一套具备使用者不可追踪性的轻量化身分鉴别机制

Yeh Kuo-Hui

doi:10.1631/FITEE.1400232

Your Location：

Home >

Browse articles >

一套具备使用者不可追踪性的轻量化身分鉴别机制

计算机与自动化 | Updated：2022-06-14

- 一套具备使用者不可追踪性的轻量化身分鉴别机制
- A lightweight authentication scheme with user untraceability*
- 信息与电子工程前沿（英文） 2015年16卷第4期页码：259-271
- Affiliations：
  
  Department of Information Management, National Dong Hwa University, Taiwan 974, Hualien
- Author bio：
- Funds：
  
  *Project supported by the Taiwan Information Security Center (TWISC) and the Ministry of Science and Technology, Taiwan (Nos. MOST 103-2221-E-259-016-MY2 and MOST 103-2221-E-011-090-MY2)
- DOI：10.1631/FITEE.1400232
  中图分类号：
- 收稿：2014-07-03，
  
  修回：2015-03-04，
  
  录用：2014-11-13，
  
  纸质出版：2015-04
- Accepted：
Scan QR Code
一套具备使用者不可追踪性的轻量化身分鉴别机制[J]. 信息与电子工程前沿（英文）, 2015,16(4):259-271.

Yeh Kuo-Hui. A lightweight authentication scheme with user untraceability*[J]. Frontiers of Information Technology & Electronic Engineering, 2015, 16(4): 259-271.
一套具备使用者不可追踪性的轻量化身分鉴别机制[J]. 信息与电子工程前沿（英文）, 2015,16(4):259-271. DOI： 10.1631/FITEE.1400232.

Yeh Kuo-Hui. A lightweight authentication scheme with user untraceability*[J]. Frontiers of Information Technology & Electronic Engineering, 2015, 16(4): 259-271. DOI： 10.1631/FITEE.1400232.

摘要

目的

随着电子商务应用的蓬勃发展，如何安全且有效率地提供足够的网路资源或线上服务给远端使用者逐渐成为一门研究显学。鉴于此，本论文主要针对目前商务网路环境设计使用者身分鉴别机制。

创新点

本研究所提出的鉴别机制主要利用杂凑函数(Hash function)作为机制内的资讯保护技术，并以一套新设计的讯息传递逻辑成功完成多个体间的相互身分鉴别，如此将可同时达到计算安全与轻量化效能两大效益。

方法

藉由使用者注册(Registration)、登入与鉴别(Login and authentication)、密码变更(Password change)等三大阶段来完成并良好管理使用者身分鉴别与讯息传输安全。

结论

本论文主要针对现有网路环境下的商务架构，进行使用者身分鉴别机制设计。在协定安全度方面，根据传输逻辑分析与安全正式化分析结果，所提方法的安全可行性已被成功证实。在效能方面，本研究比近期所提出的几份相关机制(Tsai

et al

2013；Chang

et al

2014；Kumari and Khan

2014)皆更为有效率（表2、3）。

Abstract

With the rapid growth of electronic commerce and associated demands on variants of Internet based applications

application systems providing network resources and business services are in high demand around the world. To guarantee robust security and computational efficiency for service retrieval

a variety of authentication schemes have been proposed. However

most of these schemes have been found to be lacking when subject to a formal security analysis. Recently

Chang et al. (

2014

) introduced a formally provable secure authentication protocol with the property of user-untraceability. Unfortunately

based on our analysis

the proposed scheme fails to provide the property of user-untraceability as claimed

and is insecure against user impersonation attack

server counterfeit attack

and man-in-the-middle attack. In this paper

we demonstrate the details of these malicious attacks. A security enhanced authentication scheme is proposed to eliminate all identified weaknesses.

关键词

Keywords

references

M Bellare , P Rogaway . Entity authentication and key distribution . LNCS , 1994 . 773 232 - 249 . .

M Bellare , D Pointcheval , P Rogaway . Authenticated key exchange secure against dictionary attacks . 2000 . Advances in Cryptology-EUROCRYPT . 139 - 155 . .

S Blake-Wilson , D Johnson , A Menezes . Key agreement protocols and their security analysis . 1997 . 6th IMA Int. Conf. on Cryptography Coding . 30 - 45 . .

M Burrows , M Abadi , R Needham . A logic of authentication . ACM Trans Comput Syst , 1990 . 8 ( 1 ): 18 - 36 . DOI: 10.1145/77648.77649 http://doi.org/10.1145/77648.77649 .

CC Chang , CY Lee . A secure single sign-on mechanism for distributed computer networks . IEEE Trans Ind Electron , 2012 . 59 ( 1 ): 629 - 637 . DOI: 10.1109/TIE.2011.2130500 http://doi.org/10.1109/TIE.2011.2130500 .

YF Chang , WL Tai , HC Chang . Untraceable dynamic-identity-based remote user authentication scheme with verifiable password update . Int J Commun Syst , 2014 . 27 ( 11 ): 3430 - 3440 . DOI: 10.1002/dac.2552 http://doi.org/10.1002/dac.2552 .

D He , S Wu . Security flaws in a smart card based authentication scheme for multi-server environment . Wirel Pers Commun , 2012 . 70 ( 1 ): 323 - 329 . DOI: 10.1007/s11277-012-0696-1 http://doi.org/10.1007/s11277-012-0696-1 .

C Hsiang , WK Shih . Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment . Comput Stand Interf , 2009 . 31 ( 6 ): 1118 - 1123 . DOI: 10.1016/j.csi.2008.11.002 http://doi.org/10.1016/j.csi.2008.11.002 .

W Hsieh , J Leu . Exploiting hash functions to intensify the remote user authentication scheme . Comput Secur , 2012 . 31 ( 6 ): 791 - 798 . DOI: 10.1016/j.cose.2012.06.001 http://doi.org/10.1016/j.cose.2012.06.001 .

X Huang , X Chen , J Li , 等 . Further observations on smart-card-based password-authenticated key agreement in distributed systems . IEEE Trans Parall Distr Syst , 2013 . 25 ( 7 ): 1767 - 1775 . DOI: 10.1109/TPDS.2013.230 http://doi.org/10.1109/TPDS.2013.230 .

WS Juang , ST Chen , HT Liaw . Robust and efficient password-authenticated key agreement using smart cards . IEEE Trans Ind Electron , 2008 . 55 ( 6 ): 2551 - 2556 . DOI: 10.1109/TIE.2008.921677 http://doi.org/10.1109/TIE.2008.921677 .

S Kumari , MK Khan . Cryptanalysis and improvement of a robust smart-card-based remote user password authentication scheme . Int J Commun Syst , 2014 . 27 ( 12 ): 3939 - 3955 . DOI: 10.1002/dac.2590 http://doi.org/10.1002/dac.2590 .

L Lamport . Password authentication with insecure communication . Commun ACM , 1981 . 24 ( 11 ): 770 - 772 . DOI: 10.1145/358790.358797 http://doi.org/10.1145/358790.358797 .

CT Li , CC Lee , CJ Liu , 等 . A robust remote user authentication scheme against smart card security breach . 2011 . 25th Annual IFIP WG 11.3 Conf . 231 - 238 . .

X Li , W Qiu , D Zheng , 等 . Anonymity enhancement on robust and efficient password-authenticated key agreement using smart cards . IEEE Trans Ind Electron , 2010 . 57 ( 2 ): 793 - 800 . DOI: 10.1109/TIE.2009.2028351 http://doi.org/10.1109/TIE.2009.2028351 .

X Li , Y Xiong , J Ma , 等 . An efficient and security dynamic identity based authentication protocol for multi-server architecture using smart cards . J Network Comput Appl , 2012 . 35 ( 2 ): 763 - 769 . DOI: 10.1016/j.jnca.2011.11.009 http://doi.org/10.1016/j.jnca.2011.11.009 .

YP Liao , SS Wang . A secure dynamic ID based remote user authentication scheme for multi-server environment . Comput Stand Interf , 2009 . 31 ( 1 ): 24 - 29 . DOI: 10.1016/j.csi.2007.10.007 http://doi.org/10.1016/j.csi.2007.10.007 .

SK Sood , AK Sarje , K Singh . A secure dynamic identity based authentication protocol for multi-server architecture . J Network Comput Appl , 2011 . 34 ( 2 ): 609 - 618 . DOI: 10.1016/j.jnca.2010.11.011 http://doi.org/10.1016/j.jnca.2010.11.011 .

DZ Sun , JP Huai , JZ Sun , 等 . Improvements of Juang et al.’s password-authenticated key agreement scheme using smart cards . IEEE Trans Ind Electron , 2009 . 56 ( 6 ): 2284 - 2291 . DOI: 10.1109/TIE.2009.2016508 http://doi.org/10.1109/TIE.2009.2016508 .

JL Tsai , NW Lo , TC Wu . Novel anonymous authentication scheme using smart cards . IEEE Trans Ind Inform , 2013 . 9 ( 4 ): 2004 - 2013 . DOI: 10.1109/TII.2012.2230639 http://doi.org/10.1109/TII.2012.2230639 .

D Wang , CG Ma . Cryptanalysis and security enhancement of a remote user authentication scheme using smart cards . J China Univ Posts Telecommun , 2012 . 19 ( 5 ): 104 - 114 . DOI: 10.1016/S1005-8885(11)60307-5 http://doi.org/10.1016/S1005-8885(11)60307-5 .

D Wang , P Wang . Offline dictionary attack on password authentication schemes using smart cards . 2013 . 16th Information Security Conf . 1 - 16 . .

D Wang , P Wang . On the anonymity of two-factor authentication schemes for wireless sensor networks: attacks, principle and solutions . Comput Networks , 2014 . 73 41 - 57 . DOI: 10.1016/j.comnet.2014.07.010 http://doi.org/10.1016/j.comnet.2014.07.010 .

D Wang , C Ma , P Wang , 等 . iPass: privacy preserving two-factor authentication scheme against smart card loss problem . 2012 . Cryptology ePrint Archive . 1 - 35 . .

D Wang , C Ma , P Wang . Secure password-based remote user authentication scheme with non-tamper resistant smart cards . 2012 . 26th Annual IFIP Conf. on Data and Applications Security and Privacy . 114 - 121 . .

D Wang , D He , P Wang , 等 . Anonymous two-factor authentication in distributed systems: certain goals are beyond attainment . IEEE Trans Depend Secure Comput, in press , 2014 . DOI: 10.1109/TDSC.2014.2355850 http://doi.org/10.1109/TDSC.2014.2355850 .

G Wang , J Yu , Q Xie . Security analysis of a single sign-on mechanism for distributed computer networks . IEEE Trans Ind Inform , 2013 . 9 ( 1 ): 294 - 302 . DOI: 10.1109/TII.2012.2215877 http://doi.org/10.1109/TII.2012.2215877 .

Y Wang . Password protected smart card and memory stick authentication against off-line dictionary attacks . 2012 . 27th IFIP TC 11 Information Security and Privacy Conf . 489 - 500 . .

KH Yeh , NW Lo , Y Li . Cryptanalysis of Hsiang-Shih’s authentication scheme for multi-server architecture . Int J Commun Syst , 2011 . 24 ( 7 ): 829 - 836 . DOI: 10.1002/dac.1184 http://doi.org/10.1002/dac.1184 .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Convergence of blockchain and Internet of Things: integration, security, and use cases

Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey

Stochastic stability analysis of networked control systems with random cryptographic protection under random zero-measurement attacks

A secure and high-performance multi-controller architecture for software-defined networking