安全增强的智能电网轻量级匿名认证方案

现有的智能电网身份认证方案大多存在计算成本高和认证流程复杂的问题,不适用于智能电网中资源受限的智能设备。而一些轻量级的方案却存在各种安全漏洞,这些方案都无法在效率和安全性之间实现所需的权衡。针对上述问题,基于椭圆曲线加密算法设计了一个增强的可证明安全的智能电网轻量级匿名认证方案。引入辅助验证器,摆脱在认证阶段对于电力供应商的依赖,在保护智能电表真实身份的条件下实现网关和智能电表之间的相互认证。同时,可以通过伪身份对恶意智能电表进行身份的溯源和撤销。通过在随机预言模型下的安全性分析和仿真工具ProVerif证明了方案具备较高的安全属性。性能分析表明,所提方案能够满足智能电网环境下对于安全性和高效性的要求。     

An efficient anonymous authentication mechanism for delay tolerant networks

Security and privacy are crucial to the wide deployments of delay tolerant networks. Without security and privacy guarantees, people are reluctant to accept such a new network paradigm. To address the security and privacy issues in delay tolerant networks, in this paper, based on ID-based ring signatures and Merkle hash tree techniques, we present a new efficient anonymous authentication mechanism. The newly proposed mechanism not only achieves good security properties, including authentication, anonymity and confidentiality, but also has strong robustness and high efficiency.     

一种具有公平匿名性的k次认证机制*

基于Teranisi提出的k次认证机制（k-TAA）,利用Brands提出的表示问题不可解的猜想,构造了一个具有公平的匿名性的k次认证机制k-TFAA。该机制除了拥有k-TAA机制的所有特性外,还增加了一个可信方,该可信方可以有效追踪非法使用服务的用户的身份,保证了整个机制的完备性和安全性。最后,本文对该机制的各个特性作了讨论。     

A novel user-participating authentication scheme

When utilizing services over public networks, a remote user authentication mechanism forms a first line of defense by rejecting illegal logins from unauthorized users. On-line applications over the Internet such as E-learning, on-line games, etc. are ever more common; remote user participation via networks plays a vital role in security and should be guaranteed. Without this countermeasure, malicious users are likely to enable agents to communicate with remote on-line systems. While existing remote user authentication schemes rarely address this issue, this paper highlights the problem of guaranteeing remote user participation. This proposed user authentication scheme benefits from combining CAPTCHA techniques and visual secret sharing to ensure deliberate human interaction. This scheme provides mutual authentication and is secure against certain known attacks, as well as low in computation cost.     

A lightweight anonymous authentication scheme for secure cloud computing services

The Journal of Supercomputing - Cloud computing represents the latest technology that has revolutionized the world of business. It is a promising solution giving companies the possibility of...     

A new method for using hash functions to solve remote user authentication

Recently, Peyravian and Zunic proposed the remote password authentication schemes only based on the collision-resistant hash function. The schemes are, therefore, easy to implement and simple to use. The attractive properties cause a series of discussion. Several security flaws are found and remedied. Unfortunately, most of the remedies either are insecure or violate the original advantages because of involving public-key cryptosystems or modular exponential operations. Hence, it is still a challenge to design a secure scheme abiding by the beneficial assumption of the Peyravian-Zunic schemes. The proposed scheme not only keeps the original advantages (user friendness and computational cheapness) but also highlights certain of valuable features, such as (1) mutual authentication (higher security level), (2) server’s ignorance of users’ passwords (further security guaranee to users, specially for financial services), (3) immunity from maintaining security-sensitive table (maintaining burden reduction to servers), and so forth.     

SA3: Self-adaptive anonymous authentication for dynamic authentication policies

Authentication is a procedure by which a client convinces the service provider about a claimed property under a given authentication policy. Anonymous authentication has an added property: protect the real identity of the client. In this paper, we study the situations with dynamic authentication policies, commonly seen in large scale systems such as cloud computing. While this is not a significant issue for classic authentication where client anonymity is not a concern, it will introduce an array of difficulties to anonymous authentication which have not been formally investigated. To address this issue, we propose the notion of SA³: Self-Adaptive Anonymous Authentication. The related models are presented together with a generic design from attribute-based signatures.     

基于区块链技术的车联网高效匿名认证方案

针对车联网（IOV）中心化认证效率低和隐私保护差的问题，提出一种基于区块链技术的高效匿名认证方案。该方案基于IOV开放、自组织、快速移动的特点，利用区块链技术防篡改和分布式的特性来完成车辆临时身份的生成和区块链存储。车辆相互通信时，通过触发智能合约实现高效匿名的双向身份认证。实验结果表明，在认证效率上，与传统公钥基础设施（PKI）认证、假名授权身份认证相比，随着验证量的增加，所提方案的匿名身份认证的时延增长较慢，效率较高；在安全性能上，所提方案中存入区块链的临时身份具有不可篡改、不可否认、可追溯等特点。所提方案中，恶意车辆身份可回溯并进行权限控制，并且，公钥密码体制和数字签名技术保证了通信数据的保密性和完整性。     

基于区块链技术的车联网高效匿名认证方案

针对车联网（IOV）中心化认证效率低和隐私保护差的问题,提出一种基于区块链技术的高效匿名认证方案。该方案基于IOV开放、自组织、快速移动的特点,利用区块链技术防篡改和分布式的特性来完成车辆临时身份的生成和区块链存储。车辆相互通信时,通过触发智能合约实现高效匿名的双向身份认证。实验结果表明,在认证效率上,与传统公钥基础设施（PKI）认证、假名授权身份认证相比,随着验证量的增加,所提方案的匿名身份认证的时延增长较慢,效率较高;在安全性能上,所提方案中存入区块链的临时身份具有不可篡改、不可否认、可追溯等特点。所提方案中,恶意车辆身份可回溯并进行权限控制,并且,公钥密码体制和数字签名技术保证了通信数据的保密性和完整性。     

A secure user anonymity-preserving biometric-based multi-server authenticated key agreement scheme using smart cards

Advancement in communication technology provides a scalable platform for various services, where a remote user can access the server from anywhere without moving from its place. It provides a unique opportunity for online services such that a user does not need to be physically present at the service center. These services adopt authentication and key agreement protocols in order to ensure authorized and secure access to the resources. Most of the authentication schemes proposed in the literature support a single-server environment, where the user has to register with each server. If a user wishes to access multiple application servers, he/she requires to register with each server. The multi-server authentication introduces a scalable platform such that a user can interact with any server using single registration. Recently, Chuang and Chen proposed an efficient multi-server authenticated key agreement scheme based on a user’s password and biometrics (Chuang and Chen, 2014). Their scheme is a lightweight, which requires the computation of only hash functions. In this paper, we first analyze Chuang and Chen’s scheme and then identify that their scheme does not resist stolen smart card attack which causes the user’s impersonation attack and server spoofing attack. We also show that their scheme fails to protect denial-of-service attack. We aim to propose an efficient improvement on Chuang and Chen’s scheme to overcome the weaknesses of their scheme, while also retaining the original merits of their scheme. Through the rigorous informal and formal security analysis, we show that our scheme is secure against various known attacks including the attacks found in Chuang and Chen’s scheme. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool and show that our scheme is secure against the replay and man-in-the-middle attacks. In addition, our scheme is comparable in terms of the communication and computational overheads with Chuang and Chen’s scheme and other related existing schemes.     

An anonymous authentication and secure data transmission scheme for the Internet of Things based on blockchain

With the widespread use of network infrastructures such as 5G and low-power wide-area networks, a large number of the Internet of Things (IoT) device nodes are connected to the network, generating massive amounts of data. Therefore, it is a great challenge to achieve anonymous authentication of IoT nodes and secure data transmission. At present, blockchain technology is widely used in authentication and s data storage due to its decentralization and immutability. Recently, Fan et al. proposed a secure and efficient blockchain-based IoT authentication and data sharing scheme. We studied it as one of the state-of-the-art protocols and found that this scheme does not consider the resistance to ephemeral secret compromise attacks and the anonymity of IoT nodes. To overcome these security flaws, this paper proposes an enhanced authentication and data transmission scheme, which is verified by formal security proofs and informal security analysis. Furthermore, Scyther is applied to prove the security of the proposed scheme. Moreover, it is demonstrated that the proposed scheme achieves better performance in terms of communication and computational cost compared to other related schemes.     

A tamper-proof and lightweight authentication scheme

We present a tamper-proof and lightweight challenge-response authentication scheme, based on 2-level noisy Physically Unclonable Functions (PUF). We present a security reduction, which shows the scheme to be secure against passive attacks, provided that it is hard to learn a threshold of halfspaces under the uniform distribution. Furthermore, we provide an extensive analysis of PUFs. In particular, we thoroughly derive a linear model for delay based PUFs, and finally we explore extensions of PUFs to produce efficient and tamper-resilient n-to-n mappings.     

基于线性方程组的门限匿名认证方案

现有的很多匿名认证方案中,匿名认证过程较为复杂,匿名的可控性比较随意,针对这两个问题,在求解离散对数困难性的基础上,提出了一个新的门限匿名认证方案。借助线性方程组的求解理论,获得成员的秘密份额和公钥身份等信息;基于门限共享的思想,实现示证者身份的匿名认证和匿名追踪。该方案中认证者的匿名性、门限可追踪性以及身份的不可冒充性满足了匿名认证的安全需求,在电子商务、移动通信等众多领域将具有广阔的应用前景。     

Evaluation of user authentication methods in the gadget-free world

In an ideal gadget-free environment the user is interacting with the environment and the services through only “natural” means. This imposes restrictions on many aspects of the interaction. One key element in this is user authentication, because it assures the environment and related services of the legitimacy of user’s actions and empowers the user to carry out his tasks. We present five high-level categories of features of user authentication in the gadget-free world including security, privacy and usability aspects. These are adapted and extended from earlier research on web authentication methods. We survey existing authentication methods together with some emerging technologies and evaluate these according to the features in our categories. Our results show, that no single authentication method can realise all these requirements for authentication. In conclusion, we give future research directions and open problems that stem from our observations. Especially, finding combinations of authentication factors and methods that achieve all requirements is an interesting problem in the gadget-free scenario.     

适合物联网环境的混合双向匿名认证协议

为了物联网环境下数据传输和信息的安全,在对现有经典的物联网认证协议进行分析研究的基础上,提出了一种新的混合双向匿名认证协议。新协议是利用可信计算技术,采用基于双线性对的一次性公钥和散列函数相结合的方法。通过对安全性和效率的分析,新协议能够很好地满足物联网环境对存储和运算开销的要求,有效地保证终端与服务器端通信的隐私和数据安全,实现了双向认证和匿名认证。     

Provably secure authenticated key agreement scheme for distributed mobile cloud computing services

With the rapid development of mobile cloud computing, the security becomes a crucial part of communication systems in a distributed mobile cloud computing environment. Recently, in 2015, Tsai and Lo proposed a privacy-aware authentication scheme for distributed mobile cloud computing services. In this paper, we first analyze the Tsai–Lo’s scheme and show that their scheme is vulnerable to server impersonation attack, and thus, their scheme fails to achieve the secure mutual authentication. In addition, we also show that Tsai–Lo’s scheme does not provide the session-key security (SK-security) and strong user credentials’ privacy when ephemeral secret is unexpectedly revealed to the adversary. In order to withstand these security pitfalls found in Tsai–Lo’s scheme, we propose a provably secure authentication scheme for distributed mobile cloud computing services. Through the rigorous security analysis, we show that our scheme achieves SK-security and strong credentials’ privacy and prevents all well-known attacks including the impersonation attack and ephemeral secrets leakage attack. Furthermore, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool, and show that our scheme is secure against passive and active attacks including the replay and man-in-the-middle attacks. More security functionalities along with reduced computational costs for the mobile users make our scheme more appropriate for the practical applications as compared to Tsai–Lo’s scheme and other related schemes. Finally, to demonstrate the practicality of the scheme, we evaluate the proposed scheme using the broadly-accepted NS-2 network simulator.     

一种基于区块链的IoV隐私保护认证方案设计

传统车联网（Internet of Vehicles,IoV）身份认证系统普遍具有中心不可信的安全风险,而智联车又存在许多亟待解决的隐私安全问题。因此,借助区块链分布式、可溯源、不可窜改等特点,提出云链结合的可信分散式系统架构,基于该架构同时结合无证书的密码机制以及密钥隔离技术设计分布式身份认证协议。通过安全性分析表明,该方案安全性高、能满足车联网匿名身份认证的要求。同时与现有方案进行仿真对比表明,本方案具有更低的计算开销和通信成本,适用于实际的认证时延低和隐私保护的车联网环境中。     

一种基于ECC的SIP认证方案的提出与实现

随着会话发起协议（SIP）应用领域的不断扩大,SIP实体间通讯的安全问题成为了亟待解决的热点问题。对SIP的安全方案进行了讨论,分析了进行安全认证的方法,在此基础之上提出了一种新的基于椭圆曲线密码学（ECC）的认证方案,保证了SIP消息传输过程中完整性、机密性和不可抵赖性。     

Enhancing wireless video streaming using lightweight approximate authentication

In this paper, we propose a novel lightweight approximate authentication algorithm that provides efficient protection for wireless video streaming where attacks on the stream are possible, but classical integrity protection algorithms are impractical because bit errors occur naturally. The benefits of the proposed algorithm over other algorithms are fast execution and small message authentication code size. Moreover, the approximate authentication supports error resilient video decoding by dropping seriously damaged packets, thus improving the perceived quality of the video stream. The performance of the algorithm is demonstrated via numerical analysis, simulations and measurements over modeled and real wireless channels.