Efficient Certificateless Authenticated Key Agreement Protocol from Pairings

0 IntroductionKey agreement protocol is vital to Web security,whichallows two communication parties (i .e.the Web cli-ent and Web server) to establish a secret session key overan open network. The session key,generated with contri-butions fromall the communicating parties ,is usually sub-sequently be used to achieve some cryptographic goal be-tweenthe Web clients and servers ,such as confidentialityor dataintegrity. The first two-party key agreement proto-col was first proposed by Diffie and…     

Self-Organized Public-Key Management for Mobile Ad Hoc Networks Based on a Bidirectional Trust Model

In traditional networks , the authentication is performed by certificate authoritys（CA）,which can＇t be built in distributed mobile Ad Hoc Networks however. In this pa per, we propose a fully self-organized public key management based on bidirectional trust model without any centralized authority that allows users to generate their public-private key pairs, to issue certificates, and the trust relation spreads rationally according to the truly human relations. In contrast with the traditional self-organized public-key management, the average certificates paths get more short, the authentication passing rate gets more high and the most important is that the bidirectional trust based model satisfys the trust re quirement of hosts better.     

基于SSL证书认证中间件的安全性分析

安全套接字层SSL证书认证具有信任链验证、主机验证、证书撤销及证书扩展机制。定义了抽象化SSL协议栈内部SSL库的使用,扩展了用于连接的缺省值设置方法,阐述了信任链验证的OpenSSL应用程序接口具有不同有效主机名组成限制及证书列表匹配要求。在分析OpenSSL内部数据结构及数据运输层建立HTTPS连接机制的基础之上,揭示了JSSE不执行自身主机验证建立SSL连接的缺陷,并提出通过形式验证技术和编程来实现自动检查应用程序是否正确使用SSL库的关键选项与参数的解决策略。     

一种基于超立方体的跨域认证协议

提出了一种基于超立方体的跨域认证协议模型.该模型利用超立方体的结构特征,支持不同信任域间的实体双向认证.相对于传统跨域认证模型,减少了认证服务器间注册的工作量,简化了认证服务器间共享密钥的分配和管理工作.该模型还能够避免由单一权威机构认证所带来的网络瓶颈和单点崩溃等问题.分析表明,该协议模型具有较高的安全性和可靠性,从而使应用服务器能够有效地进行访问控制,保障网络安全.     

企业应用系统整合中的CAS单点登录技术

针对企业应用系统单点登录的需要,提出一种基于中央认证服务器(CAS)的单点登录技术方案.系统中,认证管理器通过责任链模式管理认证执行者,客户端浏览器与认证服务器之间采用HTTPS协议,认证服务器与平台应用服务器之间采用HTTP协议.在访问业务系统时,相关信息的传递均结合时间戳、关键信息加密签名和SSL加密通道技术.在自动认证完成后,业务系统可根据需要设定是否继续走安全套接层协议(SSL)加密通道,既保证单点登录过程中信息传递的保密性和真实性.又兼顾业务系统访问的安全与效率.     

Two-Party Authenticated Key Agreement in Certificateless Public Key Cryptography

0 Introduction To simplify the management of certificates of tradi- tional PKI, Shamir[1] proposed the identity-based public key cryptography (ID-PKC) in which the public key of each party is derived directly from certain aspects of its identity, for exam…     

Web服务统一身份认证协议

为实现基于Web服务的多应用系统的用户身份安全认证,采用统一身份认证方案,结合已有的Web服务安全规范,提出了一个多应用环境下的基于Web服务的统一身份认证协议Web Services Single Sign-on(WSSS),并详细描述了WSSS的模型、消息定义及流程,采用形式化方法对协议进行了表示和分析,同时对协议进行了安全性分析．WSSS所定义的统一身份认证服务可用于为网络中各种基于Web服务的应用提供Web服务的安全身份认证。     

基于PGP信任模型的Web服务统一身份认证研究

针对Web Service应用中身份管理上存在的安全问题,设计了一个Web Services统一身份认证方案,描绘了认证体系架构,阐述了认证原理,分析了其关键技术.该方案以PGP信任模型为基础,结合现代对称密码和非对称密码认证技术,为各WebServices提供了强身份认证,能简易地实现单点登录,并应用于实践.     

基于SRP-6协议的认证与密钥交换方案

针对Web服务中身份认证的问题,分析了SRP-6(Secure Remote Password-6)协议的密钥交换机制,提出了一种基于简单对象访问协议(SOAP)和SRP-6协议的认证与密钥交换方案(SRP-over-SOAP).该方案将SOAP消息进行扩展,通过在SOAP头中加入标记,实现了SOAP消息对SRP认证信息的传递.文中还将该方案用于Web服务,实现了服务器和客户机间的双向身份认证.     

EC密钥协商与分布式认证协议集成

分析了开放网络环境的认证,指出了综合利用多种密码技术设计认证系统以满足日益复杂认证需求的必要性。通过研究认证与密钥交换机制,分析现有协议特性,权衡认证系统安全性、效率及需求等因素,提出了一种认证与密钥交换协议。协议进行分布式认证,综合利用EC密钥协商和对称密钥传输进行密钥交换,可实现双向身份认证和显式密钥认证。该方案可使认证系统性能提高,需求降低。     

Scheme on Cross-Domain Identity Authentication Based on Group Signature for Cloud Computing

In the cloud computing, different cloud service providers are often in different trust domains. As the traditional identity authentication mode cannot be applied to the cloud computing, the cross-domain identity authentication mechanism is needed to solve the identity authentication problem in the cloud computing. In view of the security problems in cloud computing, a cross-domain identity authentication scheme based on group signature is proposed. This scheme introduces a group of cloud service providers and users who are located in different trust domains. Any member of the group can generate the signature on behalf of the whole group, making the user access the cloud service provider in the case of privacy security. At the same time, with traceability it can track illegal operation of illegal users. In addition, the scheme uses the Chinese Remainder Theorem to integrate the message, and it can control the length of the data in the calculation process, simplifying the calculation process. It also realizes the join and revocation of group members without changing the key of other legitimate group members, and the maintenance cost of authentication schemes is low. The results show that the scheme has the advantages of anonymity, anti-counterfeit, traceability, anti-joint attack and so on. It can not only realize tracking function under the condition of guaranteeing user's privacy, but can also simplify the authentication calculation process to improve the efficiency of the cross domain identity authentication, and its performance is more suitable for large-scale cloud computing environment.     

OvBNN authentication based on cooperative signature for wireless sensor networks

The universality of the application of wireless sensor networks( WSN) makes more attention be paid on the security problem. Node authentication is not only the basis of network security,but also the premise of key management and secure routing protocol. Although the signature mechanism based on symmetric encryption is high in energy efficiency,it is vulnerable to be attacked and there is a time delay during authentication. Traditional public key encryption mechanism with improvement in security brings in complex algorithm and costs much time,which is not suitable for WSN. In this paper,a signature authentication mechanism,an optimized variant Bellare Namprempre Neven( OvBNN) is presented to quickly complete the authentication by mutual cooperation between nodes so as to make the nodes use the intermediate calculation results of their neighbor nodes directly.Simulation results show that the proposed mechanism is superior to traditional authentication mechanisms both in energy consumption and authentication time.     

基于Ad hoc中密钥管理方案

研究密钥管理方案,提出了一种基于Adhoc中密钥管理方案．该方案采用基于口令认证方法,在Adhoc中建立节点之间的信任关系,实现了节点之间的密钥认证和信息加密,同时减轻了节点的计算量和存储负担．     

基于可信第三方的快速域间垂直切换认证协议

针对异构无线网络中的域间垂直切换,提出一种基于可信第三方的切换认证和密钥协商协议,协议分别考虑了向上切换和向下切换两种切换场景.文中还改进了一种三方密钥分配协议,用于实现域间垂直切换认证过程中的临时密钥分配.分析比较表明,该方案在安全和性能上具有较好的折中性.     

一种基于层次型证书的移动IPv6绑定更新协议

针对移动IPv6路由最优化引入的安全威胁和传统保护机制缺乏认证的特点,基于IPv6的地址格式,提出了一种层次型的证书机制,解决了实体之间身份认证问题,并在此基础上提出了一种绑定更新协议。该协议通过把移动节点的开销交给家乡代理来处理,并运用一次绑定多个转交地址注册等机制降低了开销。与传统协议相比较,该协议的安全性和效率都有很大提高。     

移动计算网络中代理主机的认证协议

首先讨论认证协议所要满足的安全要求和技术要求，并在此基础上设计一种移动计算网络中代理主机的认证协议。该协议基于公钥体制实现双向认证，安全性好且运行效率高。     

改进的UMTS的认证机制的研究

详细分析了UMTS认证和密钥分配协议的过程以及协议的安全性,找出协议中存在的弱点和可能的攻击,提出了公钥加密协议的改进方法。经过分析,这一改进协议不但能满足第三代移动通信的安全需求,而且改善了UMTS在认证过程中在安全上的不足。     

改进的UMTS的认证机制的研究

详细分析了UMTS认证和密钥分配协议的过程以及协议的安全性，找出协议中存在的弱点和可能的攻击，提出了公钥加密协议的改进方法。经过分析，这一改进协议不但能满足第三代移动通信的安全需求，而且改善了UMTS在认证过程中在安全上的不足。     

基于802.1x的校园网身份认证系统的设计与实施

校园网应用越来越多,对网络安全性、计费以及实名制的需求也日益突出,而传统认证方式在校园网中存在不可弥补的缺陷.因此,通过对IEEE的基于802.1x协议认证方式的分析以及和其他传统认证方式进行比较和实际调研,最后采用基于802.1x的解决方案实施校园网身份认证系统.     

利用P2P技术实现移动终端在WLAN内的漫游认证

针对IEEE 802.11i协议中身份认证和主密钥协商造成认证时延过大的问题,提出了一种利用P2P Chord技术管理无线局域网(WLAN)内认证信息的认证优化机制.站点在首次接入WLAN时将协商生成的认证信息发布至P2P Chord环中.当站点在接入点(AP)间发生切换时,可从P2P Chord环中查找出相应的认证信息以完成后续的协议交互,无需通过认证服务器重新认证,从而显著降低复杂认证引起的时延.理论推导及实验结果表明:该认证信息管理方案能够降低站点在AP间的切换时延,满足实时应用通信质量的需求;同时还可以减轻认证服务器的负担,在一定程度上防止单一故障点的存在.