【作者】 杨晓燕；

【导师】 徐秋亮；

【作者基本信息】 山东大学 ， 计算机科学与技术， 2019， 博士

【摘要】 随着网络技术的发展和云计算、大数据、物联网等技术的广泛应用,社会进入了信息化时代,各种信息系统正在彻底改变着人们的工作和生活方式,给人们带来极大便利。人们越来越多地在远程服务器上(或云端)存储和利用资源,使用远程服务器(云端)提供的各种服务。为了保护用户在远程服务器上(云端)的数据安全,防止攻击者假冒合法用户,服务器需要对用户进行身份或权限认证,确保该用户具有合法的访问权限。口令具有容易记忆的特点,利用口令来验证用户的身份或权限是目前最常用的认证技术,而基于口令的认证密钥交换协议除了可以认证用户和服务器的身份,还可以使用户和服务器建立一个共享的高强度会话密钥,用来保证用户和服务器后续通信的安全,因此基于口令的密钥交换协议能使人们以容易记忆的方式使用高强度会话密钥,为安全通信提供方便、安全的方式。基于口令的认证密钥交换协议最初由Bellovin和Merrittin于1992年提出,此协议可使通信双方建立一个共享的高强度的密钥并对通信双方进行身份认证,而两个通信方只共享一个短的口令作为认证因子。口令通常较短,容易记忆,而且使用方便,既不需要部署公钥基础设施,也不需要智能卡等硬件设备存储密钥。公钥基础设施的去除意味着避免了公钥注册、管理和撤销等一系列费时费力的操作。基于口令的认证密钥交换协议一直是密码学研究领域里的一个热点问题。在网络使用过程中,越来越多的个人隐私信息在网络中传输、存储和处理,在使用各种网络服务的同时,用户自然希望能够尽量少的泄露额外隐私信息。既能充分享受服务,又能尽可能保护隐私信息,是密码学安全协议设计的重要课题之一。匿名性是实现用户个人信息保护的一种有效的手段。通过在通信过程中隐藏用户的个人身份信息,使攻击者和服务器都无法获得用户个人身份与其它信息之间的关联,可以在一定程度上保护用户的个人隐私。匿名口令认证密钥交换协议使得用户以匿名的方式与服务器建立会话密钥,同时实现服务器对用户的访问权限认证,而用户与服务器之间只共享一个低熵的口令。本文对匿名口令认证密钥交换协议、三方口令认证密钥交换协议和匿名双因子认证密钥交换协议进行研究,取得以下三个方面的研究成果:一、基于验证元的匿名口令认证密钥交换协议目前大部分的匿名口令认证密钥交换协议都是在随机谕言模型下设计和分析的,仅有少量协议是在标准模型下可证安全。随机谕言模型是一种理想模型,随机谕言函数在实际应用中只能通过具有良好密码学性质的哈希函数来替代,但是这可能会给协议带来安全隐患。此外,在大多数的基于口令的匿名认证密钥交换协议中,服务器通常存储用户的明文口令,如果服务器遭到攻击,存储在服务器上的口令和其它信息将会泄露。为了减少这一缺陷带来的损失,研究者提出了口令的非对称模型,即服务器不再存储用户的明文口令,而只存储称为验证元的口令验证信息。如果攻击者获得了验证元,则需要进行离线字典攻击才能得到正确的口令,采用加盐等策略可以很好的对口令进行防护。基于以上原理,我们提出了一个基于验证元的匿名口令认证密钥交换协议的通用框架,并给出了协议的一个实例化方案。该协议以目前最高效的单轮口令认证密钥交换协议为基础,将两方口令认证密钥交换协议与n选1茫然传输(不经意传输)相结合,实现了用户的匿名性。该协议在标准模型下是可证安全的。该协议只需要两轮交互,实现了匿名口令认证密钥交换协议的双向隐式认证的最优轮数。如果需要实现用户与服务器的双向显示认证,只需要再增加一轮交互。二、基于验证元的三方口令认证密钥交换协议在大规模的端到端应用中,如果两个通信方使用两方口令认证密钥交换协议产生会话密钥,那么每一个通信方都需要与另一方共享一个单独的口令,用户需要记忆的口令数量将与通信方的数量成线性关系。大量的口令将超出用户的记忆能力,密钥管理将变得非常困难。研究者提出了三方口令认证密钥交换协议,即两个用户分别与可信的服务器共享口令,双方在服务器的帮助下建立共同的会话密钥。现有的大多数三方口令认证密钥交换协议均基于随机谕言模型来实现,并且假设服务器拥有公钥。只有少数协议仅以口令作为认证方式,并且在标准模型下是可证明安全的。另外在大多数三方口令认证密钥交换协议中,口令以明文的形式存储在服务器上,一旦服务器信息泄露,敌手获得用户口令后伪装成合法用户与服务器通信,对用户的数据安全造成极大的危害。针对以上不足,本文利用平滑投射哈希函数构造了基于验证元的三方口令认证密钥交换协议。该协议仅以口令作为认证方式,不依赖服务器拥有公钥,并且在标准模型下是可证明安全的。三、匿名双因子认证密钥交换协议人们通常使用口令作为认证方式,但是口令通常选自一个小的集合,容易遭受字典攻击。随着口令破解硬件和算法的不断提升,敌手破解口令的能力也逐渐加强。此外,口令还可以通过社会工程,肩窥和键盘窃听等方式恢复。单因子认证不符合在某些特定应用中提供更强的安全保护的目标。研究者提出了双因子认证密钥交换协议,使用智能卡和口令是目前最常用的双因子认证方式。匿名性是一种重要的安全属性,用来保护用户的个人身份信息不被暴露。为了实现双因子认证和用户身份的匿名性,研究者提出了基于动态ID的匿名双因子认证密钥交换协议。传统的基于动态ID的匿名双因子认证密钥交换协议仅针对外部攻击者实现用户的匿名性,并且只有少数协议实现了用户身份的不可追踪性。在用户/服务器场景中,服务器可以识别用户的身份,从而跟踪用户的活动,并且分析用户的个人偏好以获得不正当的经济利益(例如,向广告商销售用户的购物行为分析数据)。本文对匿名双因子认证密钥交换协议进行了研究,提出了强匿名性的概念。强匿名性是指服务器或外部敌手都不能获得用户身份的任何信息。服务器只知道它正在与属于合法的用户群组的用户进行交互,而不知道该用户的任何身份信息。本文提出了一个具有强匿名性的匿名的双因子认证密钥交换协议,并在随机谕言模型下证明了协议的安全性。在协议的构造中,使用n选1茫然传输来保证用户的匿名性。此协议不需要时钟同步,不需要服务器存储用户的口令列表,并且实现了会话密钥的语义安全性,用户对服务器和敌手的匿名性和不可追踪性。更多还原

【Abstract】 With the development of network technology and the wide application of technologies such as cloud computing,big data,and Internet of Things,society has entered the era of informationization.Various information systems are completely changing the work and lifestyle of people,bringing great convenience to people.People are increasingly storing and utilizing resources on remote servers(or the cloud),using a variety of services provided by remote servers(the cloud).To protect the data security of the user on the remote server(the cloud)and prevent the attacker from impersonating the legitimate user,the server needs to authenticate the identity or access rights of the user.Passwords are easy to remember.Using passwords to verify user identity or permissions is currently the most commonly authentication technology.In addition to authenticating the identity of users and servers,password-based authenticated key exchange protocols can also generate a shared high-intensity session key between the user and the server.This key can be used to ensure the security of subsequent communication between the user and the server.Therefore,password-based key exchange protocol enables people to use high-intensity session keys in an easy-to-remember manner,providing convenient and secure communication for secure communication.Password-based authenticated key exchange(PAKE)protocol was firstly proposed by Bellovin and Merrittin in 1992.The protocol enables the participants to establish a shared high-intensity secret key,while the two participants only share a short password as the authentication factor.Passwords are usually short,easy to remember,and easy to use.They do not require the deployment of a public key infrastructure or hardware devices such as smart cards to store keys.The removal of the public key infrastructure means avoiding a series of time-consuming and laborious operations such as public key registration,management and revocation.Password-based authenticated key exchange protocol has always been a hot issue in the field of cryptography research.During using the network,more and more personal privacy information is transmitted,stored and processed in the network.While using various network services,users naturally hope to disclose additional private information as little as possible.It is one of the important topics in design of cryptographic security protocols that making people fully enj oy the service and protect the privacy information as much as possible.Anonymity is an effective means of protecting users’ personal information.By hiding the user’s personal identity information during the communication process,neither the attacker nor the server can obtain the association between the user’s personal identity and other information,which can protect the user’s personal privacy to a certain extent.Anonymous password-based authenticated key exchange protocol allows the user to establish a session key with the server in an anonymous manner,and at the same time enables the server authencicate the user’s access authority,while the user and the server only share a low entropy password.This paper studies anonymous PAKE protocol,three-party PAKE protocol,and anonymous two-factor authenticated key exchange protocol and have the following three aspects of research results:1.Verifer-based anonymous password authenticated key exchange protocolAt present,most of anonymous PAKE protocols are designed and analyzed in random oracle model.Only a small number of protocols are provably secure in standard model.However,the random oracle model is an ideal model.The random oracle function can only be replaced by a hash function with good cryptographic properties in practical applications,but this may bring security risks to the protocol.In addition,in most anonymous PAKE protocols,the server typically stores the user’s plaintext password,and if the server is compromised,passwords and other information stored on the server will be compromised.In order to reduce the loss caused by this defect,the researchers proposed an asymmetric model of the password,that is,the server no longer stores the user’s plaintext password,but only the password verification information called the verifier.If the attacker obtains the verifier,an offline dictionary attack is required to obtain the correct password,adopting a strategy such adding salt can better protect the password.Based on the above principles,we propose a general framework of verifier-based anonymous password authenticated key exchange protocol,and give an instantiation scheme of the protocol.Based on the most efficient PAKE protocol,the protocol combines the two-party password authenticated key exchange protocol with 1-out-of-n oblivious transfer to achieve user anonymity.This protocol is proven secure in standard model.This protocol only requires two rounds of interaction,which realizes the optimal communication efficiency of the mutual implicit authentication of anonymous PAKE protocol.If the protocol want to achieve mutual explicit authentication between the user and the server,it only need to add another round of interaction.2.Verifier-based three-party PAKE protocolIn a large-scale end-to-end application,if two participants use a two-party PAKE protocol to generate a session key,each participant needs to share a password with the other party,and the user needs to remember a lots of password.The quantity of the password the user need to remember will be linear with the number of participants.A large number of passwords will exceed the user’s memory,and key management will become very difficult.The researchers proposed three-party PAKE protocol where two users only share passwords with a trusted servers,and the two users establish a common session key with the help of the server.Most of the existing three-party PAKE protocols are designed in random oracle model and required the server have pulick key.Only a few protocols which only use passwords as the authentication method are provably secure in standard model.In addition,in most three-party PAKE protocol,the password is stored in the cleartext on the server.Once the server information is leaked,the adversary obtains the user password and then pretends to be a legitimate user to communicate with the server,which greatly harms the data security of the user and the server.Aiming at the shortcomings of existing three-party PAKE protocol,this paper constructs a verifier-based three-party PAKE protocol by using smooth projective hash function.The protocol is provably secure in standard model,and the protocol uses only password as the authentication means,and does not rely on the server to have the public key.3.Anonymous two-factor authenticated key exchange protocolPeople often use passwords as authentication methods,but passwords are usually chosen from a small collection and are vulnerable to dictionary attacks.As password cracking hardware and algorithms continue to improve,the ability of adversary to crack passwords has gradually increased.In addition,passwords can be recovered through social engineering,shoulder surfing and keyboard eavesdropping.Single-factor authentication does not meet the goal of providing greater security protection in certain applications.The researchers proposed two-factor authenticated key exchange protocol,and smart cards and passwords are currently the most commonly used two-factor authentication method.Anonymity is an important security attribute that protects a user’s personal information from being exposed.In order to realize two-factor authentication and anonymity of user identity,the researchers proposed anonymous two-factor authenticated key exchange protocol based on dynamic ID.Conventional dynamic ID-based anonymous two-factor authenticated key exchange protocol only achieves user anonymity for external attackers,and only a few protocols realize the untraceability of user identity.That is to say,the honest-but-curious server may identify the user,trace the user’s activities,and analyze the user’s individual preferences for financial benefits(e.g.selling of user shopping behavior or profile to advertisers).This paper studies the anonymous two-factor authenticated key exchange protocol and proposes the notion of strong anonymity.Strong anonymity is means any information about the identity of the user cannot be obtained by the server or external adversary.The server only knows that it is interacting with a user belonging to a legitimate user group without knowing any identity information for that user.This paper proposes an anonymous two-factor authenticated key exchange protocol and proves the security of the protocol in random oracle model.In the construction of the protocol,1-out-of-n oblivious transfer is used to ensure the anonymity of the user.This protocol does not require clock synchronization,does not require the server to store the user’s password list,and achieves the semantic security of the session key,the user’s anonymity and untraceability to the server and the adversary.更多还原