A novel pairing-free certificateless authenticated key agreement protocol with provable security

Recently, He et al. (Computers and Mathematics with Applications, 2012) proposed an efficient pairing-free certificateless authenticated key agreement (CL-AKA) protocol and claimed their protocol was provably secure in the extended Canetti-Krawczyk (eCK) model. By giving concrete attacks, we indicate that their protocol is not secure in the eCK model. We propose an improved protocol and show our improvement is secure in the eCK model under the gap Diffie-Hellman (GDH) assumption. Furthermore, the proposed protocol is very efficient.     

无线传感器网络中三方密钥建立协议研究

提出了一个无线传感器网络(WSN)的可证明安全认证三方密钥建立协议。协议的安全性基于求解椭圆曲线离散对数问题和双线性配对Diffie Hellman问题的计算不可行性。节点之间的身份验证是无线传感器网络中最具挑战性的一个安全要求,它需要在WSN中三个相邻节点之间建立正确的会话密钥轮来实现这种安全目标。通过理论证明,该协议对数据完整性攻击和会话密钥中已知密钥安全性攻击是安全的,并提供了完美的前向安全。     

标准模型下可证安全的认证密钥协商协议

提出了一个标准模型下的基于身份认证的密钥协商协议。协议的设计采用了双线性配对的思想,协议的安全性分析,则综合运用了串空间知识以及可证安全中Game证明的方法,给出了严格的证明。协议具有良好的前向安全性和会话密钥无托管性,通过利用显式的身份认证,提高了协议的执行效率。与随机预言模型中的协议相比,在计算和通信效率方面相当。     

Secure lightweight password authenticated key exchange for heterogeneous wireless sensor networks

Several three-party password authenticated key exchange (3-PAKE) protocols have recently been proposed for heterogeneous wireless sensor networks (HWSN). These are efficient and designed to address security concerns in ad-hoc sensor network applications for a global Internet of Things framework, where a user may request access to sensitive information collected by resource-constrained sensors in clusters managed by gateway nodes. In this paper we first analyze three recently proposed 3-PAKE protocols and discuss their vulnerabilities. Then, based on Radio Frequency Identification technologies we propose a novel 3-PAKE protocol for HWSN applications, with two extensions for additional security features, that is provably secure, efficient and flexible.     

Pair-wise path key establishment in wireless sensor networks

When sensor networks deployed in unattended and hostile environments, for securing communication between sensors, secret keys must be established between them. Many key establishment schemes have been proposed for large scale sensor networks. In these schemes, each sensor shares a secret key with its neighbors via preinstalled keys. But it may occur that two end nodes which do not share a key with each other could use a secure path to share a secret key between them. However during the transmission of the secret key, the secret key will be revealed to each node along the secure path. Several researchers proposed a multi-path key establishment to prevent a few compromised sensors from knowing the secret key, but it is vulnerable to stop forwarding or Byzantine attacks. To counter these attacks, we propose a hop by hop authentication scheme for path key establishment to prevent Byzantine attacks. Compared to conventional protocols, our proposed scheme can mitigate the impact of malicious nodes from doing a Byzantine attack and sensor nodes can identify the malicious nodes. In addition, our scheme can save energy since it can detect and filter false data not beyond two hops.     

A pairing-free identity-based authenticated key agreement protocol with minimal message exchanges

Based on the computational Diffie-Hellman problem, this paper proposes an identity-based authenticated key agreement protocol which removes bilinear pairings. Compared with previous protocols, the new protocol minimizes message exchange time with no extra cost. The protocol provides strong security guarantees including key compromise impersonation resilience, perfect forward secrecy, and master key forward secrecy. A security proof with the modular approach in the modified Bellare-Rogaway model is also provided.     

An efficient password-based three-party authenticated multiple key exchange protocol for wireless mobile networks

With the rapid development of wireless mobile communication, the password-based three-party authenticated key exchange protocol has attracted an increasing amount of attention. To generate more session keys at one time for different applications, Li et al. proposed a password-based three-party authenticated multiple key exchange (3PAMKE) protocol for wireless mobile networks. They claimed that their protocol could withstand various attacks. In this paper, we will show Li et al.’s protocol is not secure off-line password guessing. Furthermore, we proposed an improved 3PAMKE protocol to overcome weakness in Li et al.’s protocol. Security analysis and performance analysis shows our protocol not only overcomes security weakness, but also has better performance. Therefore, our protocol is more suitable for wireless mobile networks.     

传感器网络中对偶密钥建立协议研究

传感器节点部署的随机性可能导致网络中出现孤立的密钥共享连通集团。为解决这一问题,提出了基于信任关系传递的多点信任模型,构造了基于信任域认证的对偶密钥建立协议。仿真结果表明：该协议具有良好的抗妥协性能,能够有效地实现孤立集团间的互联,从而验证了其安全性和有效性。     

有效的群组密钥自治愈管理方案

对无线传感器网络的自治愈群组密钥管理方案进行了研究.针对无线传感器网络群组通信信道不可靠、丢包率较高的无线通信环境现状,提出了一种具有撤销能力的群组密钥自治愈管理方案.该方案利用散列链的单向性和后续会话标志的不可知性实现了群组密钥的安全.通过会话密钥的历史冗余关联,使授权节点能够自动恢复丢失的群组会话密钥.安全及能量消耗分析表明,该方案不仅能保证无线传感器网络的通信安全,而且具有较低的通信开销和存储开销,适应于大规模的无线传感器网络.     

WSN中一种轻量级和高安全性的密钥管理方案

提出了一种基于ECC和ElGamal的轻量级高安全性密钥管理方案。该方案采用汉密尔顿算法构造密钥池, 采用分区域管理模型, 每一区域设有一个服务器和控制中心, 协议结合ElGamal进行通信双方的会话密钥协商。性能分析和仿真结果表明, 该方案与传统的密钥管理方案相比, 方案中节点的计算开销和通信开销得到了大大的降低, 具有良好的网络连通性, 比较适合于无线传感器网络。     

Resource-efficient authentic key establishment in heterogeneous wireless sensor networks

A key challenge for the protection of heterogeneous wireless sensor networks (HWSNs) is how to enable sensor nodes to establish shared cryptographic keys in an authentic and resource-efficient manner for their secure communications. So far, a number of schemes have been developed to address this challenge. However, a main shortcoming of these schemes is that their use of sensor resources is not properly balanced. This has motivated us to propose a new lightweight scheme to rectify the problem. The scheme only employs symmetric cryptosystems for its design. It takes advantage of the hierarchical clustering feature of a HWSN to deliver a novel way of building vertical key shareability before sensor deployment to enable horizontal key shareability after the deployment for authentic shared key establishment. The scheme evaluation shows that it offers strong authenticity and resilience against various security threats, and is more resource-efficient, flexible and scalable than related work.     

一种可证明安全的匿名可认证密钥协商协议

提出了一种新的双方密钥协商协议,新方案采用紧致结构以确保方案的匿名性。之后利用可证明安全理论对新方案进行了严格的安全性分析,同时对方案的匿名性和AKE安全性进行了论证。新方案的消息长度较短,且只需两轮交互,与类似方案相比有较明显的性能优势。     

A provably secure authenticated key agreement protocol for wireless communications

Designing elliptic curve password-based authenticated key agreement (ECPAKA) protocols for wireless mobile communications is a challenging task due to the limitation of bandwidth and storage of the mobile devices. Some well-published ECPAKA protocols have been proved to be insecure. We notice that until now none of the existing ECPAKA protocols for wireless mobile communication is provided any formal security analysis. In this paper, we propose a novel protocol and conduct a formal security analysis on our protocol. Compared with other ECPAKA protocol, our protocol meets all basic security properties and is the first ECPAKA protocol with formal security proof for wireless communication. We also explore the suitability of the novel protocol for 3GPP2 specifications and improve the A-Key (Authentication Key) distribution for current mobile cellular systems.     

An enhanced authenticated key agreement protocol for wireless mobile communication

With the rapid progress of wireless mobile communication, the authenticated key agreement protocol has attracted an increasing amount of attention. However, due to the limitations of bandwidth and storage of the mobile devices, most of the existing authenticated key agreement protocols are not suitable for wireless mobile communication. Quite recently, Sui et al. have presented an efficient authenticated key agreement protocol based on elliptic curves cryptography and included their protocol in 3GPP2 specifications to improve the security of A-Key distribution. However, in this paper, we show that Sui et al.'s protocol can't resist the off-line password guessing attack, and therefore present an enhanced authenticated key agreement protocol. At the same time, we also consider including our enhanced protocol in 3GPP2 specifications.     

一种基于分簇的无线传感器网络动态密钥分发协议

层簇式无线传感器网络具有能量利用率高的优点,目前已经提出了多种基于分簇的路由协议,但这些协议并没有考虑到安全性因素.针对这个问题,提出了一种基于分簇的动态密钥分发协议SDKD,通过综合考虑节点的剩余能量和地理位置信息优化簇头选举机制,并使用哈希函数产生动态密钥加密通信过程.仿真实验表明,SDKD协议与典型的分簇协议LEAP相比,降低了网络能量消耗,并延长了网络生命周期.     

Escrowable identity-based authenticated key agreement protocol with strong security

Escrowable identity-based authenticated key agreement protocols are welcome in certain closed groups applications, where audit trail is a legal requirement. In this paper, we present a strongly secure one-round escrowable identity-based two-party authenticated key agreement protocol, which captures all basic desirable security properties including perfect forward secrecy, ephemeral secrets reveal resistance and so on, and is provably secure in the extended Canetti–Krawczyk (eCK) model. We show that the security of the protocol can be reduced to the standard computational bilinear Diffie–Hellman assumption in the random oracle model. Assuming that no adversary can obtain the master private key for the escrow mode, our scheme is secure as long as each party has at least one uncompromised secret. To the best of our knowledge, our scheme is the first escrowable identity-based authenticated key agreement protocol provably secure in the eCK model.     

无线传感器网络密钥管理方案前向安全性研究

对现有的基于椭圆曲线的无线传感器网络密钥管理方案进行了分析研究,针对现有密钥管理算法不具备前向安全性的问题,以相对简单及较为经典的两个方案为基础,将前向安全的概念引入到密钥管理方案之中,实现了前向安全在椭圆曲线无线传感器网络密钥管理方案中的应用。在此基础上,应用硬件节点MICAz进行硬件模拟,分析了方案的安全性、存储消耗、运行时间,验证了方案的适用性。     

A comprehensive security analysis of LEACH++ clustering protocol for wireless sensor networks

Wireless sensor networks (WSNs) will play a major role in future technologies in the development of the cyber-physical society. Studies show that WSNs are vulnerable to various insider attacks that may degrade its performance and affect the application services. Various intrusion detection system-based solutions have been proposed for WSNs to secure them from such attacks; however, these solutions have certain limitations with respect to completeness and evaluation. Recently, we proposed an intrusion detection framework to secure WSNs from insider attacks and proposed a protocol called LEACH++. In this paper, we perform a detailed security analysis of LEACH++ against black-hole, sink-hole and selective forwarding attacks by launching a number of attacks with different patterns. The results of our experiments performed in network simulator-2 show that the proposed scheme is highly efficient and achieves higher accuracy and detection rates with very low false-positive rate when compared to an anomaly based detection scheme.