基于身份的可认证多方密钥协商新方案

认证密钥协商协议允许通信方在公开的网络环境里进行认证,并协商一个安全的共享会话密钥。在McCullagh-Barreto方案的基础上,提出了一个基于身份的可认证多方密钥协商新方案。引入密钥种子更新临时公私钥对,实现了认证功能,提高了安全性,成功抵抗了Reveal查询攻击和密钥泄漏扮演攻击,且具有无密钥控制、等献性等特性。     

一种无证书认证密钥协商协议的分析与改进*

研究无证书公钥密码系统中两方认证密钥协商协议问题。对Liu xu的无证书两方认证密钥协商协议进行安全性分析,指出该方案不具有强安全性。该方案不能抵抗密钥泄露伪装攻击和临时私钥泄露攻击。分析了方案不安全的原因,在此基础上提出一个改进的方案来修正Liu xu的方案。因此,设计看似安全的无证书两方认证密钥协商协议并不困难,但要给出协议的安全性证明并不容易。     

基于身份的可认证多方密钥协商方案

三方密钥协商协议虽然比传统方案高效,但不具有认证功能且易遭受中间人攻击。文章将该协议扩展到多方,提出2个新的基于身份的密钥协商方案。方案中用于实现认证功能的签名是短签名,因此认证过程比较高效。通过引入口令进化机制,提高了安全性。新方案具有等献性、无密钥控制、已知密钥安全、抗中间人攻击等安全特性。     

一种高效无线传感器网络认证及密钥协商方案

随着无线传感器网络在社会各个领域的渗透,其安全机制的研究一直是无线传感器网络的研究热点。在分析了无线传感器网络中认证及密钥协商方案设计时应满足条件的基础上,基于单向HASH函数和对称密码算法,设计了无线传感器网络中传感器节点间一种高效的认证及密钥协商方案。并从互认证、会话密钥、可抵御攻击等方面对该方案的安全性进行了分析,说明了该方案的安全性能较好,可有效抵御典型攻击行为;详细比较该方案和现有类似方案的运行性能,结果表明,该方案在存储容量需求、计算复杂性和通信带宽需求方面均优于现有方案。     

基于身份的P2PSIP可认证密钥协商方案

为解决点对点会话初始协议(P2PSIP)的安全性问题,根据其分布式特点,结合身份公钥密码,提出一种可认证密钥协商方案。分析其安全性、运算效率和密钥托管等问题。该方案可以实现P2PSIP呼叫过程的双向身份认证和密钥协商,抵抗中间人攻击、重放攻击和离线密码攻击,防止消息体篡改、会话劫持和身份欺骗。     

新型S/KEY认证方案的分析与设计

分析传统S/KEY型一次性口令认证系统的缺陷,提出一种新型的S/KEY认证方案,实现客户端与服务器的双向认证,可进行会话密钥协商,且每次认证产生不同的会话密钥。该方案可有效抵御重放攻击、小数攻击、破坏协议攻击和冒充攻击,对中间人攻击也有较强的防御作用。     

完美前向安全的基于身份认证密钥协商方案

现有的基于身份的一轮认证密钥协商方案没能实现强的完美前向性.采用强不可伪造的签名算法对临时公钥进行签名,提出一种改进的基于身份认证密钥协商方案.首先,对Boneh和Boyen提出的强不可伪造的短签名方案进行改造,提出一种强不可伪造的基于身份签名方案;然后,将新签名方案与Ni等人提出的eCK安全的基于身份一轮认证密钥协商方案相结合,提出新的密钥协商方案.进一步,为了实现新方案的可证明安全性,在对比分析eCK-PFS模型和eCK模型的基础上,融合现有安全模型,定义了基于身份认证密钥协商方案分析的强安全模型ID-eCK-PFS.在ID-eCK-PFS模型下,通过安全性规约,证明了新提出的基于身份认证密钥协商方案实现了强安全性,包括抗密钥泄露伪装、抗临时秘密泄露和完美前向安全性等.     

基于椭圆曲线密码体制的可认证的密钥协商设计与分析

椭圆曲线密码体制以其密钥短、安全强度高、速度快等优越性被广泛用于进行构建数字签名和用户身份认证方案.同样,它也可以用来构建密钥交换协议.Diffie-Hellman密钥协商协议对来自中间人的攻击是脆弱的.基于椭圆曲线离散对数难解性, 利用椭圆曲线密码体制的数字签名方案,提出了基于身份认证的密钥协商协议.该协议提供身份认证、密钥确认、完美前向安全性, 并能够防止中间人攻击.     

一种抗阻断攻击的认证组密钥协商协议

一个非认证的组密钥协商协议不能对通信参与者和消息进行认证,它必须依赖认证的网络信道或其它的认证方法.分析了Burmester等人在认证广播信道下提出的著名组密钥协商协议,指出它不能抵抗内部恶意节点发起的密钥协商阻断攻击,该攻击导致组内其它诚实节点不能正确计算出一致的组密钥.提出了一种改进的认证的组密钥协商协议,在原协议中加入了消息正确性的认证方法,能够对组内恶意节点进行检测,并在随机预言模型下证明了改进的协议能够抵抗密钥协商阻断攻击.     

一种无线认证密钥协商协议

提出一种新的无线局域网认证密钥协商协议,可以提供双方相互认证及密钥确认。该协议在密钥设置上基于挑战响应协议和KAS方案,在密钥预分配上基于Diffie—Hellman协议,可以提供完美前向安全性,抵抗被动攻击、字典攻击、中间人攻击、假冒攻击等。并对协议的计算代价和通信代价进行分析。     

面向多网关的无线传感器网络多因素认证协议

无线传感器网络作为物联网的重要组成部分,广泛应用于环境监测、医疗健康、智能家居等领域.身份认证为用户安全地访问传感器节点中的实时数据提供了基本安全保障,是保障无线传感器网络安全的第一道防线;前向安全性属于系统安全的最后一道防线,能够极大程度地降低系统被攻破后的损失,因此一直被学术及工业界视为重要的安全属性.设计面向多网关的可实现前向安全性的无线传感器网络多因素身份认证协议是近年来安全协议领域的研究热点.由于多网关无线传感器网络身份认证协议往往应用于高安全需求场景,一方面需要面临强大的攻击者,另一方面传感器节点的计算和存储资源却十分有限,这给如何设计一个安全的多网关无线传感器网络身份认证协议带来了挑战.近年来,大量的多网关身份认证协议被提出,但大部分都随后被指出存在各种安全问题.2018年,Ali等人提出了一个适用于农业监测的多因素认证协议,该协议通过一个可信的中心(基站)来实现用户与外部的传感器节点的认证;Srinivas等人提出了一个通用的面向多网关的多因素身份认证协议,该协议不需要一个可信的中心,而是通过在网关之间存储共享秘密参数来完成用户与外部传感器节点的认证.这两个协议是多网关无线传感器网络身份认证协议的典型代表,分别代表了两类实现不同网关间认证的方式:1)基于可信基站,2)基于共享秘密参数.分析指出这两个协议对离线字典猜测攻击、内部攻击是脆弱的,且无法实现匿名性和前向安全性.鉴于此,本文提出一个安全增强的可实现前向安全性的面向多网关的无线传感器网络多因素认证协议.该协议采用Srinivas等协议的认证方式,即通过网关之间的共享秘密参数完成用户与外部传感器节点的认证,包含两种典型的认证场景.对新协议进行了BAN逻辑分析及启发式分析,分析结果表明该协议实现了双向认证,且能够安全地协商会话密钥以及抵抗各类已知的攻击.与相关协议的对比结果显示,新协议在提高安全性的同时,保持了较高的效率,适于资源受限的无线传感器网络环境.     

增强型相互认证密钥协商方案

传统用于保护用户密钥隐私的相互认证方案不能有效抵抗重放攻击与DOS攻击。为此,将安全单向哈希函数和椭圆曲线上的离散对数难问题相结合,提出一种基于智能卡的相互认证方案。该方案通过引入时间戳及时延限制,能有效抵抗重放攻击,并减轻DOS攻击。相比于其他同类方案,该方案的移动用户端减少2次点的加法运算,提高用户端的计算效率。分析结果表明,该方案是安全有效的。     

An efficient and secure multi-server authentication scheme with key agreement

Remote user authentication is used to validate the legitimacy of a remote log-in user. Due to the rapid growth of computer networks, many network environments have been becoming multi-server based. Recently, much research has been focused on proposing remote password authentication schemes based on smart cards for securing multi-server environments. Each of these schemes used either a nonce or a timestamp technique to prevent the replay attack. However, using the nonce technique to withstand the replay attack is potentially susceptible to the man-in-the-middle attack. Alternatively, when employing the timestamp method to secure remote password authentication, it will require the cost of implementing clock synchronization. In order to solve the above two issues, this paper proposes a self-verified timestamp technique to help the smart-card-based authentication scheme not only effectively achieve password-authenticated key agreement but also avoid the difficulty of implementing clock synchronization in multi-server environments. A secure authenticated key agreement should accomplish both mutual authentication and session key establishment. Therefore, in this paper we further give the formal proof on the execution of the proposed authenticated key agreement scheme.     

A user friendly mutual authentication and key agreement scheme for wireless sensor networks using chaotic maps

Spread of wireless network technology has opened new doors to utilize sensor technology in various areas via Wireless Sensor Networks (WSNs). Many authentication protocols for among the service seeker users, sensing component sensor nodes (SNs) and the service provider base-station or gateway node (GWN) are available to realize services from WSNs efficiently and without any fear of deceit. Recently, Li et al. and He et al. independently proposed mutual authentication and key agreement schemes for WSNs. We find that both the schemes achieve mutual authentication, establish session key and resist many known attacks but still have security weaknesses. We show the applicability of stolen verifier, user impersonation, password guessing and smart card loss attacks on Li et al.’s scheme. Although their scheme employs the feature of dynamic identity, an attacker can reveal and guess the identity of a registered user. We demonstrate the susceptibility of He et al.’s scheme to password guessing attack. In both the schemes, the security of the session key established between user and SNs is imperfect due to lack of forward secrecy and session-specific temporary information leakage attack. In addition both the schemes impose extra computational load on resource scanty sensor-nodes and are not user friendly due to absence of user anonymity and lack of password change facility. To handle these drawbacks, we design a mutual authentication and key agreement scheme for WSN using chaotic maps. To the best of our knowledge, we are the first to propose an authentication scheme for WSN based on chaotic maps. We show the superiority of the proposed scheme over its predecessor schemes by means of detailed security analysis and comparative evaluation. We also formally analyze our scheme using BAN logic.     

Cryptanalysis and improvement of authentication scheme for roaming service in ubiquitous network

Abstract

The paper analyzes a recently proposed secure authentication and key agreement scheme for roaming service in a ubiquitous network. In 2018, Lee et al. proposed a biometric-based anonymous authentication scheme for roaming in ubiquitous networks. But, we found that Lee et al. scheme is prone to the off-line dictionary attack when a user’s smart device is stolen, replay attack due to static variables and de-synchronization attack when an adversary blocks a message causing failure of authentication mechanism. Further, the scheme lacks no key control property and has incorrect XOR calculation. In the sequel, we presented an improved biometric based scheme to remove the weaknesses in Lee et al.’s scheme, which also does not require an update of identity in every session, hence preventing de-synchronization attack. Also, the security of the proposed schemes were analyzed in a widely accepted random oracle model. Further, computational and communication cost comparisons indicate that our improved scheme is more suitable for ubiquitous networks.     

An efficient two-factor user authentication scheme with unlinkability for wireless sensor networks

User authentication with unlinkability is one of the corner stone services for many security and privacy services which are required to secure communications in wireless sensor networks (WSNs). Recently, Xue et al. proposed a temporal-credential-based mutual authentication and key agreement scheme for WSNs, and claimed that their scheme achieves identity and password protection, and the resiliency of stolen smart card attacks. However, we observe that Xue et al.’s scheme is subject to identity guessing attack, tracking attack, privileged insider attack and weak stolen smart card attack. In order to fix the drawbacks, we propose an enhanced authentication scheme with unlinkability. Additionally, the proposed scheme further cuts the computational cost. Therefore, the proposed scheme not only remedies its security flaws but also improves its performance. It is more suitable for practical applications of WSNs than Xue et al.’s scheme.     

Pair-wise path key establishment in wireless sensor networks

When sensor networks deployed in unattended and hostile environments, for securing communication between sensors, secret keys must be established between them. Many key establishment schemes have been proposed for large scale sensor networks. In these schemes, each sensor shares a secret key with its neighbors via preinstalled keys. But it may occur that two end nodes which do not share a key with each other could use a secure path to share a secret key between them. However during the transmission of the secret key, the secret key will be revealed to each node along the secure path. Several researchers proposed a multi-path key establishment to prevent a few compromised sensors from knowing the secret key, but it is vulnerable to stop forwarding or Byzantine attacks. To counter these attacks, we propose a hop by hop authentication scheme for path key establishment to prevent Byzantine attacks. Compared to conventional protocols, our proposed scheme can mitigate the impact of malicious nodes from doing a Byzantine attack and sensor nodes can identify the malicious nodes. In addition, our scheme can save energy since it can detect and filter false data not beyond two hops.     

Two efficient two-factor authenticated key exchange protocols in public wireless LANs

Recently, Parks et al. proposed an authentication and key agreement protocol for low-power PDAs in public wireless LANs using two factors including a password and a token, e.g. a smart card. They claimed that their proposed scheme provided mutual authentication, identity privacy, half-forward secrecy and low computation cost for a client including just one symmetric key encryption and five hash operations. In this paper, we point out that Park et al.’s protocol is vulnerable to the dictionary attack upon identity privacy. We propose two schemes with mutual authentication, half-forward secrecy, lower computation cost and less exchanged messages than Park et al.’s protocol. In additional to these properties, identity privacy, which is not satisfied by Park et al.’s protocol, is also provided by our second scheme.     

An efficient improvement remote user mutual authentication and session key agreement scheme for E-health care systems

The E-health care systems allow patients to gain the health monitoring facility and access medical services remotely. A secure mechanism for mutual authentication and session key agreement is the most important requirements for E-Health Care Systems. Recently, Amin et al.’s proposed a mutual authentication and session key agreement protocol and claimed that their scheme is secure against all possible attacks. In this paper, we show that not only their scheme is vulnerable to privileged-insider attack, replay attack, session key disclosure attack, but also does not provide patient untraceability and backward secrecy. In order to withstand the mentioned security weaknesses, we propose an efficient remote mutual authentication scheme for the systems which are using ECC and Fuzzy Extractor. The proposed scheme not only resists against different security attacks, but it also provides an efficient registration, login, mutual authentication, session key agreement, and password and biometric update phases. During the experimentation, it has been observed that the proposed scheme is secure against various known attacks. Beside, our scheme is robust against privileged-insider attack that it rarely checked in security analysis. The informal analysis will ensure that our scheme provides well security protection against the different security attacks. Furthermore, we analyzed the security of the scheme using AVISPA software and Random Oracle Model. The formal analysis results and performance evaluation vouch that our scheme is also secure and efficient in computation and communication cost.     

一种新的基于身份的Ad hoc认证和密钥协商方案

现有Ad hoc网络中基于身份的认证和密钥协商方案是基于双线性对实现的,计算开销较大,并且存在密钥托管问题。针对该问题,提出了一种新的基于身份的认证和密钥协商方案。方案中,节点之间通过无双线性对的基于身份签名算法实现身份认证,通过Diffie-Hellman密钥协商技术建立会话密钥。分析表明,该方案不存在密钥托管问题,并且具有更高的执行效率。