LTE-R线路实测数据进一步对本文所提方案的有效性进行了验证,分析得出所提方案能够满足可追溯性、匿名性、抗伪装用户攻击、抗中间人攻击和抗重放攻击等安全特性。性能分析表明,本文方案在通信开销和计算开销方面较比较方法性能更优,能够满足...     

Adaptive security design with malicious node detection in cluster-based sensor networks

Distributed wireless sensor networks have problems on detecting and preventing malicious nodes, which always bring destructive threats and compromise multiple sensor nodes. Therefore, sensor networks need to support an authentication service for sensor identity and message transmission. Furthermore, intrusion detection and prevention schemes are always integrated in sensor security appliances so that they can enhance network security by discovering malicious or compromised nodes. This study provides adaptive security modules to improve secure communication of cluster-based sensor networks. A dynamic authentication scheme in the proposed primary security module enables existing nodes to authenticate new incoming nodes, triggering the establishment of secure links and broadcast authentication between neighboring nodes. This primary security design prevents intrusion from external malicious nodes using the authentication scheme. For advanced security design, the proposed intrusion detection module can exclude internal compromised nodes, which contains alarm return, trust evaluation, and black/white lists schemes. This study adopts the two above mentioned modules to achieve secure communication in cluster-based sensor networks when the network lifetime is divided into multiple cluster rounds. Finally, the security analysis results indicate that the proposed design can prevent and detect malicious nodes with a high probability of success by cluster-based and neighbor monitor mechanisms. According to the performance evaluation results, the proposed security modules cause low storage, computation, and communication overhead to sensor nodes.     

无线传感器网络密钥种子管理和分配模型及应用

随机密钥种子预分配方案是实现安全的无线传感器网络应用的首选方案,该方案在无线传感器网络节点布置之前建立和分配某种密钥种子信息,在网络节点布置之后利用密钥种子信息建立或发现节点之间安全的通信链路.根据传感器网络的通信保密和节点认证需求,提出了通用密钥种子管理和分配模型(KSMA).该模型可用于预分配方案的安全分析,描述了预分配方案的5个安全属性.在KSMA模型中,基于单向累加器,定义了一类新的密钥种子结构,提出了新的密钥种子预分配方案和节点秘密共享发现协议,并在UC(universally composable)安全框架中对新的秘密共享发现协议进行了可证明安全分析.在新方案中说明了如何设定密钥池参数和节点密钥链参数的方法,该方法不仅保证了高概率的安全链路建立,而且可以通过节点身份证人确认机制实现节点之间身份认证,有效地防御传感器网络Sybil攻击.通过与其他方案的分析对比,新方案改善了网络安全弹性、综合性能良好.     

支持网内处理的无线传感器网络加密方案

随着无线传感器网络的广泛应用,网络安全成了很多传感器网络应用的关键.在研究现有的安全方案的基础上,提出了一种支持安全网内处理的无线传感器网络加密方案.它能提供网络数据内容的语义加密、数据源认证、数据完整性和数据新鲜.同时,通过安全的网内处理延长了无线传感器网络的生命期.     

A Generic Framework for Anonymous Authentication in Mobile Networks

Designing an anonymous user authentication scheme in global mobility networks is a non-trivial task because wireless networks are susceptible to attacks and mobile devices powered by batteries have limited communication, processing and storage capabilities. In this paper, we present a generic construction that converts any existing secure password authen- tication scheme based on a smart card into an anonymous authentication scheme for roaming services. The security proof of our construction can be derived from the underlying password authentication scheme employing the same assumptions. Compared with the original password authentication scheme, the transformed scheme does not sacrifice the authentication effciency, and additionally, an agreed session key can be securely established between an anonymous mobile user and the foreign agent in charge of the network being visited. Furthermore, we present an instantiation of the proposed generic construction. The performance analysis shows that compared with other related anonymous authentication schemes, our instantiation is more effcient.     

对两个无线传感器网络中匿名身份认证协议的安全性分析

针对设计安全高效的无线传感器网络环境下匿名认证协议的问题,基于广泛接受的攻击者能力假设,采用基于场景的攻击技术,对新近提出的两个无线传感器网络环境下的双因子匿名身份认证协议进行了安全性分析。指出刘聪等提出的协议(刘聪,高峰修,马传贵,等.无线传感器网络中具有匿名性的用户认证协议.计算机工程,2012,38(22):99-103)无法实现所声称的抗离线口令猜测攻击,且在协议可用性方面存在根本性设计缺陷;指出闫丽丽等提出的协议(闫丽丽,张仕斌,昌燕.一种传感器网络用户认证与密钥协商协议.小型微型计算机系统,2013,34(10):2342-2344)不能抵抗用户仿冒攻击和离线口令猜测攻击,且无法实现用户不可追踪性。结果表明,这两个匿名身份认证协议都存在严重安全缺陷,不适于在实际无线传感器网络环境中应用。     

移动IPv6网络安全接入认证方案

对于移动IPv6网络,身份认证是网络安全的关键问题之一.针对移动IPv6网络的接入认证,提出了一种基于移动互联网双向认证方案.在移动切换过程中的接入认证和家乡注册,采用对家乡注册消息进行基于双私钥签名的方式,实现了家乡代理和移动节点分别对注册消息的签名,实现了接入认证与家乡注册的并发执行,移动用户和接入网络的一次交互实现了用户和接入域的有效双向认证.理论分析和数据结果表明,方案的认证总延时和切换延时要优于传统方法,有效地降低了系统认证的延时.安全性分析表明,框架中的基于双私钥的CPK方案满足双向接入认证安全,有效地解决了密钥托管问题.     

Design and analysis of secure host-based mobility protocol for wireless heterogeneous networks

Mobility protocols allow hosts to change their location or network interface while maintaining ongoing sessions. While such protocols can facilitate vertical mobility in a cost-efficient and access agnostic manner, they are not sufficient to address all security issues when used in scenarios requiring local mobility management. In this paper, we propose a new scheme that makes Host Identity Protocol (HIP) able to serve as an efficient and secure mobility protocol for wireless heterogeneous networks while preserving all the advantages of the base HIP functions as well. Our proposal, called Heterogeneous Mobility HIP (HMHIP), is based on hierarchical topology of rendezvous Servers (RVSs), signaling delegation, and inter-RVS communication to enable secure and efficient network mobility support in the HIP layer. Formal security analysis using the AVISPA tool and performance evaluation of this method are provided; they confirm the safety and efficiency of the proposed solution. HMHIP reduces handover latency and packet overhead during handovers by achieving registration locally.     

A novel re-authentication scheme based on tickets in wireless local area networks

Fast re-authentication schemes during handover of a mobile station are essential to seamless services for real-time multimedia applications in wireless local area networks. Although much research has been done to reduce re-authentication latency, the schemes developed so far either suffer from heavy burden problems or degrade the security level. In this paper, a novel ticket-based approach is proposed for re-authentication during handover. The mobile station receives handover tickets from the authentication server as a proof of authorization, and it presents the corresponding ticket when associating with a new access point. Our scheme reduces re-authentication delay to the delay of 2-way handshake between a mobile station and an access point. Furthermore, this scheme imposes less burden over the entities compared with other proactive key pre-distribution schemes, while satisfying 802.11i security requirements.     

Remote user authentication and key agreement for mobile client–server environments on elliptic curve cryptography

In recent years, with the rapid advance of wireless mobile networks, secure and efficient authentication mechanisms that can operate over insecure wireless channels have become increasingly essential. To improve the efficiency in the energy-limited mobile devices, many authentication schemes using elliptic curve cryptography (ECC) have been presented. However, these schemes are still inefficient in terms of computation cost and communication overhead. Moreover, they suffer from various attacks, making them impractical due to their inherent design. To address their weaknesses, we propose a more efficient ID-based authentication scheme on ECC for mobile client–server environments with considering security requirements. The proposed scheme not only provides mutual authentication but also achieves session key agreement between the client and the server. Through a rigorous formal security proof under random oracle model, it has been indicated that the proposed protocol is secure against security threats. The informal security analysis shows that our scheme can resist well-known attacks and provides user anonymity. Performance analysis and comparison results demonstrate that our scheme outperforms the related competitive works and is more suitable for practical application in mobile client–server environments.     

A secure and privacy-preserving lightweight authentication protocol for wireless communications

In wireless networks, seamless roaming allows a mobile user (MU) to utilize its services through a foreign server (FS) when outside his home server (HS). However, security and efficiency of the authentication protocol as well as privacy of MUs are of great concern to achieve an efficient authentication protocol. Conventionally, authentication involves the participation of three entities (MU, HS, and FS); however, involving an HS in the authentication process incurs heavy computational burden on it due to huge amount of roaming requests. Moreover, wireless networks are often susceptible to various forms of passive and active attacks. Similarly, mobile devices have low processing, communication, and power capabilities.

In this paper, we propose an efficient, secure, and privacy-preserving lightweight authentication protocol for roaming MUs in wireless networks without engaging an HS. The proposed authentication protocol uses unlinkable pseudo-IDs and lightweight time-bound group signature to provide strong user anonymity, and a cost-effective cryptographic scheme to achieve security of the authentication protocol. Similarly, we implement a better billing system for MUs and a computationally efficient revocation scheme. Our analysis shows that the protocol has better performance than other related authentication protocols in wireless communications in terms of security, privacy, and efficiency.     

A novel DNA based password authentication system for global roaming in resource-limited mobile environments

Mobile environments are highly vulnerable to security threats and pose a great challenge for the wireless and mobile networks being used today. Because the mode of a wireless channel is open, these networks do not carry any inherent security and hence are more prone to attacks. Therefore, designing a secure and robust protocol for authentication in a global mobile network is always a challenging. In these networks, it is crucial to provide authentication to establish a secure communication between the Mobile User (MU), Foreign Agent (FA) and Home Agent (HA). In order to secure communication among these entities, a number of authentication protocols have been proposed. The main security flaw of the existing authentication protocols is that attackers have the ability to impersonate a legal user at any time. Moreover, the existing authentication protocols in the literature are exposed to various kind of cryptographic attacks. Besides, the authentication protocols require larger key length and more computation overhead. To remedy these weaknesses in mobility networks, DNA (Deoxyribo Nucleic Acid) based authentication scheme using Hyper Elliptic Curve Cryptosystem (HECC) is introduced. It offers greater security and allows an MU, FA and HA to establish a secure communication channel, in order to exchange the sensitive information over the radio link. The proposed system derive benefit from HECC, which is smaller in terms of key size, more computational efficiency. In addition, the security strength of this authentication system is validated through widely accepted security verification tool called ProVerif. Further, the performance analysis shows that the DNA based authentication system using HECC is secure and practically implementable in the resource-constrained mobility nodes.

     

A strong user authentication scheme with smart cards for wireless communications

Seamless roaming over wireless network is highly desirable to mobile users, and security such as authentication of mobile users is challenging. Recently, due to tamper-resistance and convenience in managing a password file, some smart card based secure authentication schemes have been proposed. This paper shows some security weaknesses in those schemes. As the main contribution of this paper, a secure and light-weight authentication scheme with user anonymity is presented. It is simple to implement for mobile user since it only performs a symmetric encryption/decryption operation. Having this feature, it is more suitable for the low-power and resource-limited mobile devices. In addition, it requires four message exchanges between mobile user, foreign agent and home agent. Thus, this protocol enjoys both computation and communication efficiency as compared to the well-known authentication schemes. As a special case, we consider the authentication protocol when a user is located in his/her home network. Also, the session key will be used only once between the mobile user and the visited network. Besides, security analysis demonstrates that our scheme enjoys important security attributes such as preventing the various kinds of attacks, single registration, user anonymity, no password/verifier table, and high efficiency in password authentication, etc. Moreover, one of the new features in our proposal is: it is secure in the case that the information stored in the smart card is disclosed but the user password of the smart card owner is unknown to the attacker. To the best of our knowledge, until now no user authentication scheme for wireless communications has been proposed to prevent from smart card breach. Finally, performance analysis shows that compared with known smart card based authentication protocols, our proposed scheme is more simple, secure and efficient.     

An efficient user authentication and key exchange protocol for mobile client–server environment

Considering the low-power computing capability of mobile devices, the security scheme design is a nontrivial challenge. The identity (ID)-based public-key system with bilinear pairings defined on elliptic curves offers a flexible approach to achieve simplifying the certificate management. In the past, many user authentication schemes with bilinear pairings have been proposed. In 2009, Goriparthi et al. also proposed a new user authentication scheme for mobile client–server environment. However, these schemes do not provide mutual authentication and key exchange between the client and the server that are necessary for mobile wireless networks. In this paper, we present a new user authentication and key exchange protocol using bilinear pairings for mobile client–server environment. As compared with the recently proposed pairing-based user authentication schemes, our protocol provides both mutual authentication and key exchange. Performance analysis is made to show that our presented protocol is well suited for mobile client–server environment. Security analysis is given to demonstrate that our proposed protocol is provably secure against previous attacks.     

基于分离机制网络的可信域内快速认证协议

分离机制网络明确地分离了主机身份与位置信息,将互联网体系划分为接入网与核心网两大类,很好地解决了互联网的扩展性和移动性等问题.基于分离机制网络,结合可信计算技术,提出一种终端域内切换时的快速认证方案,在对终端用户身份进行认证的同时,对终端平台进行身份认证和完整性校验.在本方案中,终端进行域内切换时不需要本域的认证中心再次参与,仅由接入交换路由器通过Token即可完成认证.认证过程可以保持用户身份和平台信息的匿名性,减轻了认证中心的负担.与其他方案相比,本方案在认证开销、认证延迟以及安全性等方面均有明显优势.安全性分析结果表明本方案是安全高效的.