Key-leakage evaluation of authentication in quantum key distribution with finite resources

Partial information leakages of generation key undoubtedly influence the security of practical Quantum Key Distribution (QKD) system. In this paper, based on finite-key analysis and deep investigation on privacy amplification, we present a method for characterizing information leakages gained by adversary in each authentication round and therefore take the theory derived by Cederlöf and Larsson (IEEE Trans Inf Theory 54:1735–1741, 2008) into practical case. As the authentication key is fed from one round of generation keys to the next except the first round, by considering its security weakness due to information leakages and finite size effect, we further propose a universal formula for calculating the lifetime of initial authentication key used in QKD with finite resources. Numerical simulations indicate that our bound for estimating information leakages strictly characterizes the stability of practical QKD against information-leakage-based attacks, and our calculation formula in terms of lifetime can precisely evaluate the usage time of initial authentication key. Our work provides a practical solution for evaluating authentication security of QKD.     

Advanced unambiguous state discrimination attack and countermeasure strategy in a practical B92 QKD system

Even though unconditional security of B92 quantum key distribution (QKD) system is based on the assumption of perfect positive-operator-valued measures, practical B92 systems only utilize two projective measurements. Unfortunately, such implementation may degrade the security of the B92 QKD system due to Eve’s potential attack exploiting the imperfection of system. In this paper, we propose an advanced attack strategy with an unambiguous state discrimination (USD) measurement which makes practical B92 QKD systems insecure even under a lossless channel. In addition, we propose an effective countermeasure against the advanced USD attack model by monitoring double-click events. We further address a fundamental approach to make the B92 QKD system tolerable to attack strategies with USD measurements using a multi-qubit scheme.     

一种基于ECC的一次性口令身份认证方案

身份认证机制是网络安全的第一道防线,一次性口令(OTP)技术是不需要第三方参与的身份认证技术,但其本身存在安全漏洞。介绍了一次性口令认证技术的原理,并分析了S/Key一次性口令系统不能抵御冒充攻击以及存在小数攻击等局限性。基于ECC密码体制,对现有的一次性口令系统进行了改进,提出一种可以进行双向认证的一次性口令认证方案。此方案能够进行双向的身份验证,有效地防止了冒充攻击、重放攻击和小数攻击,从而提高了认证系统的安全性。     

基于改进OTP的用户认证技术的研究与实现

随着网络应用的不断发展，网络安全问题也变得越来越重要．用户认证机制是安全防护机制之一，认证信息可以用来认证需访问系统的请求用户的合法性。文中分析了无须第三方认证的“一次性口令(OTP)”技术及其存在的安全漏洞，结合Kerberos认证机制优点，提出了将用户的通行密语用服务器的公钥加密后保存在数据库中，并在服务器种子信息中加入时间戳和服务器IP地址的改进OTP技术，提高了认证系统的安全性。     

基于EIGamal密码体制的一次性口令认证技术改进

分析了一次性认证技术的原理并指出了它所存在的安全漏洞,基于EIGamal密码体制,提出了一种改进方案,从而使系统具有更高的安全性。     

Identity based secure authentication scheme based on quantum key distribution for cloud computing

Identity theft is the most recurrent twenty-first century cybercrime. Thus, authentication is of utmost significance as the number of hackers who seek to intrigue into legitimate user’s account to obtain sensitive information is increasing. Identity based authentication operates to corroborate the identity of the user so that only the legitimate user gets access to the service. This paper proposes a quantum identity based authentication and key agreement scheme for cloud server architecture. Quantum cryptography based on the laws of quantum physics is a vital technology for securing privacy and confidentiality in the field of network security. A formal security analysis has been performed using AVISPA tool that confirms the security of the proposed scheme. The security analysis of the proposed protocol proves that it is robust against all security attacks. To confirm applicability of quantum key distribution in cloud computing, a practical long-distance entanglement-based QKD experiment has been proposed. This experiment confirms successful generation of shifted keys over distance of 100 km of optical fiber with a key rate of 4.11 bit/s and an error rate of 9.21 %.     

基于OTP的增强型身份认证系统的研究与设计

身份认证是网络安全的第一道防线,也是最重要的一道防线。一次性口令认证技术是一种易于实现且安全度较高的解决方案。但是,基于OTP技术的身份认证系统在实际实施 和运用中仍然存在一些潜在的问题。本文提出的SOTP身份认证系统克服了OTP认证技术的弱点,具有更好的安全性和实用性。     

SaaS模式下新型认证方案的设计与分析

针对软件即服务(SaaS)应用系统下认证协议的应用及安全性问题,提出一种新型认证方案。通过加密用户口令,将散列结果传输到网络上,只有服务器私钥才能解密,从而实现客户端及服务器双向认证一次性口令技术,提高认证系统的安全性。采用SVO逻辑对该协议进行形式化分析,结果验证了其安全性。     

一次性口令认证方案的研究与改进

研究了动态口令技术,分析了文献[4]中一个简单的一次性口令认证方案,发现原方案不能抵御冒充服务器攻击并且认证信息以明文方式进行传输,通过引入公钥加密算法对原方案进行改进,改进的方案不仅能防止重放攻击,而且能够抵御冒充服务器攻击,具有更高的安全性。     

基于角色驱动的需求响应安全接入机制

研究并提出基于角色驱动的需求响应安全接入机制。在需求响应主体发起接入请求后,对接入主体进行一次一密算法的安全认证。认证通过后,利用主动或被动数据采集技术对接入主体的网络设备通信数据进行采集。数据分析首先采用聚类算法消除数据中的噪声（异常数据）,再将处理后的数据与角色类型中其他主体的信息进行关联分析。安全控制机制根据关联分析的结果,对接入主体进行角色分配,并授予受保护的系统和数据资源上执行某种操作的权限,完成安全接入过程。对比评估表明,在开销增长允许的范围内,该机制增强了需求响应接入的安全性和灵活性。     

Multiple stochastic paths scheme on partially-trusted relay quantum key distribution network

Quantum key distribution (QKD) technology provides proven unconditional point-to-point security based on fundamental quantum physics. A QKD network also holds promise for secure multi-user communications over long distances at high-speed transmission rates. Although many schemes have been proposed so far, the trusted relay QKD network is still the most practical and flexible scenario. In reality, the insecurity of certain relay sections cannot be ignored, so to solve the fatal security problems of partially-trusted relay networks we suggest a multiple stochastic paths scheme. Its features are: (i) a safe probability model that may be more practical for real applications; (ii) a multi-path scheme with an upper bound for the overall safe probability; (iii) an adaptive stochastic routing algorithm to generate sufficient different paths and hidden routes. Simulation results for a typical partially-trusted relay QKD network show that this generalized scheme is effective. Supported by the National Fundamental Research Program of China (Grant No. 2006CB921900), the National Natural Science Foundation of China (Grant Nos. 60537020 and 60621064), the Knowledge Innovation Project of the Chinese Academy of Sciences, and the Chinese Academy of Sciences International Partnership Project     

New robust biometrics-based mutual authentication scheme with key agreement using elliptic curve cryptography

In this work, we demonstrate that Chaudhry et al.’s recent biometrics-based three factor authentication scheme is vulnerable to the denial of service attack, and it also fails to provide perfect forward secrecy because it only uses the lightweight symmetric key primitives to ensure security. To enhance the information security, this article presents a new robust biometrics-based mutual authentication scheme using elliptic curve cryptography for client-server architecture based applications in mobile environment. The proposed scheme supports session key agreement and flawless mutual authentication of participants, which is proved under the BAN logic. Moreover, the proposed scheme provides prefect security attributes and resists all known attacks, and it has perfect performance in communication cost. Thereby, the proposed scheme is more suitable for client-server architecture based applications.     

An ID-based client authentication with key agreement protocol for mobile client-server environment on ECC with provable security

Recently, lots of remote user authentication schemes are implemented on elliptic curve cryptosystem (ECC) to reduce the computation loads for mobile devices. However, most of those remote user authentication schemes on ECC suffer from different attacks and can not provide provable security. Therefore, we propose an ID-based remote mutual authentication with key agreement scheme on ECC in this paper. The proposed scheme not only provides mutual authentication but also supports a session key agreement between the user and the server. The scheme also provides the known session key security, the perfect forward secrecy, the no key-compromise impersonation, the no unknown key-share and the no key control. Compared with the related works, the proposed scheme is more efficient and practical for mobile devices. We also give a security proof under the random oracle.     

一种基于Harn数字签名的双向认证访问控制方案

针对信息保护系统,该文在于Harn数字签名方案和零知识证明构造了一种双向认证访问控制方案。在该方案中,用户与系统不必暴露秘密信息就可以进行双向认证,并且用户和系统的共享密钥可用于认证有 访问保密信息体的请求的合法权限。因此,该方案与已有该问控制方案相比要更加安全。该方案能够执行像改变存取权限和插入／删除用户或信息体这样的该访问操作,而不影响任何用户的保密密钥,不需重建信息保护系统。因此,该方案动态特性好。基于Harn数字签名方案和零知识证明给出的这一认证访问控制方案的计算安全性不低于求解“离散对数问题”的计算复杂性。     

融入混沌理论的一种OTP方案研究

身份认证中广泛使用了一次性口令机制。该文分析了一种一次性口令认证方案,指出了其存在的不足;将混沌理论中混沌序列的技术应用到一次性口令当中,提出了一种新的一次性口令方案,该方案实现了双向认证,并在认证时间和存储空间上的开销得到了优化,提高了认证的强度和安全性。     

车载自组网中基于无证书的密钥隔离批量消息认证方案

针对车载自组网(VANET)中匿名认证存在的安全性问题,提出了一种高效的车载自组网的匿名认证方案。该方案将无证书密码体制和密钥隔离技术结合应用在车载自组网的环境中,通过更新协助器RSU与车辆用户OBUi的密钥,使得某时间段的临时私钥的泄漏不会影响到前向和后向的安全性,并在随机预言模型下证明了该方案的安全性。最后,性能分析结果表明,该方案不仅提高了消息签名匿名认证的效率,而且降低了整个系统运算的开销,具有较好的理论意义与实用价值。     

基于Hash函数的强口令认证方案设计与分析

分析了几种常用的一次性口令(OTP)认证方案存在的不足,提出了一种基于Hash函数的强口令认证方案.该方案能够实现用户端和服务器端双向认证,系统开销小,在认证过程中保护了用户的身份信息.并对安全性进行了分析,结果表明该方案能够防止字典攻击、重放攻击、假冒攻击和拒绝服务攻击,适用于运算能力有限的轻量级终端用户.     

基于曲线几何特征的双向身份认证系统研究

分析了"一次性口令"身份认证技术的原理和实现过程,在详细讨论三次B样条曲线基本原理的基础上,针对三次B样条曲线的几何性质特点,提出了一种将三次B样条曲线几何特征应用于双向身份认证的新的"一次性口令"认证系统方案,并给出了该方案详细的实施过程,最后对该方案进行了安全性分析,分析结果表明它是一种可行有效的身份认证方案.     

Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem

Conventional single-server authentication schemes suffer a significant shortcoming. If a remote user wishes to use numerous network services, he/she must register his/her identity and password at these servers. It is extremely tedious for users to register numerous servers. In order to resolve this problem, various multi-server authentication schemes recently have been proposed. However, these schemes are insecure against some cryptographic attacks or inefficiently designed because of high computation costs. Moreover, these schemes do not provide strong key agreement function which can provide perfect forward secrecy. Based on these motivations, this paper proposes a new efficient and secure biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem (ECC) without verification table to minimize the complexity of hash operation among all users and fit multi-server communication environments. By adopting the biometrics technique, the proposed scheme can provide more strong user authentication function. By adopting the ECC technique, the proposed scheme can provide strong key agreement function with the property of perfect forward secrecy to reduce the computation loads for smart cards. As a result, compared with related multi-serve authentication schemes, the proposed scheme has strong security and enhanced computational efficiency. Thus, the proposed scheme is extremely suitable for use in distributed multi-server network environments such as the Internet and in limited computations and communication resource environments to access remote information systems since it provides security, reliability, and efficiency.     

Practical authentication scheme for SIP

The Session Initiation Protocol (SIP) is commonly used to establish Voice over IP (VoIP) calls. However, the original authentication scheme for SIP-based service typically uses HTTP Digest authentication protocol, which is s not providing security at an acceptable level. In this paper, we propose a secure and practical password-only authenticated key agreement scheme for SIP using elliptic curve cryptography(ECC). Our scheme is remarkable efficient and quite simple to use. And yet we can provide the rigorous proof of the security for it. Therefore, the end result is more suited to be a candidate for SIP authentication scheme. In addition, we also suggest an extended scheme capable of providing anonymity, privacy, and location privacy to protect the user’s personal information and his real identity.