一种基于移动公网的安全专网认证与密钥协商方案

针对移动公网保障端到端安全的不足,提出了一种基于改进的Diffie-Hellman密钥交换协议机制的安全专网认证和密钥协商设计方案。该方案可以在终端接入移动公网的基础上,实现通信双方端到端的相互认证,同时协商出独立于网络的密钥。性能分析表明,该方案结构简单,安全高效,符合移动通信系统的要求。     

无线传感器网络中的群密钥协商协议研究

无线传感器网络由大量随机分布的传感器节点组成,这些节点在各自的环境进行信息采集、数据处理,并将信息传输至数据终端。文章提出了一个健壮的、可证明安全的可认证群密钥协商协议,该协议满足实用性、简单性和强安全性的要求。本文提出的可认证群密钥协商协议是基于椭圆曲线、双线性映射和Burmester和Desmedt协议实现。该协议通过两轮广播完成群会话密钥协商,比以前可认证群密钥协商协议需要更低的计算和通信开销。     

基于椭圆曲线的隐私增强认证密钥协商协议

认证密钥协商协议能够为不安全网络中的通信双方提供安全的会话密钥,但是,大多数的认证密钥协商协议并没有考虑保护用户隐私.论文关注网络服务中用户的隐私属性,特别是匿名性和可否认性,规范了增强用户隐私的认证密钥协商协议应满足的安全需求,即双向认证、密钥控制、密钥确认、会话密钥保密、已知会话密钥安全、会话密钥前向安全、用户身份匿名、用户身份前向匿名、不可关联和可否认,并基于椭圆曲线密码系统设计了一个满足安全需求的隐私增强认证密钥协商协议.     

一个高效的无证书两方认证密钥协商协议

由于双线性对有高昂的计算代价,无双线性对的密码系统在近年来得到了广泛的关注。各种无双线性对的两方认证密钥协商协议在公钥密码体制(PKC)下被研究。为了克服传统公钥密码体制下复杂的证书管理问题和基于身份的密码体制固有的密钥托管问题,一些无证书认证密钥协商协议被提出。文中提出了一个安全高效的无双线性对的基于无证书的两方认证密钥协商协议,与相关的协议相比,文中的协议具有较低的计算代价。     

异构无线网络中基于标识的匿名认证协议

针对异构无线网络中的认证协议的安全问题,提出一种基于CPK算法和改进的ECDH算法的双向认证和密钥协商协议,引入用户的临时认证身份和临时通信身份实现用户的身份匿名;提出采用临时通信身份有序对防止重认证过程中的重放攻击,并且在协议设计中规避了密钥泄漏带来的风险。分析表明该协议具有身份认证、会话密钥安全、匿名性等安全属性。     

安全的认证密钥协商协议研究

对基于证书的密钥协商协议的设计与分析进行了比较深入的研究,研究内容包括：可证明安全的基于证书的密钥协商协议以及一种新的可认证密钥协商协议。主要研究成果有：介绍了密钥协商协议的概念和安全特性;提出一个新的认证密钥交换协议AKE-1。AKE-1效率较高,并且在最新的eCK07模型下是安全的,证明基于随机预言假设和CDH假设。另外,基于AKE-1,提出一轮的变体（满足只有一个实体在线）和三轮的变体（提供密钥确认属性）,以满足不同的应用。     

一种新的三方认证密钥协商协议

目前大部分基于身份的三方认证密钥协商协议都存在安全缺陷,文中在Xu等人提出的加密方案的基础上,设计了一种基于身份的三方认证密钥协商协议.该协议的安全性建立在BDDH假设基础上,经安全性分析,协议具有已知密钥安全,PKG前向安全,并能抵抗未知密钥共享攻击和密钥泄露伪装攻击,因此该协议是一个安全的三方密钥协商协议.     

基于身份认证的无线安全密钥交换

认证密钥协商使得通信双方在共享一个安全会话密钥的同时实现相互认证。针对无线网络,基于口令认证的密钥协商算法也许能降低系统资源开销,但通常不能有效抵抗字典攻击。针对无线设备的资源有限性,文中提出一种可证安全的、基于身份的、认证的密钥协商方案,所提出方案需要计算量少,能够抵抗冒充攻击并且满足密钥协商协议所要求的其它安全属性。     

一种新的适于Ad hoc网可认证密钥协商协议

提出一种新的适于Ad hoc网可认证密钥协商协议。基于签密技术。在同一逻辑步内同时实现了认证和加密功能,提高了密钥协商效率;基于身份的公钥密码系统,降低了建立和管理公钥基础设施的代价;应用椭圆曲线上双线性对,使得该协议能以短的密钥和小的计算量实现同等安全要求。与已有密钥协商协议相比,新协议计算和传输量小,带宽要求低,安全性高,适合能源和带宽受限的Ad hoc网络。     

一个新的基于公钥密码机制的安全协议的设计

为了解决网络中的安全传输和通信问题,提出一个新的基于公钥密码机制的安全协议。该安全协议的设计和分析采用了面向主体的逻辑方法。协议中引入了可信任的第三方,采用挑战/响应机制实现通信双方的身份认证,采用Diffie-Hellmam机制实现了密钥协商。通过Rubin逻辑形式化分析,验证了该协议具有一定的严密性,能够实现身份认证和密钥协商功能。     

基于身份的认证密钥协商协议

密钥协商协议应该在满足安全性的条件下,使实现协议所需的计算开销尽可能小。文中提出了一个基于身份的认证密钥协商协议BAKAP(ID-Based Authenticated Key Agreement Protocol)。该协议提供了已知密钥安全性、完善前向保密性、密钥泄露安全性、未知密钥共享安全性和密钥控制安全性。在该协议中,参与者只需执行两次椭圆曲线点乘法和一次双线性运算。该协议与已有协议相比,计算代价小。     

AN IMPROVED AUTHENTICATED KEY AGREEMENT PROTOCOL

In 1999, Seo and Sweeney proposed a simple authenticated key agreement protocol that was designed to act as a Diffie-Hellman key agreement protocol with user authentication. Various attacks on this protocol are described and enhanced in the literature. Recently, Ku and Wang proposed an improved authenticated key agreement protocol, where they asserted the protocol could withstand the existing attacks. This paper shows that Ku and Wang＇s protocol is still vulnerable to the modification attack and presents an improved authenticated key agreement protocol to enhance the security of Ku and Wang＇s protocol. The protocol has more efficient performance by replacing exponentiation operations with message authentication code operations.     

Cryptanalysis and improvement of the YAK protocol with formal security proof and security verification via Scyther

Hao proposed the YAK as a robust key agreement based on public‐key authentication, and the author claimed that the YAK protocol withstands all known attacks and therefore is secure against an extremely strong adversary. However, Toorani showed the security flaws in the YAK protocol. This paper shows that the YAK protocol cannot withstand the known key security attack, and its consequences lead us to introduce a new key compromise impersonation attack, where an adversary is allowed to reveal both the shared static secret key between two‐party participation and the ephemeral private key of the initiator party in order to mount this attack. In addition, we present a new security model that covers these attacks against an extremely strong adversary. Moreover, we propose an improved YAK protocol to remedy these attacks and the previous attacks mentioned by Toorani on the YAK protocol, and the proposed protocol uses a verification mechanism in its block design that provides entity authentication and key confirmation. Meanwhile, we show that the proposed protocol is secure in the proposed formal security model under the gap Diffie‐Hellman assumption and the random oracle assumption. Moreover, we verify the security of the proposed protocol and YAK protocol by using an automatic verification method such as the Scyther tool, and the verification result shows that the security claims of the proposed protocol are proven, in contrast to those of the YAK protocol, which are not proven. The security and performance comparisons show that the improved YAK protocol outperforms previous related protocols.     

An efficient pairing‐free identity‐based authenticated group key agreement protocol

An authenticated group key agreement protocol allows participants to agree on a group key that will be subsequently used to provide secure group communication over an insecure network. In this paper, we give a security analysis on a pairing‐free identity‐based authenticated group key agreement because of Islam et al. We show that the protocol of Islam et al. cannot satisfy the minimal security requirements of the key agreement protocols. We propose an efficient pairing‐free identity‐based authenticated group key agreement for imbalanced mobile network. The proposed protocol can be implemented easily for practical application in mobile networks as it is free from bilinear. Under the difficulty of the InvCDH and CDH we demonstrate that the proposed protocol provides perfect forward secrecy, implicit key authentication and the dynamic functionality. As compared with the group key agreement protocols for imbalanced mobile network, the proposed protocol provides stronger security properties and high efficiency. Copyright © 2013 John Wiley & Sons, Ltd.     

An efficient chaos‐based 2‐party key agreement protocol with provable security

Key agreement protocol is an important cryptographic primitive, which allows 2 parties to establish a secure session in an open network environment. A various of key agreement protocols were proposed. Nowadays, there still exists some other security flaws waiting to be solved. Owing to reduce the computational and communication costs and improve the security, chaotic map has been studied in‐depth and treated as a good solution. Recently, Liu et al proposed a chaos‐based 2‐party key agreement protocol and demonstrated that it can defend denial‐of‐service attack and replay attack. We found, however, it cannot resist off‐line password‐guessing attack, and it also has some other security flaws. In this paper, we propose an improved chaos‐based 2‐party key agreement protocol. The results prove that the protocol can solve the threats of off‐line password‐guessing attack and other security flaws in the security proof section. What is more, performance analysis shows that the computational cost of the improved protocol is lower than Liu et al protocol.     

WSN key recovery attack based on symmetric matrix decomposition

The key protocol is one of the crucial technologies to ensure the security for wireless sensor network（WSN）.Parakh,et al.proposed a key agreement for WSN based on matrix decomposition.However,the study revealed that the protocol had security risks.A key recovery attack scheme against this protocol was proposed by using the properties of symmetric matrix and permutation matrix.Based on intercepting the row and column vector of the node,elementary transformation was performed to construct a linear algebraic attack algorithm and the equivalent key was obtained.The computational complexity is O(N⁶).Experimental results show that the method can recover the equivalent key of the above protocol within the polynomial computational complexity and the memory consumption is within an acceptable range.In addition,an improved scheme for key agreement was proposed to resist the linear algebraic attack by using a random disturbance matrix,and the correctness and security analysis were also carried out.     

一个高效的基于身份的群密钥协商协议

群密钥协商协议是在Ad Hoc网络群通信中建立会话密钥的一种有效解决方法.但由于Ad Hoc网络是一个拓扑结构变化频繁的网络,因而在群通信中,不仅要建立一致的会话密钥,还要考虑成员变化的情况.文中结合完全二又树结构,提出了一种新的基于身份的群密钥协商协议.新方案具有隐含密钥认证、已知会话密钥安全,前向安全、抗密钥泄露攻击.抗未知密钥共享攻击、密钥控制等安全特性,并且效率较高.     

无线局域网密钥协商协议安全性分析与改进

分析了中国无线局域网标准中无线鉴别基础设施WAI（WLAN Authentication Infrastructure），指出其中密钥协商协议缺乏密钥确认、易遭受拒绝服务攻击等安全问题。提出了一种采用三次握手和带消息认证的密钥协商协议，以及周期密钥更新协议．使用BAN逻辑对提出的改进密钥协商协议进行形式化分析，验证了其正确性．与WAI比较，提出的协议具有较少的交互性，提供了消息鉴别并具有抗拒绝服务攻击能力。     

A chaotic map‐based anonymous multi‐server authenticated key agreement protocol using smart card

Authenticated key agreement protocols play an important role for network‐connected servers to authenticate remote users in Internet environment. In recent years, several authenticated key agreement protocols for single‐server environment have been developed based on chaotic maps. In modern societies, people usually have to access multiple websites or enterprise servers to accomplish their daily personal matters or duties on work; therefore, how to increase user's convenience by offering multi‐server authentication protocol becomes a practical research topic. In this study, a novel chaotic map‐based anonymous multi‐server authenticated key agreement protocol using smart card is proposed. In this protocol, a legal user can access multiple servers using only a single secret key obtained from a trusted third party, known as the registration center. Security analysis shows this protocol is secure against well‐known attacks. In addition, protocol efficiency analysis is conducted by comparing the proposed protocol with two recently proposed schemes in terms of computational cost during one authentication session. We have shown that the proposed protocol is twice faster than the one proposed by Khan and He while preserving the same security properties as their protocol has. Copyright © 2014 John Wiley & Sons, Ltd.