【作者】 落红卫；

【导师】 徐国爱；

【作者基本信息】 北京邮电大学 ， 信息安全， 2021， 博士

【摘要】 随着移动互联网的快速发展,以及与云计算、物联网等新兴技术的深度融合,移动互联网已经渗透到工作和生活的各个方面。身份认证作为网络与信息安全的基石,已经成为移动互联网业务应用安全的第一道防线,不同的业务应用对其提出了差异化需求。支持多类别、多级别的身份认证,以满足不同类型、不同规模的移动互联网业务应用的差异化身份认证需求成为了移动互联网身份认证的重要发展方向。本文以建立面向移动互联网的多级可信身份认证技术方案为目标,对移动互联网身份认证关键技术进行了深入研究:首先,针对应用场景多样化和安全需求差异化,提出了一种具备智能风控的多因子身份认证技术;其次,针对最前沿的基于深度学习的说话人验证系统,提出了利用对抗性实例进行安全性检测方法;最后,针对典型的移动互联网应用场景,分别设计了一种基于椭圆曲线密码的三因子身份认证协议和一种基于硬件令牌的物联网身份认证模型。本文的主要贡献如下:(1)提出了一种具备智能风控的多因子身份认证技术,用于满足大规模多级可信身份认证需求。首先提出了一种具备智能风控的多因子身份认证技术架构,并针对大规模身份认证场景提出了轻量级身份认证服务接入方案;然后针对多因子联合身份认证进行设计,以保证身份认证安全的情况下尽可能降低对用户的打扰;随后提出基于深度学习的身份认证风险控制;最后给出了具备智能风控的多因子身份认证技术的具体应用案例。(2)提出了一种针对基于深度学习的说话人验证系统的安全性检测方法。首先,介绍了基于深度学习的说话人验证系统实现原理,随后相应地设计了一个新的损失函数来部署一个对抗性实例生成器,并生成具有轻微扰动的对抗性实例,然后利用这些对抗性实例来欺骗说话人验证系统以达到安全性检测的目的,最后通过具体测试实验获取我们设计系统的安全性检测性能指标。(3)设计了一种基于椭圆曲线密码的三因子身份认证协议。首先分析了高敏感应用场景身份认证面临的安全威胁并提出了相应的身份认证需求。然后以Mo等人的方案为例,指出其协议遭受窃取验证表攻击、拒绝服务攻击、离线猜测攻击和临时秘密值泄露攻击,随后提出了一种基于椭圆曲线加密并具备离线认证中心的三因子身份认证方案。该方案继承了现有方案的优点,并可以应用于包括用户设备、云服务器和注册中心的移动互联网身份认证系统。通过安全性分析表明,所设计的方案可以抵抗已知攻击,并具备用户友好性。通过性能分析比较表明,我们所提出的方案具有更小的计算和通信开销,并提供更多的安全属性。(4)设计了一种基于硬件令牌的物联网身份认证模型。首先分析了物联网面临的安全威胁并提出了相应的身份认证需求,继而提出了一种基于网关的双因子身份认证(Gateway-based2nd Factor,G2F)方案。该方案基于FIDO的通用第二因子协议(Universal 2nd Factor,U2F),将FIDOU2F协议中防篡改的硬件令牌,与以网关为中心的物联网架构相结合。该硬件令牌可以与网关节点和移动互联网应用服务器同时进行交互,实现了物联网身份认证的高安全性和高效率,并降低了对服务提供商的依赖性,同时保护物联网设备免受恶意攻击。之后,我们将G2F原型应用在商业化的阿里云上并进行了实际测试评估,安全和性能的测评结果表明:G2F实现了基于硬件令牌的轻量快速物联网身份认证,并能抵御已知针对物联网设备管理身份认证的安全攻击。更多还原

【Abstract】 With the rapid development of mobile Internet and the deep integration of emerging technologies such as cloud computing and internet of things(IoT),mobile Internet has penetrated into all fields of our daily lives.Different mobile Internet services have put forward strict requirements for identity authentication due to their role as the first security defense line of mobile Internet services.It has become the important direction of identity authentication to support multiple types and levels of mobile Internet services,in order to meet the differential requirements of different types and scales of mobile Internet services.This paper makes an in-depth study on the key technologies of identity authentication in mobile Internet,in order to establish a multi-level authentication scheme for typical mobile Internet services.Firstly,we propose a multi-factor authentication technology with intelligent risk management,in order to satisfy the diversification of application scenarios and the differentiation of security requirements.Secondly,we propose a security testing scheme using adversarial examples for the cutting-edge speaker verification system based on deep learning.Finally,aiming at different mobile Internet service scenarios,we propose an Elliptic Curve Cryptography(ECC)-based three-factor authentication protocal and a hardware token-based IoT authentication model respectively.The main contributions of our paper are summarized as follows:(1)We propose a multi-factor authentication technology with intelligent risk management,which can be used to meet the different authentication requirements for different mobile Internet services and large-scale concurrent authentication.Specifically,we first introduce the technical architecture of multi-factor authentication with intelligent risk management,and propose a high-performance lightweight access service for the large-scale identity authentication.Then,we study the strength of joint multi-factor authentication,in order to decrease the disturbance to users under the condition of ensuring the security of authentication.Furthermore,we research the Deep Neural Network(DNN)-based risk management.Finally,we introduce the application case of the multi-factor authentication technology with intelligent risk management.(2)We propose a security testing scheme for the speaker verification system based on deep learning.Firstly,we introduce the implementation principle of speaker verification system based on deep learning.Then,we design a new loss function to deploy an adversarial instance generator and generate adversarial instances with slight disturbance.Furthermore,we use these adversarial examples to spoof the speaker verification system.Finally,we carry out an experiment to achieve the performance of the security testing scheme.(3)We design a three factor authentication protocol based on Elliptic Curve Cryptography(ECC).Firstly,we analyze the security threats to the high sensitive application scenarios,e.g.mobile government,and propose the relevant security requirements.Then taking Mo et al’s scheme as an example,we point out that this scheme is suffering the attacks including stealing verifier attack,denial of service,off-line guessing and temporary information of known specific session.Furthermore,we propose our provably secure ECC-based three-factor authentication scheme.The scheme inherits the advantages of the existing schemes and is applied to the authentication system including user equipment,cloud server and registration center.Security analysis shows that our scheme can resist known attacks and provide user friendliness.Performance analysis and comparison show that our scheme consumes less computation and communication overhead,and provides more security attributes.(4)We design a hardware token-based IoT authentication model.Firstly,we analyze the security threats and security requirements of the IoT authentication model.Then,we propose a Gateway-based Second Factor(G2F)authentication scheme for gateway-centric IoT,which is based on FIDO U2F.The scheme combines the tamper-proof hardware token in U2F protocol with the gateway-centric IoT architecture,in order to achieve high security and efficiency of the identity authentication in IoT while reducing the dependence on service providers.The hardware token can interact with the gateway node and mobile Internet server simultaneously.The scheme realizes the high security and efficiency of identity authentication in IoT,while reducing the dependence on service providers and protecting the Internet of things devices from malicious attacks.After that,we apply the G2F prototype in Alicloud for practical test and evaluation.The security and performance test results show that G2F can realize the lightweight and fast identity authentication in IoT,while protecting the identity authentication in IoT from the known security attacks.更多还原