云计算中的轻量级查询结果验证机制

存储在云计算服务器上的数据可能被篡改或删除,查询完整性验证的作用是确保查询用户能够验证查询结果中的数据是真实的,且包含所有满足条件的数据。提出了一种基于签名链结构的查询完整性验证机制。方案使用代数签名机制替代数字签名实现校验值的计算,从而有效降低计算和查询验证开销。此外,通过维护一种新的、简单的索引结构实现了仅需下载少量数据即可实现校验值的更新。实验结果表明,所提方案比基于数字签名的签名链方案具有更小的更新开销和更高的验证效率。     

基于PUF的轻量级RFID安全认证协议

为解决射频识别系统易受传统攻击和物理克隆攻击等问题,提出一种基于物理不可克隆函数的轻量级射频识别安全认证协议.采用随机数、轻量级杂凑函数、轻量级分组算法和基于物理不可克隆函数等密码原语来实现通信安全.协议可防范窃听、篡改、假冒、重放和物理克隆等多种攻击方式,可有效降低计算处理和存储资源消耗,比较适合于低成本、低功耗且硬...     

Breaking a remote user authentication scheme for multi-server architecture

Lin et al., (2003) proposed a remote user authentication scheme for multi-server architecture. In this paper, we breaks this scheme by giving an attack. Our attack allows an adversary to impersonate any user in the system, as long as a single authentication message of that user is observed.     

Two-factor wearable device authentication protocol based on PUF and IPI

Wearable device is pushing the rapid development of mobile health,however,the open architecture of wireless body area network has brought challenges for the security of user data.In order to protect the security of user data,a two-factor authentication protocol between device note and data hub was proposed based on physically unclonable function and interpulse interval.Using dual uniqueness of device physical characteristic and user biometric trait,the protocol can resist compromise and impersonation attacks and was specially suitable for resource constrained wearable devices under body area network.Compared with the existing authentication schemes,the security of the proposed protocol was enhanced.The practicability and effectiveness of the protocol are confirmed by hardware implementation on FPGA.     

轻型的RFID安全认证协议LAP

RFID标签存在着处理能力弱、存储空间小和电源供给有限等局限性,传统的公钥算法或散列函数等复杂运算不能满足实际应用的需求。针对现有轻量级RFID认证协议的不足,设计了基于广义逆矩阵的RFID安全认证协议LAP。该协议采用了硬件复杂度较低的CRC校验及计算量较小的矩阵运算。通过安全隐私和性能分析,LAP协议适用于低成本、存储与计算受限的RFID标签。     

基于多特征的MPEG视频认证方案

为更加准确地反映MPEG视频的内容,构造了一种将视频时间信息、运动特征信息以及DCT系数块能量关系信息等多种特征融合在一起的多特征数字签名算法,并以不增加MPEG编码复杂度的水印嵌入方式将数字签名嵌入到视频中,并实现了基于多特征的视频认证方案.认证实验结果证明,本方案对于如代码转换、重新压缩等常规处理较之单特征认证方法虚警概率要低,而对于如移除、替换等恶意攻击能做出有效判断,并能对篡改区域进行准确定位.     

基于Merkle哈希树的无线躯体传感器网络安全认证方案

针对无线躯体传感器网络(WBSN)数据传输的安全性,提出一种融合Merkle哈希树和网络编码的轻量级认证方案。首先,将传感器网络构建成Merkle哈希树结构,只对根节点进行数字签名;然后,在哈希树中选择一个最优层进行网络编码,形成恢复数据包,并将数据包、签名和恢复包发送给接收器;最后,接收器通过密钥对根节点签名进行验证,若存在节点丢失,则根据恢复数据包重建哈希树,从而对数据进行认证。实验结果表明,该方案能够实现对数据的安全认证,且需要较少的网络开销,满足WBSN的性能需求。     

Lightweight integrity verification scheme for cloud based group data

In order to protect the security of the data stored in the cloud by group users,a data integrity verification scheme was designed which can protect the privacy of the group users.The scheme can efficiently detect the shared data in the cloud and support the dynamic updating of the data,and use the characteristic of the ring signature to hide the iden-tity of the signer corresponding to the data block.That is,the third-party verifier can not spy on the users identity and other private information when validating.The aggregated approach is used to generate data labels,which reduces the storage cost of labels and supports the dynamic operation of group data,so that the users in the group can easily modify the cloud group data.     

基于智能卡的动态身份认证机制

由于每次登录时用户提交的认证信息都是固定不变的,传统的口令认证机制容易遭受回放攻击。本文根据一个关于互素数的定理,提出了一种基于智能卡的动态身份认证机制。用户每次登录时,智能卡根据从服务器发来的challenge和事先嵌入智能卡的参数信息,为合法用户计算当前的认证信息。由于每次用户提交的认证信息都是动态可变的,从而有效地防止了回放攻击。     

Cryptanalysis of Hsiang‐Shih's authentication scheme for multi‐server architecture

From user point of view, password‐based remote user authentication technique is one of the most convenient and easy‐to‐use mechanisms to provide necessary security on system access. As the number of computer crimes in modern cyberspace has increased dramatically, the robustness of password‐based authentication schemes has been investigated by industries and organizations in recent years. In this paper, a well‐designed password‐based authentication protocol for multi‐server communication environment, introduced by Hsiang and Shih, is evaluated. Our security analysis indicates that their scheme is insecure against session key disclosure, server spoofing attack, and replay attack and behavior denial. Copyright © 2010 John Wiley & Sons, Ltd.     

Multi-layer authentication scheme for HEVC video based on embedded statistics

A multi-layer authentication scheme for HEVC compressed video is proposed. The combination of CU sizes, which is unique to HEVC and sensitive to video manipulation, is considered along with other elements in the HEVC coding standard to generate the authentication tag. Temporal dependency was enforced, where the authentication tag generated in one slice is embedded into its subsequent slice. By design, the authentication tag is repeatedly but selectively embedded into various elements in a HEVC video, including nonzero DCT coefficients, QP parameter values, and prediction modes, depending on the bit segment in the generated tag. Our scheme offers three layers of authentication to detect and localize the tampered regions in a HEVC video, as well as verifying the source/sender of the video using a shared secret key. Video sequences from various classes (resolutions) are considered to verify the performance of the proposed multi-layer authentication scheme. Results show that, at the expense of slight degradation in perceptual quality, the proposed scheme is robust against several common attacks. A functional comparison is performed between the proposed multi-layer authentication scheme and the conventional schemes.     

基于票据的名字解析系统切换认证机制

名字解析系统作为信息中心网络的重要组成部分,负责建立、维护和发布信息名字和地址之间的映射关系,提供名字解析服务。移动节点在使用名字解析系统服务时,存在代理之间切换认证的场景。针对该场景简单性、高效性和安全性的要求,结合无线网络中的切换认证机制,提出一种基于票据的名字解析系统切换认证机制。移动节点利用认证服务器预签名的票据进行接入认证,之后使用原代理分发的票据进行切换认证。认证过程减少移动节点计算量大的操作和认证双方交互次数。移动节点分别通过四次通信和二次通信完成接入认证和切换认证。分析表明该机制不仅具有多种安全特性如隐私保护、双向认证、前向和后向安全性、抵抗重放攻击和伪造攻击,而且计算代价减少48%,通信开销降低至少25%。     

基于动态身份远程用户认证方案的研究

针对基于动态身份远程用户认证,可有效防止用户关键信息泄露,保证已认证用户通过授权获取网络服务.针对Wen-Li提出的基于动态身份远程用户认证与密钥协商方案进行安全性分析,指出该方案存在安全缺陷,可能导致泄露用户部分关键信息,进而遭受网络攻击.在保留Wen-Li方案优点基础上提出一种改进的远程用户认证方案,重新设计了认证过程中的会话密钥和密钥确认消息,与Wen-Li方案相比,改进方案能够抵御中间人攻击以及盗窃智能卡攻击,并增强了方案的前向安全性.     

基于NTRU的EPON认证方案研究

设计了一种基于NTRU双向认证方案,该方案将NSS签名算法和HASH函数等技术运用到双向认证中,并嵌入了会话密钥作为后续数据传输的对称密钥.分析结果表明,该方法提高了身份认证的可靠性和数据传输的安全性.     

Conditional privacy protection authentication scheme based on bilinear pairings for VANET

To solve the problem of security and efficiency of anonymous authentication in the vehicle Ad-hoc network（VANET）, a conditional privacy protection authentication scheme for vehicular networks is proposed based on bilinear pairings. In this scheme, the tamper-proof device in the roadside unit (RSU) is used to complete the message signature and authentication process together with the vehicle, which makes it more secure to communicate between RSU and trusted authority (TA) and faster to update system parameters and revoke the vehicle. And this is also cheaper than installing tamper-proof devices in each vehicle unit. Moreover, the scheme provide provable security proof under random oracle model (ROM), which shows that the proposed scheme can meet the security requirements such as conditional privacy, unforgeability, traceability etc. And the results of simulation experiment demonstrate that this scheme not only of achieves high efficiency, but also has low message loss rate.     

基于雾计算的物联网架构研究

物联网是一种能将物体连接至互联网使其更加智能的技术.但是物联网设备产生的大数据难以处理,网络架构的可扩展性差,以及用户的安全隐私容易泄露等问题都限制了物联网的发展.为了解决这些问题,通过分析雾计算所具有的优势提出基于雾计算的物联网架构.基于该架构,同时考虑到用户的安全隐私问题,又提出分层的网络架构.最后对文章进行总结和展望.     

Fragile watermarking scheme for image authentication

A simple fragile watermarking scheme for image authentication is proposed. The insertion of a binary watermark is accomplished by replacing the least significant bit of the host image with a random binary image obtained by random permutations and suitable XOR operations among bitplanes. The proposed scheme is secure, fast, and capable of detecting and localising modification, and is immune of the well-known quantisation attack.     

一种基于信息隐藏的移动终端认证方案

提出了一种用信息隐藏技术代替加密技术来实现的移动终端认证方案,以图像作为信息隐藏的载体,借鉴Kerberos[1]认证协议中相互认证的思想,实现了移动终端身份认证。在认证过程中使用了隐写术[2]和数字水印[3],前者用于认证信息的传递,后者保证认证图像的唯一性,同时实现各服务器之间的身份认证。二者相辅相成,更好地保证了认证信息的隐蔽与安全。针对于Kerberos系统中可能会发生的重放攻击,文中采用时间戳连同协商随机数的方法得以解决。     

Mobile platform continuous authentication scheme based on gait characteristics

The popularity of smart phones renders people extremely high requirements for safety.But the traditional one-time authentication method can’t continuously guarantee the security of equipment.To solve the problem,a continuous authentication scheme based on gait characteristics was proposed to realize the identification of current visitors.Moving average filtering,threshold-based useful information interception method and other operations were adopted to reduce noise interference.Template interception was used to maximize the utilization of information,and an optimal combination of time domain features and frequency domain features were proposed to reduce the storage space requirement of users’ information.Finally,the support vector machine realized the identity authentication function.Experiments show that the proposed scheme can effectively authenticate the identities of visitors.     

基于签密算法的EPON认证方案研究

介绍了签密密码体系和ONU/OLT注册过程,提出了一种适用于EPON安全注册的双向认证方案.分析了该方案在EPON注册认证过程中一逻辑步完成加密和签密的认证效率优势,与两种传统公钥EOPN双向认证方案相比,该方案自定义控制帧的快速封装特性能确保认证信息的机密性.