一种使用双线性映射的移动Agent鉴别协议

描述一种使用双线性映射的Agent鉴别协议,它能在Agent平台间建立信任关系,在ad-hoc模式下不需要使用信任第三方.协议用于Agent获得执行权前的鉴别.方法的主要思想是"单道"链的概念.安全机制采用基于双线性Diffle Hellman密钥交换算法加密文本.     

基于双线性对的隐藏签名认证方案

隐藏签名认证方案是指,当用户从CA得到签名(证书)后,在向服务提供商申请服务时,为防止攻击者截获签名或串通服务提供商来陷害自己,用户向服务提供商证明他(或她)有签名而不把该签名给服务提供商。现有的隐藏签名认证方案都不能阻止CA冒充用户身份。该文引入两个证书权威机构CA,假设两个CA不勾结,提出了3个隐藏签名认证方案。这3个方案都能保护用户身份不被任何人(包括CA)冒充;在用户端具备较强计算能力时,后两个方案实现了用户和服务提供商的双向认证;并且在CA具有一定可信度时,第3个方案还能部分抵抗拒绝服务攻击(DoS)。     

New Multisignature Scheme Based on Bilinear Pairings

Two digital multisignature schemes based on bilinear pairings were proposed. One of them is the sequential digital multisignature, and the other is the broadcasting digital multisignature. The scheme has the same security as JI and LI＇s multisignature scheme, but the new scheme has the lower computation. So the new scheme is the multisignature which has high security and low computation. It has the theory meaning and extensive application under the condition of SmartCard, etc.     

可证明安全的RFID通信安全协议

通过对RFID系统特殊安全问题的系统研究,从可证明安全论证的角度出发,本文提出了一种可证明安全的RFID通信安全协议——rPAP。在随机预言模型下,使用形式化描述方式,系统地建立了RFID通信安全模型,并在该模型下,形式化地论证了rPAP协议的安全性。该协议适用于一般的RFID系统。     

一种新型的LTE-A网络切换认证协议

针对典型蜂窝网络LTE-A网络的切换认证问题,本文通过引入SDN（Software Defined Network,软件定义网络）,提出了软件定义LTE-A异构网络架构,在中心控制器中共享UE（User Equipment,用户设备）的安全上下文信息,以实现简化切换认证过程,提高认证效率的目标.中心控制器的加入,使蜂窝与核心网通信时需要增加一次信令开销,而LTE-A网络的标准切换认证方法过于复杂,应用在软件定义LTE-A异构网络中,会产生较多的信令开销.基于代理签名的切换认证方法,使UE在验证身份时不用经过核心网,减少了信令开销.在安全性相同的情况下,基于椭圆曲线的加密体系比基于RSA的加密体系计算量更小,有利于减少中心控制器的计算压力.本文采用椭圆曲线代理签名方法,提出了一种新型的切换认证协议,并运用着色Petri网进行建模和仿真分析.仿真结果表明,该协议是有效的,且安全性更高.     

Fast and Secure Handover Authentication Scheme Based on Ticket for WiMAX and WiFi Heterogeneous Networks

Integrated WiMAX and WiFi networks is of great potential for the future due to the wider coverage of WiMAX and the high data transport capacity of WiFi. However, seamless and secure handover (HO) is one of the most challenging issues in the WiMAX and WiFi heterogeneous networks. In this paper, we present a fast and secure HO authentication scheme based on credential ticket for WiMAX and WiFi heterogeneous networks. In the proposed scheme, Mobile Station (MS) shows its corresponding credential ticket generated by the previously visited Base Station (BS)/Access Point (AP) to the target BS/AP whenever an HO occurs, and then the MS and target BS/AP can complete the mutual authentication and derive their shared session key without interacting with the Authentication, Authorization, and Accounting server, which significantly reduces the HO authentication delay. Moreover, our scheme fulfills the essential security requirements in HO authentication semantics and the formal verification by the AVISPA tool shows that the proposed scheme is secure against various malicious attacks. In addition, the theoretical analysis and simulation indicate that our scheme outperforms the existing HO authentication schemes in terms of communication and computation cost.     

An Enhanced Secure Authentication Scheme for Vehicular Ad Hoc Networks Without Pairings

Wireless Personal Communications - In the recent paper, Nai-Wei Lo and Jia-Lun Tsai mathematically proposed an efficient authentication scheme for vehicular sensor network. It uses elliptic curve...     

A Priority-Aware Anonymous Handover Authentication Protocol for Wireless Communications

Wireless Personal Communications - A fast handover authentication protocol takes an important role for delay-sensitive applications in wireless networks. Mobile users may be granted different...     

Enhanced Delegation Based Authentication Protocol for Secure Roaming Service with Synchronization

Portable communication systems can provide mobile users with global roaming services. Recently, Youn and Lim proposed a delegation-based authentication protocol which achieves unlinkability for secure roaming services. This paper indicates that there are two drawbacks in Youn and Lim's protocol: 1) the synchronization problem will lead to a fail in on-line authentication; and 2) the exhaustive search puts a heavy burden on the off-line authentication process. Moreover, based on Youn and Lim's protocol, a remedy is proposed to address these problems. It is worthwhile to note that the proposed remedy not only keeps the original advantages but also enhances the security and performance.     

一种泛在网络的安全认证协议

泛在网络是标准的异质异构网络,保证用户在网络间的切换安全是当前泛在网的一个研究热点。该文对适用于异构网络间切换的认证协议EAP-AKA进行分析,指出该协议有着高认证时延,且面临着用户身份泄露、中间人攻击、DoS攻击等安全威胁,此外接入网络接入点的有效性在EAP-AKA协议中也没有得到验证,使得用户终端即使经过了复杂的认证过程也不能避免多种攻击。针对以上安全漏洞,该文提出一种改进的安全认证协议,将传统EAP-AKA的适用性从3G系统扩展到泛在网络中。新协议对传播时延和效率进行完善,为用户和接入点的身份信息提供有效性保护,避免主会话密钥泄露,采用椭圆曲线Diffie Hellman算法生成对称密钥,在每次认证会话时生成随机的共享密钥,并实现用户终端与家乡域网络的相互认证。通过开展实验,对协议进行比较分析,验证了新协议的有效性及高效率。     

基于临时安全域的网格安全认证模型的研究

分析了现有网格安全体系结构模型存在的问题,结合网格固有的特点设计了一个网格环境下的认证模型,该模型以虚拟组织和信任域为基础,针对域内和域间环境采用不同的认证策略并且引入了临时安全域(TSD)的概念,通过分析表明该模型在提供安全身份鉴别的同时简化了实体之间的认证,满足网格环境的安全需求。     

面向V2X安全通信的认证协议研究

车联网作为提高交通效率和安全最有前途的技术之一,已经引起了工业界和学术界的广泛关注.其中,V2X安全通信是研究热点之一.然而,V2X技术的发展也引发了许多安全和隐私问题.为了解决这些问题,大量面向V2X通信的认证协议被提出.本文首先详细介绍了V2X通信的标准模型以及车联网的特点,并根据其特点分析了认证协议设计中需要满足...     

非对称双线性对下的基于身份的加密方案

基于身份的加密是一种直接以用户的身份作为公钥的加密方案。自提出以来,利用双线性对实现基于身份的加密方案的案例已经有很多,但是这些方案大都是采用对称的双线性对,即要求作为映射输入的两个群相同。这无疑缩小了映射中所选取的椭圆曲线的范围,将在一种更一般的条件下,即在非对称双线性对下,基于判定性双线性Diffe-Hellman（BDHE）难解问题在标准模型下构造出一种新型的基于身份的加密方案,并证明其在标准模型下具有不可区分的选择身份的选择明文（IND-sID-CPA）安全性。     

Secure Protocol for Fast EAP Authentication in Wireless Networks

We study the problem of reducing the latency introduced by authentication and network access control processes required in heterogeneous wireless networks and based on the Extensible Authentication Protocol. We aim to reduce the time spent on providing access and smooth transition between different technologies which require to perform authentication in order to allow network access. We propose a secure protocol which reduces the number of roundtrips during authentication and verify its security properties with a formal tool.     

一种新的隐私保护型车载网络切换认证协议

该文针对现有车载网络切换认证协议存在的安全性、隐私等方面的不足,在LIAP协议的基础上提出改进方案。首先将随机数与伪标识串联,再用二次模运算对串联的信息进行加密,以生成动态身份标识保护用户位置隐私;与此同时,在移动终端切换过程中,新路侧单元重新生成新会话秘密序列,并与终端伪标识进行异或加密,对LIAP协议中存在的平行会话攻击进行安全防护。理论分析及实验表明,改进协议不仅满足终端匿名性和抵御各种攻击的安全需求,也实现了较快的切换速度,与同类切换认证协议相比,实用中具明显优越性。     

一个可证安全的基于身份多密钥认证协商协议

An authentication multiple key agreement protocol allows the users to compute more than one session keys in an authentication way. In the paper, an identity-based authentication multiple key agreement protocol is proposed. Its authentication part is proven secure against existential forgery on adaptively chosen message and ID attacks under the random oracle model upon the CDH assumptions. The session keys are proven secure in a formal CK security model under the random oracle model upon the CBDH assumptions. Compared with the previous multiple key agreement protocols, it requires less communication cost.     

基于口令的安全用户认证模型

对基于口令的访问控制进行研究,应用DES,SHA-512和Diffe—Hellman密钥交换协议,提出一个基于口令的安全用户认证模型。此模型可以抵抗中间人攻击、重放攻击、字典攻击和拒绝服务攻击,同时还能提供完善向前保密。基于提出的安全用户认证模型应用HOOK技术,给出了一个基于C／S方式的原型实现。     

利用双线性对构造的面向电子商务的同时签密

Concurrent signature was introduced as an efficient approach to solving the problem of fair exchange of signatures. Almost all fair exchange e-commerce protocols based on concurrent signature that have been proposed until now either do not provide message privacy protection or adopt the sign-then-encrypt scheme to provide confidentiality. However, confidentiality is an important requirement of fair exchange e-commerce protocol. In this paper, a new concept called concurrent signcryption which combines the concepts of concurrent signature and signcryption together to resolve the confidentiality problem in e-commerce systems based on concurrent signature. We also propose a concurrent signcryption scheme using bilinear pairings and prove its security in the random oracle model. Compared with the sign-then-encrypt scheme using bilinear pairings, our scheme enjoys shorter message length and less operation cost. Moreover, in our scheme the two ambiguous signcryptions can be published in any order.     

一种基于相互认证的安全RFID系统

论文分析了现在RFID面临的各种安全问题,然后在XingxinGao等给出的RFID系统的基础上,提出了一种基于相互认证的安全RFID系统。通过结合相互认证机制与随机读取访问控制,本系统可有效地抵御传统攻击,特别是解决了Gao系统的重放攻击漏洞,也保证了个人隐私安全。此外,通过数字证书加密,标签与读头之间的信息交互过程变得更加安全。     

基于Hash算法的网格安全认证模型

分析了现存网格安全认证模型，针对GSI模型中用户鉴别过程，提出一种基于Hash算法的网格安全认证模型H—GSAM。H—GSAM通过对明文采用分段Hash和段内引用混沌映射的方法确保了鉴别过程中的安全性。分析表明，该算法可有效提高用户鉴别过程的效率。