Verifiable three-party secure key exchange protocol based on eigenvalue

In order to solve the problem that the traditional key exchange protocol,which was not flexible enough and flawed in security,cannot provide the function of three-party key negotiation,firstly,a simple and flexible three-party key exchange scheme that can resist man-in-the-middle attacks was proposed with the help of secret matrix eigenvalues.However,the validity of key exchange cannot be verified by the scheme,and counterfeiting by middlemen can’t be prevented.Then based on it,the secret matrix was reconstructed,where the matrix order was a large even number,and all the eigenvalues appeared in pairs,similar to the diagonal matrix.Based on the special secret matrix,the verification part which can be used to verify the legitimacy of the communication party was introduced to the scheme,and the verifiable three-party key exchange protocol based on the eigenvalue was given.The protocol not only solved the problem of three-party key exchange,but also verified identity legitimacy.It is proved that it’s feasible to design a three-party key exchange protocol by the eigenvalue.The final protocol is both secure and efficient.     

基于主体行为的多方安全协议会话识别方法

针对分布在多个相关流中的多方安全协议会话问题,提出了多方安全协议会话的3个启发式的主体行为特征——邻接主机行为、主体角色行为以及主机消息行为,给出了主体行为特征检测原理,提出了多方安全协议会话识别方法。针对3个典型的多方安全协议,分别在3种会话运行场景下进行实验,结果表明该方法识别率在90%以上,误报率和漏报率在6%以下,能够有效地识别协议会话。     

Privacy-preserving authenticated key agreement scheme based on biometrics for session initiation protocol

A secure key agreement scheme plays a major role in protecting communications between the users using voice over internet protocol over a public network like the internet. In this paper we present a strong security authenticated key agreement scheme for session initiation protocol (SIP) by using biometrics, passwords and smart cards. The proposed scheme realizes biometric data protection through key agreement process meanwhile achieving the verification of the biometric value on the SIP server side which is very important in designing a practical authenticated key agreement for SIP. The main merits of our proposed scheme are: (1) the SIP server does not need to maintain any password or verification table; (2) the scheme can provide user identity protection—the user’s real identity is protected by a secure symmetric encryption algorithm and the elliptic curve discrete logarithm problem, and it is transmitted in code; (3) the scheme can preserve the privacy of the user’s biometric data while the biometric matching algorithm is performed at the SIP server side, even if the server does not know the biometric data in the authentication process. Performance and security analysis shows that our proposed scheme increases efficiency significantly in comparison with other related schemes.     

MaTRU‐KE revisited: CCA2‐secure key establishment protocol based on MaTRU

Quantum attack–resistant cryptosystems are required for secure communication since there is a big demand to have quantum computers. Lattice‐based cryptography is one of the quantum‐secure families due to its key/ciphertext sizes and performance. NTRU‐based cryptosystems, a member of lattice‐based cryptosystems, have received much more attention. MaTRU, a noncommutative version of NTRU with some matrix properties, is used to obtain a key exchange protocol in 2018. In this paper, we focus on MaTRU‐based key exchange protocols having CCA2 properties. We propose CCA2‐secure versions of MaTRU‐KE and then provide a security analysis of CCA2‐secure key establishment protocols. We also provide a comparison with the previous ones.     

A new authenticated key agreement for session initiation protocol

The session initiation protocol (SIP) is an authentication protocol used in 3G mobile networks. In 2009, Tsai proposed an authenticated key agreement scheme as an enhancement to SIP. Yoon et al. later pointed out that the scheme of Tsai is vulnerable to off‐line password guessing attack, Denning–Sacco attack, and stolen‐verifier attack and does not support perfect forward secrecy (PFS). Yoon et al. further proposed a new scheme with PFS. In this paper, we show that the scheme of Yoon et al. is still vulnerable to stolen‐verifier attack and may also suffer from off‐line password guessing attack. We then propose several countermeasures for solving these problems. In addition, we propose a new security‐enhanced authentication scheme for SIP. Our scheme also maintains low computational complexity. Copyright © 2011 John Wiley & Sons, Ltd.     

Password-only authenticated key establishment protocol without public key cryptography

A scenario in which a user and a server can authenticate each other and generate a strong session key through a symmetric cipher by their shared weak (low-entropy) password in an insecure channel is considered. Until now, designing a secure protocol in this scenario has been an open problem due to the offline dictionary attack. A protocol to resolve this problem is proposed. The idea is to ensure that people must participate to verify each guessed password in the offline dictionary attack. Therefore, this attack cannot succeed in a reasonable time for the proposed protocol.     

A secure enhanced privacy-preserving key agreement protocol for wireless mobile networks

The rapid proliferation of mobile networks has made security an important issue, particularly for transaction oriented applications. Recently, Jo et al. presented an efficient authentication protocol for wireless mobile networks and asserted that their proposed approach provides all known security functionalities including session key (SK) security under the assumption of the widely-accepted Canetti–Krawczyk (CK) model. We reviewed Jo et al.’s proposed roaming protocol and we demonstrate that it fails to provide the SK-security under the CK-adversary setting. We then propose an enhancement to Jo et al.’s roaming protocol to address the security drawback found in Jo et al.’s protocol. In the enhanced roaming protocol, we achieve the SK-security along with reduced computation, communication and storage costs. We also simulate the enhanced roaming protocol using NS2 for end-to-end delay and network throughput, and the simulation results obtained demonstrate the efficiency of our protocol.     

对车载电子系统电路保护的考量

新型车载信息娱乐系统和导航系统能提供更多的内容，让你体验到更高质量的音频和视频节目，并且改善了个人通信装置的连接性能。为了适应很高的数据传输速率，满足当前通信的要求，要对这种设备进行保护，避免因为顾客误用、危险性的环境和电源波动而造成损坏。     

MANET中高效的安全簇组密钥协商协议

针对移动自组网中组密钥管理面临的诸多挑战,提出一种高效的安全簇组密钥协商协议(ESGKAP,effi-cient and secure group key agreement protocol).ESGKAP基于提出的高性能层簇式CCQ_n网络模型,有效地减少了组密钥协商过程中的秘密贡献交互开销,增加了协议的灵活性、可扩展性和容错性.ESGKAP无需控制中心,由秘密分发中心构造门限秘密共享,所有成员通过协商生成簇组密钥,提高了方案的安全性,且基于ECC密码体制提高了簇组密钥生成的效率.同时,提出高效的签密及门限联合签名方案,确保簇组成员能够对接收的簇组密钥份额进行验证,进一步增加了方案的安全性.使用串空间模型对ESGKAP方案进行了形式化分析,证明了其正确性和安全性.最后,通过与BD、A-GDH和TGDH协议比较,表明ESGKAP能有效减少节点和网络资源消耗,很好地适用于特定的移动自组网环境,具有更为明显的安全和性能优势.     

An anonymous and secure key agreement protocol for NFC applications using pseudonym

Wireless Networks - Near Field Communication (NFC) is a promising technology that facilitate E-commerce through contactless communications. In the past decade, the NFC characteristics such as...     

A secure search protocol for lightweight and low-cost RFID systems

In radio frequency identification (RFID) systems, search protocols are used to find a specific item in a large number of tagged products. These protocols should be secure against RFID attacks such as traceability, impersonation, DoS and eavesdropping. Sundaresan et al. (IEEE Trans Dependable Secure Comput, 2015) presented a server-less search protocol based on 128-bits PRNG function and claimed that their method can address all vulnerabilities of previous protocols. In this paper, we prove that Sundaresan et al.’s protocol is vulnerable to traceability attack with the high probability. In addition, we present an improved protocol to solve the proposed problem and analyze its security level informally and formally based on AVISPA tool and BAN logic.     

Strongly secure ID‐based authenticated key agreement protocol for mobile multi‐server environments

To provide mutual authentication and communication confidentiality between mobile clients and servers, numerous identity‐based authenticated key agreement (ID‐AKA) protocols were proposed to authenticate each other while constructing a common session key. In most of the existing ID‐AKA protocols, ephemeral secrets (random values) are involved in the computations of the common session key between mobile client and server. Thus, these ID‐AKA protocols might become vulnerable because of the ephemeral‐secret‐leakage (ESL) attacks in the sense that if the involved ephemeral secrets are compromised, an adversary could compute session keys and reveal the private keys of participants in an AKA protocol. Very recently, 2 ID‐AKA protocols were proposed to withstand the ESL attacks. One of them is suitable for single server environment and requires no pairing operations on the mobile client side. The other one fits multi‐server environments, but requires 2 expensive pairing operations. In this article, we present a strongly secure ID‐AKA protocol resisting ESL attacks under mobile multi‐server environments. By performance analysis and comparisons, we demonstrate that our protocol requires the lowest communication overhead, does not require any pairing operations, and is well suitable for mobile devices with limited computing capability. For security analysis, our protocol is provably secure under the computational Diffie‐Hellman assumption in the random oracle model.     

Cryptanalysis of smart‐card‐based password authenticated key agreement protocol for session initiation protocol of Zhang et al.

As the core signaling protocol for multimedia services, such as voice over internet protocol, the session initiation protocol (SIP) is receiving much attention and its security is becoming increasingly important. It is critical to develop a roust user authentication protocol for SIP. The original authentication protocol is not strong enough to provide acceptable security level, and a number of authentication protocols have been proposed to strengthen the security. Recently, Zhang et al. proposed an efficient and flexible smart‐card‐based password authenticated key agreement protocol for SIP. They claimed that the protocol enjoys many unique properties and can withstand various attacks. However, we demonstrate that the scheme by Zhang et al. is insecure against the malicious insider impersonation attack. Specifically, a malicious user can impersonate other users registered with the same server. We also proposed an effective fix to remedy the flaw, which remedies the security flaw without sacrificing the efficiency. The lesson learned is that the authenticators must be closely coupled with the identity, and we should prevent the identity from being separated from the authenticators in the future design of two‐factor authentication protocols. Copyright © 2014 John Wiley & Sons, Ltd.     

可信计算技术安全协议与密钥管理研究

分析TCG规范中密钥管理模型和安全协议,通过采用对称密码技术、引入“用户实体”概念和减少密钥管理层级等,设计了更加简洁统一的可信计算密钥存储管理、权限管理、密钥迁移、应用密钥管理和安全协议,分析了方案对其他相关部分的可能影响。     

A secure n-secret based client authentication protocol for 802.11 WLANs

Authentication has strong impact on the overall security model of every information system. Various authentication techniques are available for restricting the access of unauthorized users to the enterprise scale networks. IEEE 802.1X defines a secure and reliable authentication framework for 802.11 WLANs, where Extensible Authentication Protocol (EAP) provides the base to this architecture. EAP is a generic architectural framework which supports extensibility by incorporating the new and improved authentication schemes, which are based on different types of credentials. Currently there exist a number of EAP and Non-EAP methods with varying level of security and complexity. In this work, we have designed a new n-secret based authentication scheme referred here as Personal Dialogue Based Authentication, for the client authentication to the network. It is a Transport Layer Security (TLS) protected authentication protocol, which will be executed inside the secure TLS tunnel for providing the privacy and credential security to the wireless client. The developed authentication protocol has a reasonable set of features like; strong security, user privacy, simplicity and extensibility. For the formal analysis of the protocol we have used SPAN–AVISAP model checker on Ubuntu platform for validating the realization of the specified security goals. The experimental results obtained by simulation performed with the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool shows that our protocol is efficient and secured.

     

基于PKI的一种信息安全传输协议设计

针对目前信息传输的安全问题，给出了一种新型的基于PKI（Public Key Infrastructure）的信息安全传输协议模型，将椭圆曲线加密算法ECC，高级加密算法AES，MD5算法应用在其中，并给出了具体的实现过程，该协议主要解决了信息传输争接收过程中的身份认证、发送者和接收者的不可否认性、数据的完整性和保密性等问题。     

Protected session keys context for distributed session key management

Handoffs must be fast for wireless mobile nodes (MN) without sacrificing security between the MN and the wireless access points in the access networks. We describe and analyze our new secure Session Keys Context (SKC) scheme which has all the good features, like mobility and security optimization, of the currently existing key distribution proposals, namely key-request, pre-authentication, and pre-distribution. We analyze these solutions together, and provide some conclusions on possible co-operative scenarios and on which level of the network to implement them. Finally before conclusions we provide some handoff delay simulation results with SKC and key request schemes with corresponding example handoff scenarios with a next generation radio link layer.     

运行模式法分析ISO／IEC密钥建立协议

基于作者提出的运行模式法分析了ISO/IEC DIS 11770-3所提出的一个密钥建立协议(Helsinki密码协议)。分析结果表明Horng-Hsu攻击是Helsinki密码协议的惟一攻击,提出了一种改进的Helsinki密码协议,该协议可以防止Horng-Hsu攻击并比以前改进的Helsinki密码协议更安全。     

基于量子隐写术的计算安全比特承诺协议

在量子比特承诺协议中,目前流行的方案没有很好地解决信道噪声的影响,实用性不强。根据量子隐写术对信息的隐藏性,提出一种新的量子比特承诺协议。提出了利用量子信道噪声结合遮盖比特隐藏敏感信息,同时采用量子纠错码的方法克服信道噪声,有效地抵抗了第三方窃听攻击和噪声对信息的影响和破坏。通过理论分析与仿真证明该协议的绑定性和完善隐蔽性;理论证明了方案的有效性,为量子密码协议的推广应用提供了理论基础。