共查询到17条相似文献,搜索用时 218 毫秒
1.
密钥管理是基于移动通信系统进行端到端加密的核心问题,现有方案大多依赖于密钥管理中心,并存在不在同一加密组内的终端要进行端到端加密通信时通信消耗大、效率低等问题。为解决这些问题,提出一种基于IBE(Identity Based Encryption)的三级密钥管理方案。该方案适于在资源有限的移动终端上使用,采用IBE机制生成和管理主密钥,简化了密钥协商过程,降低了对密钥管理中心的依赖,使用对称加密算法加密通信信息,确保通信的高效性。通信双方可进行双向认证,具有前向安全性,可抵抗选择密文攻击。 相似文献
2.
在传统的代理重加密(PRE)体制中,代理者一旦获得重加密密钥就能将所有授权者能解密的密文转换成受理者能解密的密文,代理者的重加密权限过大;而且授权者需要对不同的受理者生成代理重加密密钥,计算过程中浪费了大量的资源。为了解决以上问题,构造了一种基于身份的条件型广播代理重加密方案。该方案中的授权者在生成重加密密钥过程中加入特殊条件,来限制代理者的重加密权限过大的问题;与此同时,使授权者的密文能够被再次广播以确保重要通信,这样的处理能节省更多的计算和通信开销。最后通过理论分析阐明了方案的安全性。 相似文献
3.
4.
为了减轻云应用中移动设备解密的负担,利用基于身份的广播加密(IBBE)、基于身份的加密(IBE)、基于身份的条件型广播代理重加密方案,提出了多条件型非对称跨加密系统的代理重加密方案。该方案允许发送方将信息加密成IBBE密文,一次性发送给多个接收方,其中任一接收方又可以授权给代理者一个多条件型的重加密密钥,代理者利用该多条件型重加密密钥,能将符合多个条件的原始密文重加密成一个新的接收方可以解密的IBE密文。该方案实现了从IBBE加密系统到IBE加密系统的非对称代理重加密,而且代理者可以根据条件将最初的原始密文进行重加密,避免了不需要进行重加密的原始密文被代理者重加密,提高了代理者重加密的效率,同时节约了接收方获悉正确明文的时间。 相似文献
5.
6.
现今人与人之间传输数据时越来越依赖于3G移动通信网络,特别是第三代移动通信网络(3G)。尽管3G网络实现了网络组件内数据的机密性、完整性,但它并不提供用户端到端的机密性和完整性,而端到端加密的关键是有效地管理每一个密钥。因此文章提出了一种新的端到端加密的密钥管理方案,该方案基于三方Diffie、Hellman密钥协议算法,充分利用了3G的特殊性,只增加一种新的软件,几乎没有改变3G的物理结构。文章还对方案进行了评估,证明了该协议能够提供消息的机密性,以及通信双方双向认证的正确性。 相似文献
7.
为了实现家居和建筑自动化(HBA)的数据安全传输,在欧洲安装总线(KNX/EIB)标准协议引入加密和认证机制;使用迪菲赫尔曼(Diffie-Hellman)算法实现非对称密钥共享,高级加密标准(AES)实现数据加密,基于哈希算法的挑战握手认证协议实现设备认证,使用控制器协调密钥分享和设备认证过程。模拟实验表明,所提方法在空间和时间上都是可行的,比其他改进方法更容易实现,操作更简单,能够保证数据的安全。 相似文献
8.
针对目前基于格的身份基代理重加密方案存在的加/解密效率低和密文、密钥尺寸过长的问题,采用原像抽样和对偶加密技术,重新构造了一个基于格的身份基代理重加密方案。该方案采用原像抽样技术提取用户私钥,用对偶加密算法对消息进行加密,利用代理重加密密钥进行重加密,并用用户的私钥进行解密。安全分析表明,在标准模型下,基于ring learning with errors困难假设,该方案满足IND-aID-CPA安全。效率分析表明,该方案可以有效缩短密文和密钥尺寸,提高加/解密效率。 相似文献
9.
由于单一的加密算法无法满足隐私数据在网络传输过程中的安全需求,因此论文提出了一种基于改进的AES与SM2相结合的混合加密数据保护方案。对AES的密钥扩展过程和列混合操作过程进行改进,采用双密钥提高密钥安全性,简化列混合操作提高解密速度。使用改进的AES对隐私数据加密,能够保障隐私数据的安全。使用国密SM2对AES对称密钥加密,保证了对称密钥的分配安全。采用国密SM3哈希算法,用以验证数据完整性。通过实验和分析,证明该方案的可行性与正确性。与已有方法相比,该方案提升了隐私数据解密速率,提高了安全性,高效易行。 相似文献
10.
11.
A pairing-free certificate-based proxy re-encryption scheme for secure data sharing in public clouds
To assure the confidentiality of the sensitive data stored in public cloud storages, the data owners should encrypt their data before submitting them to the clouds. However, it brings new challenge for us to effectively share the encrypted data in the public clouds. The paradigm of proxy re-encryption provides a promising solution to data sharing as it enables a data owner to delegate the decryption rights of the encrypted data to the authorized recipients without any direct interaction. Certificate-based proxy re-encryption is a new cryptographic primitive to effectively support the data confidentiality in public cloud storages, which enjoys the advantages of certificate-based encryption while providing the functionalities of proxy re-encryption. In this paper, we propose a certificate-based proxy re-encryption scheme without bilinear pairings. The proposed scheme is proven secure under the computational Diffie-Hellman assumption in the random oracle model. Due to avoiding the time-consuming bilinear pairing operations, the proposed scheme significantly reduces the computation cost. Compared to the previous certificate-based proxy re-encryption schemes with bilinear pairings, it enjoys obvious advantage in the computation efficiency, and thus is more suitable for the computation-limited or power-constrained devices. 相似文献
12.
随着物联网飞速发展,设备数量呈指数级增长,随之而来的IoT安全问题也受到了越来越多的关注.通常IoT设备完整性认证采用软件证明方法实现设备完整性校验,以便及时检测出设备中恶意软件执行所导致的系统完整性篡改.但现有IoT软件证明存在海量设备同步证明性能低、通用IoT通信协议难以扩展等问题.针对这些问题,本文提供一种轻量级的异步完整性监控方案,在通用MQTT协议上扩展软件证明安全认证消息,异步推送设备完整性信息,在保障IoT系统高安全性的同时,提高了设备完整性证明验证效率.我们的方案实现了以下3方面安全功能:以内核模块方式实现设备完整性度量功能,基于MQTT的设备身份和完整性轻量级认证扩展,基于MQTT扩展协议的异步完整性监控.本方案能够抵抗常见的软件证明和MQTT协议攻击,具有轻量级异步软件证明、通用MQTT安全扩展等特点.最后在基于MQTT的IoT认证原型系统的实验结果表明, IoT节点的完整性度量、MQTT协议连接认证、PUBLISH报文消息认证性能较高,都能满足海量IoT设备完整性监控的应用需求. 相似文献
13.
Abdul Nasir Khan M. L. Mat Kiah Sajjad A. Madani Mazhar Ali Atta ur Rehman Khan Shahaboddin Shamshirband 《The Journal of supercomputing》2014,68(2):624-651
Due to the limited computational capability of mobile devices, the research organization and academia are working on computationally secure schemes that have capability for offloading the computational intensive data access operations on the cloud/trusted entity for execution. Most of the existing security schemes, such as proxy re-encryption, manager-based re-encryption, and cloud-based re-encryption, are based on El-Gamal cryptosystem for offloading the computational intensive data access operation on the cloud/trusted entity. However, the resource hungry pairing-based cryptographic operations, such as encryption and decryption, are executed using the limited computational power of mobile device. Similarly, if the data owner wants to modify the encrypted file uploaded on the cloud storage, after modification the data owner must encrypt and upload the entire file on the cloud storage without considering the altered portion(s) of the file. In this paper, we have proposed an incremental version of proxy re-encryption scheme for improving the file modification operation and compared with the original version of the proxy re-encryption scheme on the basis of turnaround time, energy consumption, CPU utilization, and memory consumption while executing the security operations on mobile device. The incremental version of proxy re-encryption scheme shows significant improvement in results while performing file modification operations using limited processing capability of mobile devices. 相似文献
14.
Sharing your privileges securely: a key-insulated attribute based proxy re-encryption scheme for IoT
Attribute based proxy re-encryption (ABPRE) combines the merits of proxy re-encryption and attribute based encryption, which allows a delegator to re-encrypt the ciphertext according to the delegatees’ attributes. The theoretical foundations of ABPRE has been well studied, yet to date there are still issues in schemes of ABPRE, among which time-bounded security and key exposure protection for the re-encryption keys are the most concerning ones. Within the current ABPRE framework, the re-encryption keys are generated independently of the system time segments and the forward security protection is not guaranteed when the users’ access privileges are altered. In this paper, we present a key-insulated ABPRE scheme for IoT scenario. We realize secure and fine-grained data sharing by utilizing attribute based encryption over the encrypted data, as well as adopting key-insulation mechanism to provide forward security for re-encryption keys and private keys of users. In particular, the lifetime of the system is divided into several time slices, and when system enters into a new slice, the user’s private keys need are required to be refreshed. Therefore, the users’ access privileges in our system are time-bounded, and both re-encryption keys and private keys can be protected, which will enhance the security level during data re-encryption, especially in situations when key exposure or privilege alternation happens. Our scheme is proved to be secure under MDBDH hardness assumptions as well as against collusion attack. In addition, the public parameters do not have to be changed during the evolution of users’ private keys, which will require less computation resources brought by parameter synchronization in IoT. 相似文献
15.
物联网具有终端异构、信息传输复杂、应用安全要求多样化等特点,并且物联网的终端大多处理能力有限,因此物联网中通信的安全问题较互联网更为严峻,而传统的单路传输安全方法无法在保证安全的同时降低运算的复杂度,不太适用于物联网环境。针对上述问题,提出将传统的加密技术与多路传输相结合,设计一种端到端的安全多路通信方法。该方法的基本思想是通信双方选择多条不同的传输路径,采用Diffie Hellman算法进行密钥协商,将密钥协商信息分片并根据选择的路径发送给接收方,这样便协商出一个安全的会话密钥。然后,发送方使用该密钥加密数据并将得到的密文分片经多路传输。分析表明,相比于单路传输的安全通信方法能更好地对抗中间人攻击、密钥破解等安全问题,并在一定程度上降低运算复杂度。 相似文献
16.
已有基于证书代理重加密方案的构造严重依赖双线性对运算,计算效率不高。针对这一问题,提出了一个高效的基于证书代理重加密方案。所提出方案的加密算法无须作双线性对运算,而其他算法至多作一次双线性对运算,因此显著提高了方案的计算性能。与现有基于证书代理重加密方案相比,该方案具有计算效率高和通信带宽低的优点。基于[q-mBDHI]问题和[1-BDHI]问题的困难性假设,该方案在随机预言模型下被严格证明满足适应性选择密文攻击下的密文不可区分安全性,即满足选择密文安全性。 相似文献
17.
物联网云平台通过物联网节点采集和使用数据,基于云平台进行数据的运算和存储,提升了物联网处理数据的能力和数据共享的范围,也丰富了云端数据的内容,推动了互联网与人类世界的渗透和融合,同样也带来了全新的安全问题,由于物联网节点的特点与局限性,导致节点极其容易受到攻击,因此,如何实现物联网云平台中被劫持节点数据访问授权的可信更新至关重要.为此,提出了一种基于代理重加密的物联网云节点授权可信更新机制(PRE based trusted update scheme of authorization for nodes on IoT cloud platform, PRE-TUAN).首先,定义系统模型,包含可信的物联网数据服务器、授权管理服务器和半可信的云端重加密代理服务器;其次,描述系统流程和算法;最后对PRE-TUAN进行安全性分析和证明.PRE-TUAN以代理重加密为基础,将充分发挥云的运算能力,同时确保物联网数据分享的安全与可靠. 相似文献