安全的認證協定及其應用

Secure Authentication Protocols and Their Applications

鄭婷方(Ting-Fang Cheng)

指導教授 ： 張真誠

國立清華大學/電機資訊學院/資訊工程學系/博士(2013年)

摘要

隨著網路和資訊科技的發展，以及線上人口的持續增加，許多商業交易和人與人之間的通訊便轉移到網際網路上。然而由於資訊的數位化，網路上傳輸的資料很容易遭受惡意攻擊者的竊聽、篡改、和複製。為了保障通訊雙方的權益，身分認證便成為網路系統中最重要的安全議題之一。也就是說，對於任意的通訊雙方，我們該如何做訊息交換來確認彼此身分的合法性，進而達到通訊的安全。
本論文主要在研究各種認證機制和相關應用的安全性及基本需求。首先回顧三方認證金鑰協議的基本原理，並提出更為安全有效的認證機制。隨後考慮現今網路的急速成長，已使單一伺服器系統的認證機制不敷使用。因此我們延伸前面三方認證金鑰協議的概念，提出一項全新的多重伺服器認證方法。在這個方法中，我們改良伺服器和註冊中心之間共享金錀的方式，以確實達到使用者單次註冊的特性。並以前述兩種認證機制為基礎，再額外設計出三種不同的應用系統：匿名的英式電子拍賣系統、衛星通訊系統的認證機制以及混合式電子售票系統。值得注意的是在電子拍賣系統中，首先引進了商品上架的概念。這讓系統中的使用者不僅能作為買家競標商品，亦可成為賣方在系統上銷售物品。這樣的概念讓我們的電子拍賣系統更貼近於現實生活。另一方面，在混合式售票系統中，我們利用多重伺服器的概念，提供一個票券整合平台，讓各種票券供應商能委託整合伺服器代售，而消費者可以在任何有網路的地方透過此平台來瀏覽和購買他們所需的票券。最後，除了上述一對一通訊外，我們也進一步探討一對多通訊的安全性，即群組通訊中的多重播送和金鑰分配的認證問題。

關鍵字

三方認證金鑰協議 ； 匿名 ； 英式拍賣 ； 群組通訊 ； 多重伺服器 ； 多重播送 ； 相互認證 ； 上架 ； 衛星通訊系統 ； 售票系統

並列摘要

With the rapid development of network and information technologies and the continuing growth of the online population, more and more commercial enterprises are supporting online transactions. However, due to the digitization of information, it is easy for malicious attackers to eavesdrop on, tamper with, or duplicate data that are transmitted on the network. In order to protect the rights and interests of both communication parties, authentication is one of the most important security issues for network systems. Thus, when any two parties are communicating, it is very important that they be able to confirm the legitimacy of each other’s identity in order to achieve secure communication.
In this study, we focused on security research and the essentials of various authentication protocols and related applications. First, we reviewed the principle of three-party authenticated key exchange (3PAKE) and provided a more secure and efficient authentication protocol based on this architecture. Second, considering that the single-server authentication mechanism is no longer sufficient due to the explosive growth of computer networks, we extended the first 3PAKE protocol to a multi-server architecture. In the new scheme, we improved the strategy of key sharing between service providers and the registration center in order to achieve single registration with certainty. Third, based on the two previous authentication protocols, we subsequently designed three application systems, including an anonymous electronic English auction system, an authentication scheme for satellite communication systems, and a diverse ticket-sale system in a hybrid cloud. Especially in the new auction system, we were the first to design an on-shelf mechanism for an auction system that allows users to play the role of a bidder as well as an auctioneer. In the new, diverse, ticket-sale system, we applied the concept of a multi-server to provide a ticket integration platform that service providers can use to delegate the sale of their service tickets to the integrated server, and the customers can freely browse and purchase electronic service tickets from the system in any networked place. In addition to previous one-to-one communications, we also explored the security of one-to-many communications. Finally, we proposed a secure multicast authentication protocol and developed the cryptanalysis of a polynomial-based key management scheme for group communication.

並列關鍵字

3PAKE ； anonymity ； English auction ； group communication ； multi-server ； multicast ； mutual authentication ； on-shelf ； satellite communication system ； ticket-sale system

參考文獻

[2] Abdellatif, R., Aslan, H.K. and Elramly, S.H., “New real time multicast authentication protocol,” International Journal of Network Security, Vol. 12, No. 1, pp. 13-20, Jan. 2011.

[137] Xiong, H., Qin, Z. and Li, F., “An anonymous sealed-bid electronic auction based on ring signature,” International Journal of Network Security, Vol. 8, No. 2, pp. 236-243, May 2009.

[143] Zhang, Q. and Calvert, K.L., “A peer-based recovery scheme for group rekeying in secure multicast,” International Journal of Network Security, Vol. 6, No. 1, pp. 15-25, Jan. 2008.

[7] Bellovin, S.M. and Merritt, M., “Encrypted key exchange: password-based protocols secure against dictionary attacks,” Proceedings of 1992 IEEE Computer Society Symposium on Research in Security and Privacy, Oakland, CA, pp. 72-84, May 1992.

[12] Cachin, C., “Efficient private bidding and auctions with an oblivious third party,” Proceedings of 6th ACM Conference on Computer and Communications Security (ACM CCS 1999), Singapore, pp. 120-127, Nov. 1999.