一种基于ECC的RFID认证协议

文章通过对物联网所存在安全问题的研究,结合椭圆曲线密码体制的高安全性和零知识证明的零知识性等优点,设计了一种在物联网环境下控制系统中针对终端设备和后台数据库间的身份认证协议。该协议利用椭圆曲线密码体制又引入了零知识证明的思想,是一种基于椭圆曲线的零知识证明的身份认证协议,并且在认证的过程当中与哈希函数相结合,来有效地保护认证时双方交互的证据信息。协议可以有效地完成对物联网环境下控制系统中终端设备和后台数据库间的双向身份认证。     

基于FIDO协议的指纹认证方案研究

首先简单介绍了FIDO协议,然后提出了基于FIDO协议和移动终端可信执行环境(TEE)的指纹认证方案总体框架和业务流程,并设计了指纹认证安全性提升方案,最后指出了指纹认证应用和推广还需要移动终端增加指纹识别能力并开放TEE能力。     

带身份认证的BB84协议

利用量子特性实现量子保密通信是目前量子信息学界和密码学界关注的热点问题之一.提出带身份认证的BB84协议,在密钥产生和分配过程中,通信双方利用初始密钥进行身份认证,既能提高效率,又增强了系统的安全性.     

一种基于混沌的量子身份认证

提出了一种新的基于混沌的量子身份认证方案,该方案将混沌系统对初值条件和参数的极度敏感性及混沌序列的良好伪随机性与量子密码的绝对安全性结合在一起,能够有效地抵抗多次身份认证中由于有限精度导致的混沌特性退化而造成对混沌系统初值和参数的攻击。在方案的实现过程中,利用量子隐形传态原理,解决了多次身份认证中出现的混沌迭代异步问题,实现了每一次身份认证中双方的同步,从而实现了“一次一密”的量子身份认证。整个身份认证过程实现简单,具有动态性和可证明的安全性。     

一种基于ECC的高效双向身份认证

椭圆曲线密码体制和零知识证明在密码学里面得到了广泛的研究和应用.文章提出了一种基于椭圆曲线密码体制的零知识证明的双向身份认证方案,该方案用椭圆曲线密码体制代替传统的公钥密码体制,并将椭圆曲线的算法加入到了零知识证明的思想里面,使得认证的安全性和准确度有了很大的提高.     

基于量子特性的身份认证

利用量子特性实现量子保密通信是目前量子信息学界和密码学界关注的热点问题之一,文章根据利用量子特性提出了一个量子身份认证方案,实现了通信中通信双方的身份认证.该方案实施申采用了动态工作方式,易于实现,具有可证明安全性.     

一种基于指纹加密的网络身份认证方案

分析与比较了现有的身份认证技术,将指纹识别、数据加密和安全协议等技术紧密结合,指出用指纹加密作为网络身份认证技术是可行的,可靠的。提出了一种基于指纹加密的网络身份认证方案,介绍了方案原理,体系结构和认证协议,很好地解决了计算机网络系统中的身份认证问题。     

基于身份的认证密钥协商协议

密钥协商协议应该在满足安全性的条件下,使实现协议所需的计算开销尽可能小。文中提出了一个基于身份的认证密钥协商协议BAKAP(ID-Based Authenticated Key Agreement Protocol)。该协议提供了已知密钥安全性、完善前向保密性、密钥泄露安全性、未知密钥共享安全性和密钥控制安全性。在该协议中,参与者只需执行两次椭圆曲线点乘法和一次双线性运算。该协议与已有协议相比,计算代价小。     

一种基于智能卡的双向身份认证方案

计算机网络的普及使更多的资源和应用可以利用网络远程获得,所以身份认证问题成为网络安全研究中的重要课题。当前主要的身份认证方法有以下几种：基于口令的身份认证;基于生物特征的身份认证;基于智能卡的身份认证以及几种方式的混合认证。结合密码学和智能卡技术的身份认证方案也被多次提出,许多专家和学者还提出了多种改进的方案。但是,这些方案均会出现一些不可避免的漏洞。针对多种方案的漏洞,该文提出了一种在智能卡中引入公钥密码算法的认证方案,并对其安全性进行了分析,该方案的安全性和优越性也在文中得到体现。     

一种改进的双线性对的双向基于身份的认证密钥协商协议

使用对的双向认证密钥协商协议已经在密码领域得到了广泛的关注,过去提出的一些这种类型的协议大多数是有缺陷的,这导致了协议被攻击或者无法保证其安全性。在本文中,我们利用一种签名方案的变体,提出了一种有效的、使用线性对的且基于身份的认证密钥协商协议,并证明了其安全性。此外,和现有的一些协议相比,我们所给出的协议更安全有效。     

Weakness of remote authentication scheme of Chen et al.

The extensive application of mobile commerce has led researchers to design more secure protocols for mobile devices during the recent years. In 2011, Chen et al. proposed a three‐factor mobile device‐based remote authentication scheme, which tackled the security risk imposed by the loss of both password and mobile device. Scheme of Chen et al., however, is still vulnerable to the privileged insider attack, the replay attack, the impersonation attack, and the denial of service attack. It is not feasible for real‐life implementation. Copyright © 2013 John Wiley & Sons, Ltd.     

A secure and efficient remote patient‐monitoring authentication protocol for cloud‐IoT

The ongoing Cloud‐IoT (Internet of Things)–based technological advancements have revolutionized the ways in which remote patients could be monitored and provided with health care facilities. The real‐time monitoring of patient's health leads to dispensing the right medical treatment at the right time. The health professionals need to access patients' sensitive data for such monitoring, and if treated with negligence, it could also be used for malevolent objectives by the adversary. Hence, the Cloud‐IoT–based technology gains could only be conferred to the patients and health professionals, if the latter authenticate one another properly. Many authentication protocols are proposed for remote patient health care monitoring, but with limitations. Lately, Sharma and Kalra (DOI: 10.1007/s40998‐018‐0146‐5) present a remote patient‐monitoring authentication scheme based on body sensors. However, we discover that the scheme still bears many drawbacks including stolen smart card attack, session key compromise, and user impersonation attacks. In view of those limitations, we have designed an efficient authentication protocol for remote patient health monitoring that counters all the above‐mentioned drawbacks. Moreover, we prove the security features of our protocol using BAN logic‐based formal security analysis and validate the results in ProVerif automated security tool.     

An efficient two‐party authentication key exchange protocol for mobile environment

The primary goal of this research is to ensure secure communications by client‐server architectures in mobile environment. Although various two‐party authentication key exchange protocols are proposed and claimed to be resistant to a variety of attacks, studies have shown that various loopholes exist in these protocols. What's more, many two‐party authentication key exchange protocols use timestamp to prevent the replay attack and transmit the user's identity in plaintext form. Obviously, these methods will lead to the clock synchronization problem and user's anonymity problem. Fortunately, the three‐way challenged‐response handshake technique and masking user's original identity with a secret hash value used in our study address these problems well. Of course, the proposed protocol based on elliptic curve cryptography supports flawless mutual authentication of participants, agreement of session key, impersonation attack resistance, replay attack resistance, and prefect forward secrecy, as well. The analyses in the aspects of efficiency and security show that the proposed protocol is a better choice for mobile users.     

量子消息认证协议

研究了在量子信道上实现经典消息和量子消息认证的方法。给出了一个基于量子单向函数的非交互式经典消息认证加密协议。证明了给出的协议既是一个安全的加密方案,也是一个安全的认证方案。利用该认证加密协议作为子协议,构造了一个量子消息认证方案,并证明了其安全性。与BARNUM等给出的认证方案相比,该方案缩减了通信双方共享密钥的数量。     

Openstack authentication protocol based on digital certificate

As the industry standard for open source cloud platforms,openstack uses the single-factor authentication method based on username and password that provides by keystone components to identity authentication mechanism,while it is not suitable for application scenarios with high security level requirements.A digital certificate-based identity authentication protocol which had cloud user identification protocol and authentication protocol was designed to meet the requirements.With expending the keystone component to achieve a digital certificate-based identity authentication system,a combination of authentication server,UKey technology,encryption technology and well-established key management and so on was used.According to the research,the system can effectively resist multiple cyber-attacks and improve the security of cloud users when they log in to the cloud platform.     

ID-based authentication scheme combined with identity-based encryption with fingerprint hashing

Current identity-based （ID） cryptosystem lacks the mechanisms of two-party authentication and user＇s private key distribution. Some ID-based signcryption schemes and ID-based authenticated key agreement protocols have been presented, but they cannot solve the problem completely. A novel ID-based authentication scheme based on ID-based encrypfion （IBE） and fingerprint hashing method is proposed to solve the difficulties in the IBE scheme, which includes message receiver authenticating the sender, the trusted authority （TA） authenticating the users and transmitting the private key to them. Furthermore, the scheme extends the application of fingerprint authentication from terminal to network and protects against fingerprint data fabrication. The fingerprint authentication method consists of two factors. This method combines a token key, for example, the USB key, with the user＇s fingerprint hash by mixing a pseudo-random number with the fingerprint feature. The security and experimental efficiency meet the requirements of practical applications.     

椭圆曲线加密结合cookie信息的物联网终端安全认证协议

针对物联网(IoT)中终端设备接入网络服务器的安全性问题,提出了一种基于椭圆曲线加密(ECC)和cookie信息的物联网终端安全认证协议.协议首先将用户身份信息、服务器私钥、随机数和cookie有效期信息组成一个cookie文件,然后利用椭圆曲线加密体制对其进行加密,并将之存储在智能终端.在认证阶段,通过比对由cookie信息计算的安全参数来实现相互身份认证.性能分析表明,该协议在具有较低计算和通信成本的同时,能够有效抵抗多种攻击,提供了较高的安全性,非常适合应用于物联网中资源有限的终端设备.     

轻型的RFID安全认证协议LAP

RFID标签存在着处理能力弱、存储空间小和电源供给有限等局限性,传统的公钥算法或散列函数等复杂运算不能满足实际应用的需求。针对现有轻量级RFID认证协议的不足,设计了基于广义逆矩阵的RFID安全认证协议LAP。该协议采用了硬件复杂度较低的CRC校验及计算量较小的矩阵运算。通过安全隐私和性能分析,LAP协议适用于低成本、存储与计算受限的RFID标签。     

基于LDAP协议与Kerberos认证机制的统一认证

为开发一个企业级的用户身份认证体系,依据目录服务理论,将LDAP协议和Kerberos认证技术相结合,应用于身份认证服务器的结构设计,进行用户统一身份认证和授权,并进一步分析了系统的安全性。