面向WSN的双向认证与密钥协商方案设计

由于无线传感器网络（Wireless Sensor Network,WSN）节点计算能力等资源受限，如何使用较少的计算量实现节点间的认证与密钥协商以保证通信安全一直是研究的热点。针对基于对称密码的认证方案网络扩展性较差、密钥更新困难的问题，以及基于非对称密码的认证方案计算资源开销大的问题，面向WSN安全需求，提出了一种基于身份的非双线性节点认证与密钥协商方案，以椭圆曲线密码算法（Elliptic Curve Cryptography,ECC）为基础，实现了通信节点之间的双向认证、会话密钥协商、确认和更新。分析表明，方案可以满足无线传感器网络节点密钥协商过程所需的几种典型的安全属性，且在资源消耗上有所优化。     

适合于无线传感器网络的混合式组密钥管理方案

针对无线传感器网络中经常出现节点加入或退出网络的情况,提出了一种安全有效的混合式组密钥管理方案.多播报文的加密和节点加入时的组密钥更新,采用了对称加密技术;而系统建立后,组密钥的分发和节点退出后的组密钥更新,采用了基于身份的公钥广播加密方法.方案可抗同谋、具有前向保密性、后向保密性等安全性质.与典型组密钥管理方案相比,方案在适当增加计算开销的情况下,有效降低了节点的存储开销和组密钥更新通信开销.由于节点的存储量、组密钥更新开销独立于群组大小,方案具有较好的扩展性,适合应用于无线传感器网络环境.     

无线传感器网络中自治愈的群组密钥管理方案

 群组密钥管理的自治愈机制是保证无线传感器网络在不可靠信道上进行安全群组通信的重要 手段.基于采用双方向密钥链的群组密钥分发与撤销方法,提出了一个无线传感器网络中具有撤销能力的自治愈群组密钥管理方案.该方案实现了群组密钥的自治愈功能和节点撤销能力, 能够满足在较高丢包率的无线通信环境下传感器网络群组密钥管理的安全需求,确保了群组密钥保密性、前向保密性和后向保密性等安全属性.性能分析表明,该方案具有较小的计算和通信开销,能够适用于无线传感器网络.     

一种面向无线传感器网络节点安全的成簇机制

无线传感器网络容易受到节点欺骗和虚假信息的影响造成所采集信息的安全问题,正常节点可能被占领而变为恶意节点,从而给网络带来不利影响。研究并提出了面向传感器网络的节点安全成簇机制,采用基本的随机密钥预分配模型和有效的密钥管理技术实现网络在成簇阶段进行恶意节点的识别和剔除;同时,增加节点和簇头的安全认证以及重新分簇方法增强节点的安全性。仿真结果表明该成簇机制能够准确捕捉、剔除恶意节点,并能显著降低网络中的广播能耗,对延长网络寿命将起到积极作用。     

一种有效的无线传感器网络密钥协商方案

 针对无线传感器网络能量、计算能力、存储空间以及带宽等局限性问题,提出了一种适合无线传感器网络的密钥协商方案EKASFWSN(Efficient Key Agreement Scheme for Wireless Sensor Networks).该方案首先运用身份加密(IBE)算法预置网络系统参数并通过计算获得节点的相关参数;然后节点使用组播技术向邻居节点广播其ID号并利用Diffie-Hellman密钥交换技术和IBE算法安全地交换节点间的相关参数、计算节点的密钥;最后利用计算获得的节点间共享密钥使用对称密码方法对网络消息进行加、解密.与目前在WSNS研究中比较流行的传统网络密钥协商方案进行的理论分析和仿真实验,结果表明:EKASFWSN方案较好的解决了无线传感器网络在计算能力、能量、存储空间和带宽等方面的局限性问题;并通过密钥交换和身份加密等技术提高了节点通信的安全.     

无线传感器网络中的群密钥协商协议研究

无线传感器网络由大量随机分布的传感器节点组成,这些节点在各自的环境进行信息采集、数据处理,并将信息传输至数据终端。文章提出了一个健壮的、可证明安全的可认证群密钥协商协议,该协议满足实用性、简单性和强安全性的要求。本文提出的可认证群密钥协商协议是基于椭圆曲线、双线性映射和Burmester和Desmedt协议实现。该协议通过两轮广播完成群会话密钥协商,比以前可认证群密钥协商协议需要更低的计算和通信开销。     

改进的基于自更新哈希链的认证方案

针对一些节点计算能力、通信带宽等资源受限的分布式自组网,文中介绍了几种常见的认证思想,并分析了它们的优缺点及适用性。通过采用自更新哈希链和对称密钥技术,提出一种改进的基于自更新哈希链的双向认证密钥协商方案。分析表明,该方案不仅具有较高的安全性能,而且避免了传统非对称算法的复杂运算,只进行简单的哈希哈数和对称密钥算法,大大减少了节点的计算和通信开销,在一定程度上满足资源受限网络的认证需求。     

适用于无线传感器网络的广播认证算法

为了在无线传感器网络中对广播信息进行有效地认证,使用广播者与各预定接收者的共享密钥计算的广播消息鉴别码,基于Nyberg快速单向累加器的单向性、半交换性和吸收性,构造了一种适用于无线传感器网络的广播认证算法,并从安全性、抗俘获能力和开销等方面对算法进行了详细的分析,分析表明该算法能够在小范围内实现对随机广播信息的即时认证,可满足无线传感器网络对广播认证的基本要求.     

WSN中一种改进的密钥管理方案研究

密钥管理作为传感器网络安全中最为基本的环节,在认证和加密过程中起着重要作用。针对无线传感器网络(Wireless Sensor Network,WSN)的通信密钥易被破解的缺点以及为建立安全信道而增加密钥会造成网络的连通率低的问题,提出了一种改进的无线传感器网络密钥管理方案,通过定位算法得到网络中的坐标,利用所得到的位置信息对所存储的密钥空间进行优化,可以增大2个邻居节点拥有相同密钥空间的概率。实验结果表明:该方法占用较小密钥存储空间,能明显改善网络连通性和网络的安全性等性能,提高安全性。     

一种无状态的传感器网络密钥预分配方案

 在无线传感器网络中,节点被敌方捕获以后将泄露节点内存储的群组密钥等秘密信息,所以需要建立一种安全高效的群组密钥管理系统来及时对被捕获节点进行撤销,以保证无线传感器网络中群组通信的安全.提出一种基于逻辑密钥树结构的密钥预分配方案,群组控制者和密钥服务器(GCKS)为逻辑密钥树中每一逻辑节点分配一个密钥集,每一sensor节点对应一个叶节点,以及一条从该叶节点到根节点的路径,GCKS将该路径上所有节点的密钥植入sensor节点.节点撤销时,GCKS将逻辑密钥树分成互不相连的子树,利用子树中sensor节点的共享密钥进行群组密钥的更新.分析表明本方案满足无状态性,以及正确性、群组密钥保密性、前向保密性和后向保密性等安全性质,具有较低的存储、通信和计算开销,适用于无线传感器网络环境.     

破解新型的轻量级数字签名方案

由于RSA、ECC签名方案计算效率低,不适用于无线传感器网络、低廉智能卡、无线射频RFID等特殊应用领域。为设计适用于计算能力有限的小计算设备上的签名方案,Wang等人结合散列认证技术,提出了一种新型的轻量级数字签名方案。针对该新型轻量级数字签名方案,给出了由签名公钥求解其等价签名私钥的多项式时间算法。使用等价签名私钥,对手可以对任意消息伪造签名,从而破解了他们结合散列认证技术提出的数字签名方案。     

A Secure Key Predistribution Scheme for WSN Using Elliptic Curve Cryptography

Security in wireless sensor networks (WSNs) is an upcoming research field which is quite different from traditional network security mechanisms. Many applications are dependent on the secure operation of a WSN, and have serious effects if the network is disrupted. Therefore, it is necessary to protect communication between sensor nodes. Key management plays an essential role in achieving security in WSNs. To achieve security, various key predistribution schemes have been proposed in the literature. A secure key management technique in WSN is a real challenging task. In this paper, a novel approach to the above problem by making use of elliptic curve cryptography (ECC) is presented. In the proposed scheme, a seed key, which is a distinct point in an elliptic curve, is assigned to each sensor node prior to its deployment. The private key ring for each sensor node is generated using the point doubling mathematical operation over the seed key. When two nodes share a common private key, then a link is established between these two nodes. By suitably choosing the value of the prime field and key ring size, the probability of two nodes sharing the same private key could be increased. The performance is evaluated in terms of connectivity and resilience against node capture. The results show that the performance is better for the proposed scheme with ECC compared to the other basic schemes.     

Novel Trusted Hierarchy Construction for RFID Sensor–Based MANETs Using ECCs

In resource‐constrained, low‐cost, radio‐frequency identification (RFID) sensor–based mobile ad hoc networks (MANETs), ensuring security without performance degradation is a major challenge. This paper introduces a novel combination of steps in lightweight protocol integration to provide a secure network for RFID sensor–based MANETs using error‐correcting codes (ECCs). The proposed scheme chooses a quasi‐cyclic ECC. Key pairs are generated using the ECC for establishing a secure message communication. Probability analysis shows that code‐based identification; key generation; and authentication and trust management schemes protect the network from Sybil, eclipse, and de‐synchronization attacks. A lightweight model for the proposed sequence of steps is designed and analyzed using an Alloy analyzer. Results show that selection processes with ten nodes and five subgroup controllers identify attacks in only a few milliseconds. Margrave policy analysis shows that there is no conflict among the roles of network members.     

Simple,secure, and lightweight mechanism for mutual authentication of nodes in tiny wireless sensor networks

Wireless sensor networks (WSNs) are widely used in large areas of applications; due to advancements in technology, very tiny sensors are readily available, and their usage reduces the cost. The mechanisms designed for wireless networks cannot be implied on networks with tiny nodes due to battery and computational constraints. Understanding the significance of security in WSNs and resource constraintness of tiny WSNs, we propose a node authentication mechanism for nodes in wireless sensor networks to avoid security attacks and establish secure communication between them. In the proposed mechanism, a base station (BS) generates a secret value and random value for each sensor node and stores at the node. The sensor node authenticates using secret value and random number. Random nonce ensures freshness, efficiency, and robustness. The proposed mechanism is lightweight cryptographic, hence requires very less computational, communication, and storage resources. Security analysis of the proposed mechanism could not detect any security attack on it, and the mechanism was found to incur less storage, communication, and computation overheads. Hence, the proposed mechanism is best suitable for wireless sensor networks with tiny nodes.     

基于ECC的智能家居密钥管理机制的实现

目前智能家居系统的数据加密技术多采用对称加密方式,但是这种方式存在密钥管理的问题,为实现密钥的安全,智能家居系统采用非对称加密技术,在此基础上设计了基于椭圆曲线密码体制(ECC)的密钥管理机制来达到保障密钥安全的目的.本密钥管理机制包括基于ECC的数据加密密钥管理机制和基于ECC的数字签名密钥管理机制,它们可以使得无线网络节点在身份认证,密钥的产生、分发、存储、更新等环节中密钥的安全性得到保障,其中密钥的存储环节利用了芯片内部闪存的读保护机制,实现了硬件级别的安全存储.最后对本机制的安全性、耗时和可扩展性进行了分析,结果表明该机制具有较强的安全性和可扩展性,在耗时方面优于E-G密钥管理方案.     

TinyZKP: A Lightweight Authentication Scheme Based on Zero-Knowledge Proof for Wireless Body Area Networks

Secure communication over wireless body area network (WBAN) is a key issue in the design and deployment of WBAN systems, in which the authentication of sensor node is a critical process. Conventional authentication schemes are not suitable to the sensor node because of the limitations of memory, computational power and energy in the node. In order to provide an efficient method to verify the identity of sender sensor nodes of WBAN, in this paper a lightweight authentication scheme, TinyZKP, based on zero-knowledge proof (ZKP) is proposed and implemented on TinyOS-based sensor nodes. Our experimental results show that, compared to two ECDSA-based authentication schemes in TinyECC and WM-ECC, the TinyZKP runs 1.9 and 1.4 times faster and the energy cost is reduced by 48 % and 28 %, respectively.     

Ad hoc空间网络密钥管理与认证方案

为了使一组卫星动态配置成一个具有灵活的分布式体系结构的集成网络信息系统，可以采用ad hoc组网方式，这种卫星网络的组网方式带来了新的安全挑战。提出了一个灵活的安全方案，设计了公钥基础设施和认证策略。基于完全分布式的认证中心，可以直接采用几乎所有的标准公钥认证协议。当空间节点的计算能力有限时，设计了一个轻型的基于对称密钥算法和单向散列函数的认证协议，在提供保密性和数据完整性的同时大大减小了计算量。     

基于生物特征标识的无线传感器网络三因素用户认证协议

为满足高安全级别场景（如军事、国家安全、银行等）的应用需求,进一步提高无线传感器网络用户认证协议的安全性,提出了基于生物特征识别的三因素用户认证协议.针对Althobaiti协议无法防御节点妥协攻击、模拟攻击、中间人攻击和内部特权攻击的安全缺陷,增加智能卡和密码作为协议基本安全因素,并利用生物特征标识信息生成函数与回复函数处理的生物特征标识作为附加安全因素;在密钥管理中,为每个节点配置了与网关节点共享唯一密钥,保证认证过程的独立性与安全性;实现用户自主选择与网关节点的共享密钥,提高公共信道通信的安全性;在网关节点不参与的情况下,设计密码和生物特征标识更新机制,保证二者的新鲜性.通过Dolev-Yao拓展威胁模型的分析与AVISPA的OFMC分析终端的仿真,结果证明该认证协议克服了Althobaiti协议安全缺陷,且对计算能力的需求小于公钥加密.权衡安全性与计算成本,该协议适用于资源受限且安全需求高的无线传感器网络应用.     

Access control in wireless sensor networks

Nodes in a sensor network may be lost due to power exhaustion or malicious attacks. To extend the lifetime of the sensor network, new node deployment is necessary. In military scenarios, adversaries may directly deploy malicious nodes or manipulate existing nodes to introduce malicious “new” nodes through many kinds of attacks. To prevent malicious nodes from joining the sensor network, access control is required in the design of sensor network protocols. In this paper, we propose an access control protocol based on Elliptic Curve Cryptography (ECC) for sensor networks. Our access control protocol accomplishes node authentication and key establishment for new nodes. Different from conventional authentication methods based on the node identity, our access control protocol includes both the node identity and the node bootstrapping time into the authentication procedure. Hence our access control protocol cannot only identify the identity of each node but also differentiate between old nodes and new nodes. In addition, each new node can establish shared keys with its neighbors during the node authentication procedure. Compared with conventional sensor network security solutions, our access control protocol can defend against most well-recognized attacks in sensor networks, and achieve better computation and communication performance due to the more efficient algorithms based on ECC than those based on RSA.     

一种基于随机密钥的无线传感器网络加密方案

密钥的建立与管理是无线传感器网络安全的重要且基础的组成部分,是影响大规模应用的一个关键问题。近来,密钥建立与管理成为无线传感器网络安全领域一个活跃的研究分支。提出一种基于随机密钥预分配的无线传感器网络加密方案。该方案通过密钥互斥机制解决传统随机密钥预分配方案中点到点数据源认证问题。