【作者】 张敏；

【导师】 张家树；

【作者基本信息】 西南交通大学 ， 计算机科学与技术， 2017， 博士

【摘要】 身份认证作为信息安全防护的第一关,起到非常重要的作用。然而传统的身份认证大多都基于口令或智能卡,而这些形式的身份认证都被验证并不安全。生物特征具有传统身份认证方式所不能比拟的优点:不容易丢失和忘记携带;不容易分享和拷贝;不容易被伪造;不容易被猜测等。虽然生物特征有这么多优点,但是生物特征资源数量有限且不可再生同时某些生物特征也涉及用户隐私,一旦丢失后果不堪设想。正是由于生物特征资源有限且涉及用户隐私,目前基于生物特征的身份认证大多仅用于单机网络环境,随着计算机网络的发展如何将生物特征扩展到远程网络环境下身份认证成为学术界研究的热点。基于生物特征的远程身份认证目前主要有两种模式:第一种是仅仅使用生物特征模式;第二种是将生物特征与口令、智能卡结合形成多因素身份认证。文章首先通过查阅文献和实验仿真证明仅仅使用生物特征在远程身份认证中的各个环节都面临各种安全威胁。在此基础上,本文在参考相关文献后指出三因素(生物特征、口令、智能卡)身份认证方案在远程身份认证领域具有较高安全性和可行性。本文对三因素身份认证进行了详细研究并将三因素身份认证方案运用到四个典型的网络环境中,通过实验和形式化证明及协议安全验证工具验证三因素身份认证方案的安全性。实验结果表明,三因素身份认证方案不单能解决目前传统身份认证面临的诸多安全问题,其在时间消耗和空间消耗相比同类方案都并无显著提高。因此基于三因素身份的远程身份认证方案应用到远程身份认证的各个领域具有一定研究价值。为了统一生物特征的模糊性和哈希函数输入稳定性,本文通过改进Fuzzy Extractors算法和Secure Sketch算法来解决这一问题;为了抵御用户注册攻击,文章创新提出基于时间戳的方式来克服身份认证中这一常见攻击。通过大量实验和安全协议形式化分析后可知三因素身份认证方案具有较高效率和安全性,是远程身份认证方案值得深入研究的方法。本文主要工作如下:(一)文章在分析总结相关文献后指出目前仅使用生物特征在远程身份认证领域存在诸多安全威胁。为了解决仅仅使用生物特征和传统远程身份认证面临的安全威胁,本文通过深入研究和论证指出三因素身份认证方案在远程身份认证中具有较高的可行性和安全性,能够满足不同环境下的远程身份认证需要。文章指出三因素身份认证方案的安全威胁、目前三因素身份认证方案普遍存在的安全问题以及设计三因素身份认证方案需要满足的必要条件;(二)本文针对单服务器具体环境,通过Fuzzy Extractors算法解决生物特征模糊性问题并将其与传统密码学相关算法设计轻量级的三因素身份认证方案。通过仿真实验对比分析可知,本文所提方案时间开销和通信开销都无显著增长,能够满足单服务器环境。通过形式化证明和Pro Verif协议安全分析工具表明,本文所提方案具有较高安全性。同时本文所提方案能够完成会话密钥协商和访问控制;(三)针对多服务器网络环境,本文首先总结出要设计多服务器远程身份认证协议需要满足的条件,并在此基础上根据Secure Sketch算法和Chebyshev Chaotic Maps算法设计出具有高健壮性的多服务器身份认证协议。针对大部分协议认证过程需要服务器参与的现状,本文提出不需要可信第三方参与的认证方案大大提高系统的健壮性。通过仿真实验和分析对比可以得知,本文所提多服务器方案具有较高健壮性和安全性,并且在时间开销和通信开销方面都无显著增长,能够满足多服务器的应用环境。同时本文所提方案能够实现会话密钥协商和用户身份匿名;(四)本文针对无线体域网环境的具体要求,本文通过Secure Sketch算法设计新的高安全的三因素身份认证协议。通过仿真实验表明,Secure Sketch算法相比Fuzzy Extractors算法时间开销更少。对比同类方案,本文所提远程医疗领域的身份认证方案具有更高的安全性,处理生物特征更合理同时时间开销和空间开销都有所降低,效率有所提高。同时,本文所提方案能够实现客户端和服务器均能发起身份认证;(五)针对无线传感器网络的具体环境,本文首先总结了无线传感器网络的安全威胁并据此提出基于Secure Sketch算法和椭圆曲线加密的三因素身份认证方案。在所设计的方案中,本文提出时间戳的方法可以在不提高时间和通信开销的前提下有效解决重复注册攻击。同时根据无线传感器网络的特殊要求,所提方案能够完全实现用户和被访问节点的双向匿名,提高身份认证的隐私保护。综上所述,本文分析了三因素身份认证方案相关理论并将其应用到具体应用领域设计出四种不同领域的身份认证协议。通过实验和安全分析和证明可以看出,三因素身份认证方案能够满足不同领域对身份认证的需求,具有较高可行性和安全性。同时,通过本文的研究可以为推动三因素身份认证方案在各个领域的全面应用奠定理论基础和积累相关技术和方法。更多还原

【Abstract】 Identity authentication schemes play an important role in information security.Traditionally,most of the identity authentication schemes are based on passwords or smart cards,but those forms of identity authentication schemes are not enough safe for passwordsare vulnerable to brute force attack and the data may be revealed if the smart card is lost.Instead,biometric have a lot of advantages over traditional authentication methods.What’s more,biometric resources are limited and non-renewable and some biological characteristics are part of individual;as a result,the biometric-based authentication schemes are mostly applied in the stand-alone network.With the development of computer network,how to extend the biometric to the network environment has become the focus of research.There are two main modes of authentication based on biometric: the first mode is to only use the biometric;the second is to combine the biometric with the password and the smart card to form the multi-factors authentication mode.From a large number of literature,we can see that there are a variety of security threats in remote identity authentication with the application of biometric alone.The results show that it is not feasible to apply biometric alone to remote identity authentication.This dissertation points out that the three-factor(biometric,password,smart card)authentication scheme offers greater security and feasibility in the field of remote identity authentication.In this dissertation,the three-factor authentication scheme is applied to each typical network environment in experiments which have verified the security of the three-factor authentication schemes along with formal proof and protocol security verification tools.The experimental results show that the three-factor authentication schemes can solve many security problems faced by traditional authentication,without more time consumption or space consumption.Therefore,the three-factor identity authentication schemes have certain research value in various fields of remote identity authentication.On the basis of literature review and in-depth study,this dissertation summarizes the conditions the three-factor authentication scheme should meet,and designs the specific identity authentication scheme for each typical network environment.For example,in order to unify the fuzziness of the biometric and the input stability of the hash function,this dissertation makes some improvement to Fuzzy Extractors algorithm and the Secure Sketch algorithm.In order to resist the user’s repeat registration attack,the author introducestime-stamp to solve the problem.A large number of experimental analysis demonstrates that the three-factor authentication schemes are more efficient and secure.The main workof this dissertation is as follows:(1)After analyzing and summarizing a large number of documents,it is pointed out that there are still many security threats in the field of remote identity authentication only based on biometric.In order to solve this problem and the security threats faced by traditional remote authentication,this dissertation points out that the three-factor authentication scheme has higher feasibility and security in remote identity authentication.After summarizing the relevant literature and in-depth study,this dissertation puts forward the security threat model of the three-factor authentication scheme and the conditions that the three-factor authentication scheme needs to meet.(2)As for the specific environment of single server and Fuzzy Extractors algorithm and traditional cryptography related algorithm to design three factors authentication scheme.Compared with the simulation results,it can be seen that there is no significant increase in the time cost and communication cost of the proposed scheme,which can meet the single server environment.Through BAN logic and ProVerif tool,the proposed schemes have higher security.At the same time,the proposed schemes can achieve the session key negotiation and access control also.(3)As for the multi-server network environment,this dissertation first summarizes the conditions that the multi-server remote authentication protocol needs to meet,and then devises the multi-server authentication protocol according to the Secure Sketch algorithm and the Chebyshev Chaotic Maps algorithm.The simulation experiments show that the multi-server scheme proposed in this dissertation has greater robustness and security,is applicable in the multi-server environment.In addition,the scheme proposed in this dissertation can achieve session secret key negotiation and user identity anonymity.(4)As for the wireless body network(WBAN)environment,the author designs a new highsecurity three-factor authentication protocol based on Secure Sketch algorithm.The simulation finds that the Secure Sketch algorithm consumes less time overhead than the Fuzzy Extractors algorithm.Compared with other identity authentication schemes in the WBAN field,the scheme proposed in this dissertation has higher security,and the biological characteristics are processed more reasonably and efficiently.(5)For the environment of wireless sensor networks,this dissertation first sums up the security threats in wireless sensor networks,and then proposes the three-factor authentication scheme based on Secure Sketch algorithm and elliptic curve encryption.In the proposed scheme,this dissertation introduces time-stamp method to resist the repeated registration attack with no more time and communication overhead.At the same time,according to the special requirements of the wireless sensor network,the proposed scheme can achieve identity anonymity between the user and the visited sensor node completely.In a nutshell,this dissertation revolves around the three-factor identity authentication program in many specific areas of application research and design four different areas of identity authentication protocol.Through the experimental and safety proof can be seen,threefactor authentication scheme can meet the needs of different areas of identity authentication in different fields.The research of this dissertation helps to lay a theoretical foundation and accumulate relevant technologies and methods to promote the comprehensive application of the three-factor authentication scheme in various fields.更多还原