改进的基于口令的群密钥协商协议

群密钥协商协议是保证后续群组安全通信的重要手段之一。为此,研究Byun和Lee提出的基于口令的群密钥协商协议,指出该协议不能抵抗不可检测的在线字典攻击。基于这个发现,对该方案进行改进,提出一种新的群密钥协商协议。安全性分析表明,该协议可以抵抗基于口令的群密钥协商协议的常见攻击。     

辫群上密钥协商协议的改进与安全性分析

对辫群上密钥协商协议进行安全性分析,指出该协议无法抵抗中间人攻击,在密钥协商协议基础上,提出一种改进的密钥协商协议。该协议在密钥协商的过程中,采用辫群上的数字签名进行认证,有效防止中间人攻击和重放反射攻击。分析结果验证了该协议的安 全性。     

可信计算环境下基于TPM的认证密钥协商协议

基于身份的认证密钥协商协议存在密钥托管、ID管理、ID唯一性和私钥的安全分发等问题,目前的可信计算技术为此提供了很好的解决方案。利用TPM平台中EK和tpmproof唯一性的特点,结合McCullagh-Barreto认证密钥协商协议思想,提出了一个在可信计算环境下基于TPM的认证密钥协商协议,该协议较好地解决了上述基于身份的密钥协商协议所存在的问题。用CK模型对所提协议进行了安全性分析,结果表明该协议具备已知密钥安全性,完善前向保密性及密钥泄露安全性等CK安全模型下相应的安全属性。     

一种基于身份的密钥协商协议安全分析与改进

认证密钥协商是保证参与者后续通信安全的一种重要机制。2007年,J.Oh等人提出了一种新的利用椭圆曲线密码体制的基于身份的认证密钥协商协议,该协议最大的特点是可以通过一次会话密钥协商过程生成两个会话密钥。但研究发现,该协议不能抵抗基本的冒充攻击和密钥泄露冒充攻击,详细地描述了这两个安全弱点后提出了一种新的改进方法,并分析了新协议的安全性。     

基于椭圆曲线的跨域端到端口令认证密钥协商协议

跨域端到端口令认证密钥协商协议(C2C-PAKA)的主要目的是使分布在不同域中持有不同口令的两个客户端可以在各自服务器的协助下实现相互认证并协商出共同的会话密钥。本文中,我们基于椭圆曲线上的离散对数问题,在直接通信架构下给出一个跨域的口令认证的密钥协商协议。该协议中,诚实的服务器是不能获取任何关于会话密钥的值。各参与方之间能够实现相互认证。与同类协议比较,该协议具有较小的通信负担和计算负担,更易于实现。此外,协议还能够抵抗字典攻击、口令泄露模仿攻击和未知会话密钥共享攻击等通用攻击类型,同时能够实现前向安全、无密钥控制和已知会话密钥安全等安全属性。     

一种改进的三方认证密钥协商协议

针对三方认证密钥协商协议容易遭受假冒攻击和中间人攻击的缺点,提出一种基于身份的三方认证密钥协商改进协议.该协议综合运用基于身份的密码学、椭圆曲线密码学和哈希函数技术建立用户之间的认证关系,以抵抗假冒攻击和重放攻击.分析结果表明,该协议基于CDH假设是可证安全的,与Tan改进协议相比,效率较高.     

基于身份的认证密钥协商协议密码分析

认证密钥协商协议是一种重要的密码学原语。该文分析一种基于身份的认证密钥协商协议,并在Bellare-Rogaway-93模型下进行安全证明。在允许攻击者进行Reveal询问时,指出该协议的不安全性。研究结果发现,该协议不能抵抗密钥泄露伪装攻击。     

对一种无线Web服务密钥协商协议的改进

极大的商务应用潜力对无线网络中Web服务的安全与效率提出了更高的要求,其中之一就是密钥协商问题。研究者从不同角度提出基于口令的密钥协商改进方案。近期,张学英与杨晋吉提出的一种无线环境下的Web服务身份认证密钥协商协议(Z-Y协议)经证明存在严重的安全缺陷。改进方案不仅继承原协议较高的效率和基本安全属性,而且能够有效地抵抗中间人攻击和重放攻击,弥补了原协议安全性能的不足。     

改进的基于身份认证密钥协商协议*

对标准模型下可证安全的基于身份认证密钥协商协议进行安全分析,指出由于传送消息存在冗余,协议不能抵御伪装攻击。为解决上述安全漏洞,提出一个改进的基于身份认证密钥协商协议,并在标准模型下分析其安全性。结果表明,新协议满足基于身份认证密钥协商协议的所有安全要求。     

一种抗阻断攻击的认证组密钥协商协议

一个非认证的组密钥协商协议不能对通信参与者和消息进行认证,它必须依赖认证的网络信道或其它的认证方法.分析了Burmester等人在认证广播信道下提出的著名组密钥协商协议,指出它不能抵抗内部恶意节点发起的密钥协商阻断攻击,该攻击导致组内其它诚实节点不能正确计算出一致的组密钥.提出了一种改进的认证的组密钥协商协议,在原协议中加入了消息正确性的认证方法,能够对组内恶意节点进行检测,并在随机预言模型下证明了改进的协议能够抵抗密钥协商阻断攻击.     

智能卡和口令结合的动态认证方案

远程认证协议能有效的保证远程用户和服务器在公共网络上的通信安全。提出一种匿名的安全身份认证方案,通过登录 的动态变化,提供用户登录的匿名性,通过用户和服务器相互验证建立共享的会话密钥,抵抗重放攻击和中间人攻击,实现用户安全和隐私,通过BAN逻辑分析证明改进方案的有效性,通过安全性证明和性能分析说明了新协议比同类型的方案具有更高的安全性、高效性。     

Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment

Recently, Liao and Wang proposed a secure dynamic ID based remote user authentication scheme for multi-server environment, and claimed that their scheme was intended to provide mutual authentication, two-factor security, replay attack, server spoofing attack, insider and stolen verifier attack, forward secrecy and user anonymity. In this paper, we show that Liao and Wang's scheme is still vulnerable to insider's attack, masquerade attack, server spoofing attack, registration center spoofing attack and is not reparable. Furthermore, it fails to provide mutual authentication. To remedy these flaws, this paper proposes an efficient improvement over Liao–Wang's scheme with more security. The computation cost, security, and efficiency of the improved scheme are well suited to the practical applications environment.     

动态ID多因素远程用户身份认证方案的改进

基于动态身份信息ID的远程用户身份认证方案,在保证远程用户身份匿名性及不可追踪性的前提下,可实现远程用户与服务器端的双向身份认证。对Yang提出的基于动态ID的远程用户身份认证方案进行了安全分析,指出Yang方案无法抵御重放攻击、服务器伪装攻击、用户伪装攻击,且不能提供双向认证。针对这些缺陷,提出了一种多因素远程用户身份认证方案的改进,并进行了安全性和效率分析,分析结果表明,改进的方案弥补了Yang方案的不足,且具有较高的安全性能。     

A secure dynamic ID based remote user authentication scheme for multi-server environment using smart cards

Recently, Hsiang et al. pointed out that Liao-Wang’s dynamic ID based remote user authentication scheme for multi-server environment is vulnerable to insider attack, masquerade attack, server spoofing attack, registration center attack and is not easily reparable. Besides, Liao-Wang’s scheme cannot achieve mutual authentication. For this, Hsiang et al. proposed an improved scheme to overcome these weaknesses and claimed that their scheme is efficient, secure, and suitable for the practical application environment. However, we observe that Hsiang et al.’s scheme is still vulnerable to a masquerade attack, server spoofing attack, and is not easily reparable. Furthermore, it cannot provide mutual authentication. Therefore, in this paper we propose an improved scheme to solve these weaknesses.     

Two robust remote user authentication protocols using smart cards

With the rapid growth of electronic commerce and enormous demand from variants of Internet based applications, strong privacy protection and robust system security have become essential requirements for an authentication scheme or universal access control mechanism. In order to reduce implementation complexity and achieve computation efficiency, design issues for efficient and secure password based remote user authentication scheme have been extensively investigated by research community in these two decades. Recently, two well-designed password based authentication schemes using smart cards are introduced by Hsiang and Shih (2009) and Wang et al. (2009), respectively. Hsiang et al. proposed a static ID based authentication protocol and Wang et al. presented a dynamic ID based authentication scheme. The authors of both schemes claimed that their protocol delivers important security features and system functionalities, such as mutual authentication, data security, no verification table implementation, freedom on password selection, resistance against ID-theft attack, replay attack and insider attack, as well as computation efficiency. However, these two schemes still have much space for security enhancement. In this paper, we first demonstrate a series of vulnerabilities on these two schemes. Then, two enhanced protocols with corresponding remedies are proposed to eliminate all identified security flaws in both schemes.     

增强型相互认证密钥协商方案

传统用于保护用户密钥隐私的相互认证方案不能有效抵抗重放攻击与DOS攻击。为此,将安全单向哈希函数和椭圆曲线上的离散对数难问题相结合,提出一种基于智能卡的相互认证方案。该方案通过引入时间戳及时延限制,能有效抵抗重放攻击,并减轻DOS攻击。相比于其他同类方案,该方案的移动用户端减少2次点的加法运算,提高用户端的计算效率。分析结果表明,该方案是安全有效的。     

一种防边权和语义攻击的位置隐私保护方法

边权攻击和位置语义攻击根据移动用户活动的周边环境推断用户的位置,泄露用户的位置隐私。针对该问题,提出一种防边权攻击的位置语义安全隐私保护方法。该方法将道路的敏感度和关联度结合,构建道路隐私度,描述道路在语义位置的敏感性,及道路与匿名集中其他道路上用户数量分布的均衡性;基于中心服务器结构,根据用户的位置隐私要求,采用宽度优先搜索方式,筛选道路隐私度最小的道路加入匿名集,以生成具备语义安全和防边权推断攻击的匿名集。仿真测试结果表明,该方法筛选的匿名集的匿名成功率达到87%,抗边权攻击和语义攻击的能力要高于对比算法。     

对三个多服务器环境下匿名认证协议的分析

设计安全高效的多服务器环境下匿名身份认证协议是当前安全协议领域的研究热点。基于广泛接受的攻击者模型,对多服务器环境下的三个代表性匿名认证协议进行了安全性分析.指出Wan等协议无法实现所声称的离线口令猜测攻击,且未实现用户匿名性和前向安全性;指出Amin等协议同样不能抵抗离线口令猜测攻击,且不能提供匿名性,对两种破坏前向安全性的攻击是脆弱的;指出Reedy等协议不能抵抗所声称的用户仿冒攻击和离线口令猜测攻击,且无法实现用户不可追踪性.突出强调这些协议失败的根本原因在于,违反协议设计的三个基本原则：公钥原则、用户匿名性原则和前向安全性原则.明确协议的具体失误之处,并提出相应修正方法.     

A secure dynamic ID based remote user authentication scheme for multi-server environment

Since the number of server providing the facilities for the user is usually more than one, the authentication protocols for multi-server environment are required for practical applications. Most of password authentication schemes for multi-server environment are based on static ID, so the adversary can use this information to trace and identify the user's requests. It is unfavorable to be applied to special applications, such as e-commerce. In this paper, we develop a secure dynamic ID based remote user authentication scheme to achieve user's anonymity. The proposed scheme only uses hashing functions to implement a robust authentication scheme for the multi-server environment. It provides a secure method to update password without the help of third trusted party. The proposed scheme does not only satisfy all requirements for multi-server environment but also achieve efficient computation. Besides, our scheme provides complete functionality to suit with the real applications.     

Practical authentication scheme for SIP

The Session Initiation Protocol (SIP) is commonly used to establish Voice over IP (VoIP) calls. However, the original authentication scheme for SIP-based service typically uses HTTP Digest authentication protocol, which is s not providing security at an acceptable level. In this paper, we propose a secure and practical password-only authenticated key agreement scheme for SIP using elliptic curve cryptography(ECC). Our scheme is remarkable efficient and quite simple to use. And yet we can provide the rigorous proof of the security for it. Therefore, the end result is more suited to be a candidate for SIP authentication scheme. In addition, we also suggest an extended scheme capable of providing anonymity, privacy, and location privacy to protect the user’s personal information and his real identity.