路径洗牌算法：安全组播中一种高效的组密钥更新算法

安全组播通信使用组内所有成员共享的组密钥来加密通信内容.为了保障安全,密钥服务器需要在组成员关系改变时进行组密钥更新(rekey).由于组内成员关系的动态性和加解密操作的高代价,组密钥更新性能成为衡量组密钥管理性能的主要指标.基于密钥树(key tree)的组密钥更新方法已经被广泛地使用,并达到了对数级的组密钥更新代价.密钥树的结构需要保证平衡,否则最坏情况下组密钥更新的通信代价会达到O(n).该文提出了一种新的基于密钥树的路径洗牌算法PSA(Path Shuffling Algorithm),该算法能够将密钥树的平衡操作分散到一般的更新密钥操作中,减少了结构调整代价,从而提高了算法的性能.理论分析给出了该算法更新组密钥的平均通信代价,模拟实验也验证了这种算法更新组密钥的平均性能要优于其它同类算法.     

基于用户概率分组模型的密钥分发方法研究

条件接收系统是付费电视系统的重要组成部分,而其中密钥分发的效率和安全性又是影响条件接收系统性能的关键因素.本文基于用户概率模型提出了用户霍夫曼树分组模型及相应密钥分发方法,该方法具有最优的分发效率.     

付费电视系统的密钥管理

采用业务分组的方法降低业务密钥量；在密钥层次管理基础上，提出了密钥霍夫曼分层方法，利用该方法可以获得最优的层次密钥管理性能，并推导得出了层次密钥管理的密钥存储量和分发效率的理论极限；最后说明结合业务分组和密钥Huffman分层将得到高性能的密钥管理系统。     

一种无状态的传感器网络密钥预分配方案

 在无线传感器网络中,节点被敌方捕获以后将泄露节点内存储的群组密钥等秘密信息,所以需要建立一种安全高效的群组密钥管理系统来及时对被捕获节点进行撤销,以保证无线传感器网络中群组通信的安全.提出一种基于逻辑密钥树结构的密钥预分配方案,群组控制者和密钥服务器(GCKS)为逻辑密钥树中每一逻辑节点分配一个密钥集,每一sensor节点对应一个叶节点,以及一条从该叶节点到根节点的路径,GCKS将该路径上所有节点的密钥植入sensor节点.节点撤销时,GCKS将逻辑密钥树分成互不相连的子树,利用子树中sensor节点的共享密钥进行群组密钥的更新.分析表明本方案满足无状态性,以及正确性、群组密钥保密性、前向保密性和后向保密性等安全性质,具有较低的存储、通信和计算开销,适用于无线传感器网络环境.     

基于LKH的组播密钥分发改进方案

文章在分析LKH算法的基础上,结合在小规模组播时PE算法性能较好的优势,设计了一种改进的组播密钥管理方案PE-RLKH方案,并给出相应的更新算法。通过对本方案和LKE方案的通信开销、密钥存储开销和计算开销的比较表明,该方案具有计算开销小,在保持一定的通信开销下能降低组密钥存储开销,具有较好的通信效率,可适用于较大规模的组播。     

数字电视条件接收系统密钥分配策略研究

数字电视条件接收系统中的密钥分配与管理方案直接影响系统的安全性和性能，在研究简单的三级密钥分配方案和固定分组的四级密钥分配方案的基础上，提出一种新的动态分组的四级密钥分配方案，并对基于该分配方案的ECM、EMM信息的授权寻址结构进行了设计。该密钥分配方案不仅降低了密钥更新和处理的数量，获得了较高的效率和安全性，而且能够动态地处理用户的加入与离开。这对于运营商动态管理收视用户有着重要的价值。     

适用于传感器网络的分级群组密钥管理

 由于无线传感器网络中经常出现节点加入或离开网络的情况,所以需要建立一种安全高效的群组密钥管理系统来保证无线传感器网络中群组通信的安全性.提出了一种基于密钥树和中国剩余定理的分级群组密钥管理方案.有sensor节点加入,先向新成员发送二级群组密钥,可参与一些不太敏感的数据的传送;待新成员获得GCKS的信任之后,则向其发送群组密钥,从而可参与有关机密信息的会话.节点离开时,通过利用完全子集方法将剩余成员进行分割,提出的方案可以利用中国剩余定理对群组密钥进行安全的更新.证明方案满足正确性、群组密钥保密性、前向保密性和后向保密性等安全性质.性能分析表明,此方案适合应用于无线传感器网络环境.     

低轨卫星网络中基于轨道分簇的密钥更新算法

该文提出一种基于轨道分簇的低轨(LEO)卫星网络密钥更新算法,即RAOC算法。该算法根据运行轨道特性对LEO卫星网络进行分簇,通过动态产生密钥更新发起节点和簇首节点完成LEO卫星网络的密钥更新。RAOC算法提出一种基于密钥更新锁的密钥更新状态描述方法,以确保密钥更新的一致性。仿真结果表明,与目前LEO卫星网络基于地基测控网和天基测控网的密钥更新算法相比,RAOC算法能自主完成LEO卫星网络的密钥更新,并能提高LEO卫星网络密钥更新的效率。     

主密钥在组播密钥管理中的应用

本文在改进的RSA体制基础上给出主密钥的生成算法,并在主密钥的基础上提出了主密钥管理方案,该方案将参与组播的成员分成若干子组,每个子组的密钥生成、分发和更新由一个主密钥控制器完成。当成员变化时,设计的密钥更新策略同时满足前向安全和后向安全,这就解决了组通信中的密钥管理问题,实现了安全的组播。同时该方案使得每个用户只需存储和管理一个密钥,就能与组内或组外的用户进行安全通信,降低了用户的负载。因此主密钥管理方案能适用于大规模的、在网络中广泛分布的和动态的组。     

基于LKH的组播密钥分发改进方案R-LKH

随着Internet的发展，组播技术得到了广泛的应用，其中组密钥管理是组播安全的核心问题。分析了已有密钥管理方案的优缺点，特别是被广泛关注的LKH方案，提出了一个基于LKH的密钥管理新方案R—LKH．并给出相应的更新算法。通过对本方案和其他方案的通信开销、密钥存储开销和计算开销的分析表明．该方案可有效降低密钥开销，且具有可行的通信效率，适用于大型的动态群组。     

Batch Private Keys Generation for RSA in Security Communication Systems

RSA public key cryptosystem is extensively used in information security systems.However, key generation for RSA cryptosystem requires multiplicative inversion over finite field, which has higher computational complexity, compared with either multiplication in common sense or modular multiplication over fnite field. In order to improve the performance of key generation, we propose a batch private keys generation method in this paper. The method derives efficiency from cutting down multiplicative inversions over finite field. Theoretical analysis shows that the speed of batch private keys generation for s users is faster than that of s times solo private key generation. It is suitable for applications in those systems with large amount of users.     

基于离散对数问题的两层分散式组密钥管理方案

该文基于多个解密密钥映射到同一加密密钥的公钥加密算法提出一个组密钥更新协议,结合LKH算法为特定源多播模型设计一个两层分散式组密钥管理方案。证明它具有后向保密性、高概率的前向保密性和抗串谋性。通过上层私钥的长寿性和密钥转换的方法来缓解子组管理者的性能瓶颈及共享组密钥方法中普遍存在的1影响n问题。分析表明,采用混合密码体制的新方案在一定程度上兼备了两类不同组密钥管理方法的优势。     

A multicast key management scheme based on characteristic values of members

A new collusion attack on Pour-like schemes is proposed in this paper. Then, we present a collusion-free centralized multicast key management scheme based on characteristic values of members. The re-keying method that other group members calculate new keys when a member is joining or leaving is also designed. It achieves forward secrecy and backward secrecy. Compared with typical existing centralized schemes, the storage of Group Key Controller (GKC) in our scheme halves the storage overhead of others, and communication overhead of GKC is 2 in case of joining re-keying. Especially, the leaving re-keying overhead is log₂ n, and the overall performance is excellent.     

基于W态的网络中任意两个用户间量子密钥分配方案

针对实现网络中任意两个用户间密钥分配的问题,该文将W态变换为系数全部相同的对称形式,提出一种利用W态实现网络量子密钥分配的方案,即可信赖中心(CA)与网络中要求通信的任意两个用户分别拥有W态的3个粒子,CA对手中的粒子进行测量并公开测量结果,两个用户按照CA的不同测量结果采取相应的措施以生成密钥。继而,分别对存在窃听者(Eve)的情况以及CA不可信的情况进行安全性分析。结果表明,该方案能够有效抵御攻击,且可以实现平均消耗3个W态得到两比特密钥的理论效率。     

一种改进DUKPT密钥管理系统的单片机设计

密钥管理在加密系统中具有核心地位。为了保证安全性,提高密钥管理效率,提出了一种改进的DUKPT算法,并在51单片机平台上实现了改进DUKPT密钥管理系统的设计,使密钥管理性能得到较大提升。改进算法具有完全可扩展性,在相同存储消耗和相同最大运行次数情况下,可用派生密钥数量是原DUKPT的42.3倍;同样派生百万密钥,改进的DUKPT存储空间减小19.05%,运行次数减少20%。经验证,系统在安全性和密钥管理效率上取得满意效果。     

Novel chaotic block encryption scheme for WSN based on dynamic sub key

In view of high efficiency and security requirements in WSN encryption algorithm,a lightweight chaotic block encryption algorithm was designed and a novel scheme of dynamic sub keys extension was proposed.To greatly reduce the computing burden of WSN nodes,this scheme made full use of WSN cloud servers monitoring platform,which was powerful in data computing and processing,and transfered the sub keys synchronization task from nodes to cloud servers.Experimental results and performance analysis show that the scheme has good characteristics of diffusion,confusion and statistical balance,strong key security and high algorithm efficiency.It has a good application prospect in the field of WSN communication encryption.     

High-performance and high-concurrency encryption scheme for Hadoop platform

To address the problem that as preventing data leakage on Hadoop platform,the existing encryption schemes suffer from several problems (e.g.,single encryption algorithm,complicated key management,low encryption performance) and they cannot protect data stored in Hadoop effectively,a high-performance encryption and key management scheme for Hadoop was proposed.Firstly,a three-level key management system was extended with the domestic commercial cipher algorithm.Then,a new data structure for encryption zone key to reduce time consumption was designed.Finally,the computing process of data stream in parallel was scheduled.The experimental results show that compared with the existing Hadoop schemes,the proposed scheme can improve the efficiency of key management,and can speed up file encryption.     

A Flexible Privacy-Enhanced Location-Based Services System Framework and Practice

Location based services(LBS) are becoming increasingly important to the success and attractiveness of next generation wireless systems. However, a natural tension arises between the need for user privacy and the flexible use of location information. In this paper we present a framework to support privacy enhanced location based services. We classify the services according to several basic criteria and we propose a hierarchical key distribution method to support these services. The key idea behind the system is to hierarchically encrypt location information under different keys, and distribute the appropriate keys only to group members with the necessary permission. Four methods are proposed to deliver hierarchical location information while maintaining privacy. We propose a key tree rebalancing algorithm to maintain the re-keying performance of the group key management. Furthermore, we present a practical LBS system implementation. Hierarchical location information coding offers flexible location information access which enables a rich set of location based services. Our load tests show such a system is highly practical with good efficiency and scalability.