使用签密的认证邮件协议

认证邮件协议,指一个发送方要将消息M与收方收到的证据进行交换的协议.在交换中最重要的一个性质就是要保证公平性.通过对原有的签密方案修改得到一种适应于认证邮件协议的新签密方案,并且在该方案的基础上设计了新的认证邮件协议,新的协议效率高且弥补了其他认证邮件协议中的缺陷.     

Novel hierarchical identity-based encryption scheme from lattice

Aiming at the high complexity in user’s private key extraction and large expansion ratio of trapdoor size in previous hierarchical identity-based encryption (HIBE) schemes,a new HIBE scheme was proposed.The implicit extension method to improve preimage sampling algorithm was used,and then combined the improved algorithm with MP12 trapdoor delegation algorithm to construct an efficient HIBE user’s private key extraction algorithm.Finally,the new extraction algorithm and the Dual-LWE algorithm was integrated to complete the scheme.Compared with the similar schemes,the efficiency of the proposed scheme was improved in system establishment and user’s private key extraction stage,the trapdoor size grows only linearly with the system hierarchical depth,and the improved preimage sample algorithm partly solves the Gaussian parameter increasing problem induced by MP12 trapdoor delegation.The security of the proposed scheme strictly reduces to the hardness of decisional learning with errors problem in the standard model.     

Two-way and anonymous heterogeneous signcryption scheme between PKI and IBC

Exiting heterogeneous signcryption schemes which were between public key infrastructure (PKI) and identity-based cryptosystem (IBC) have some limitations.A new heterogeneous signcryption scheme between PKI and IBC was proposed.In the random oracle mode,the scheme ensured confidentiality and unforgeability on the basis of the assumption of computational Diffie-Hellman problem (CDHP),q-Diffie-Hellman inversion problem (q-DHIP) and bilinear Diffie-Hellman problem (BDHP).Simultaneously,the proposed scheme guaranteed unconnectedness and anonymity of the ciphertext.Compared with other heterogeneous schemes,the scheme achieved two-way signcryption,and it generated parameters without restrict,which was suitable for actual situations.Simulation tests show that proposed scheme is feasible.     

移动漫游中强安全的两方匿名认证密钥协商方案

由于低功耗的移动设备计算和存储能力较低,设计一种高效且强安全的两方匿名漫游认证与密钥协商方案是一项挑战性的工作.现有方案不仅计算开销较高,而且不能抵抗临时秘密泄露攻击.针对这两点不足,提出一种新的两方匿名漫游认证与密钥协商方案.在新方案中,基于Schnorr签名机制,设计了一种高效的基于身份签密算法,利用签密的特性实现实体的相互认证和不可追踪;利用认证双方的公私钥直接构造了一个计算Diffie-Hellman（Computational Diffie-Hellman,CDH）问题实例,能抵抗临时秘密泄露攻击.新方案实现了可证明安全,在eCK（extended Canetti-Krawczyk）模型基础上,探讨两方漫游认证密钥协商方案安全证明过程中可能出现的情形,进行归纳和拓展,并给出新方案的安全性证明,其安全性被规约为多项式时间敌手求解椭圆曲线上的CDH问题.对比分析表明：新方案安全性更强,需要实现的算法库更少,计算和通信开销较低.新方案可应用于移动通信网络、物联网或泛在网络,为资源约束型移动终端提供漫游接入服务.     

基于格理论的装备保障信息网络快速身份认证方案

量子算法和量子计算机对装备保障信息网络的认证方案已构成严重的潜在威胁。针对当前装备保障信息网络身份认证方案无法抵抗量子计算机攻击、认证效率相对较低的问题,引入格理论的本原格抽样算法和双峰高斯抽样技术,提出了装备保障信息网络在量子环境下安全且快速的身份认证方案,给出了方案的正确性、安全性的理论证明以及方案运行效率的比较分析。结果表明,基于随机预言机证明模型,该方案在小整数解问题困难性假设下达到了适应性选择身份和选择消息攻击的存在性不可伪造性;在保证安全的前提下,新方案在私钥提取阶段和身份认证阶段的运行效率均高于已有的几个同类格基身份认证方案。这为提高我国装备保障信息网络安全认证能力提供了新的思路和方法。     

标准模型下基于身份的环签名方案

本文利用Waters提出的对偶系统加密技术,结合合数阶群上双线性运算的正交性,提出了一个基于身份的环签名方案.该方案在标准模型下是完全安全的,其安全性依赖于两个简单的静态假设.该方案借助分级身份加密（Hierarchical Identity-Based Encryption,HIBE）的思想,使得环签名满足无条件匿名性且具有较高的计算效率.     

匿名的无证书多接收者签密机制

为了满足广播通信环境下发送者的多消息发送需求,本文提出可证安全的无证书多接收者多消息签密机制,密文中不再包含接收者身份列表,实现对接收者身份等隐私信息的保护;同时发送者可在一次签密操作中完成多消息发送任务.相较与现有方案而言,除具有保密性和不可伪造性之外,本文机制具有较强的匿名性和较高的计算效率,满足广播通信环境中多消息的匿名发送需求.     

ID-Based User Authentication Scheme for Cloud Computing

In cloud computing environments, user authentication is an important security mechanism because it provides the fundamentals of authentication, authorization, and accounting (AAA). In 2009, Wang et al. proposed an identity-based (ID-based) authentication scheme to deal with the user login problem for cloud computing. However, Wang et al.’s scheme is insecure against message alteration and impersonation attacks. Besides, their scheme has large computation costs for cloud users. Therefore, we propose a novel ID-based user authentication scheme to solve the above mentioned problems. The proposed scheme provides anonymity and security for the user who accesses different cloud servers. Compared with the related schemes, the proposed scheme has less computation cost so it is very efficient for cloud computing in practice.     

机会网络中基于社会属性的按需密钥管理方案

针对机会网络的间歇性连通、快速移动、自组织管理等特征,提出了基于社会属性的按需密钥管理方案。首先利用基于身份的门限签名方案,实现了节点社会属性的自认证。随后结合机会网络的路由特性,节点之间根据社会属性匹配度有选择地颁发身份证书,并建立可度量的信任网。算法在优化证书图的同时,避免了恶意节点可能导致的无效证书链路的生成。实验仿真表明,该方案可提供较高的证书链重构成功率与节点认证可达率,并有效地降低了密钥管理所需的网络开销。     

基于身份的移动IP注册协议研究

针对移动IP注册协议中家乡和移动节点过多且复杂的计算问题,提出了一个新的基于身份的密钥分发方案,并在此基础上设计了一种高效的移动IP注册协议。该协议实现了移动IP各个节点间相互认证,其中移动节点与家乡代理之间具有双重认证的特点。双线性对和秘密随机数的选取保证了消息的安全性,消息认证码Mac和数字签名Sig保障了消息的完整性。该协议从整体上减少了计算量,降低了注册延迟率,同时也有效地保证了安全性。安全性分析表明,该方案满足移动IP的安全要求。