臺灣博碩士論文加值系統

在分散式計算環境中，可認證三方金鑰協議協定為客戶端經由認證伺服器存取應用程式伺服器所提供的服務。認證伺服器負責客戶端與應用程式伺服器的認證並協助雙方建立會議金鑰。在此種環境中使用金鑰傳輸認證協定，認證伺服器可監視傳輸訊息以預防與追踨網路犯罪。在金鑰傳輸認證協定中，會議金鑰是由認證伺服器單獨産生，易有金鑰支配安全問題。另一方面，隨著網路通訊技術快速發展，人們廣泛使用行動裝置存取遠端伺服器的服務。許多適用於行動裝置的可認證金鑰協議協定紛紛被提出，然而大部份的協定易受短暫秘密洩漏攻擊，攻擊者可從竊聽的訊息中得到客戶端的私密金鑰與會議金鑰。在本篇論文中，本研究以具備短暫秘密洩漏安全之身分為基礎的可認證金鑰交換協定為基礎提出一個適用於分散式計算環境具備短暫秘密洩漏安全之身分為基礎的三方可認證金鑰協議協定。本研究提出的協定不僅解決金鑰傳輸認證協定中金鑰支配安全問題並保留其可預防與追踨網路犯罪的優點，同時具備短暫秘密洩漏安全。AVISPA工具模擬結果符合協定的安全性分析。本研究亦提出協定的平行版本，使協定的運行更具效率。

A three-party Authenticated Key Agreement(AKA) protocol in the distributed computing environment is a client that requests services from an application server through an authentication server. The authentication server is responsible for the authentication of participating entities and helps them to construct a common session key. Adopting the Key Transfer Authentication Protocol(KTAP)in such an environment, the authentication server is able to monitor the communication messages to prevent and trace network crime. However, the session key in the KTAP setting is created only by the authentication server and is vulnerable tote resilience of key control. On the other hand, with the rapid growth of network technologies, mobile devices are widely used by people to access servers in the Internet. Many AKA protocols for mobile devices have been proposed, however, most protocols are vulnerable to Ephemeral Secret Leakage(ESL) attacks which compromise the private keys of clients and the session key by an adversary from eavesdropped messages. This paper proposes a novel ESL-secure ID-based three-party AKA protocol for mobile distributed computing environments based on ESL-secure ID-based Authenticated Key Exchange(ID-AKE) protocol. The proposed protocol solves the key control problem in KTAP while retaining the advantages of preventing and tracing network crime in KTAP and also resists ESL attacks. The AVISPA tool simulation results confirm the correctness of the protocol security analysis. Furthermore, a parallel version of the proposed protocol is presented that is communication-efficient.

CONTENTS
中文摘要 i
ABSTRACT ii
謝誌 iv
CONTENTS v
LIST OF TABLES vii
LIST OF FIGURES viii
Chapter 1 Introduction 1
Chapter 2 Preliminaries 6
2.1 Bilinear Pairings 6
2.2 Computational Problems 6
2.3 Security Attributes 7
2.4 Notations 8
Chapter 3 The Proposed Protocol 10
3.1 System Setup Phase 10
3.2 Key Extract Phase 11
3.3 Mutual Authentication and Key Agreement Phase 12
3.4 The Parallel Version 20
3.5 Preventing and Tracing Network Crime 22
Chapter 4 Security and Performance Analysis 25
4.1 Security Analysis 25
4.2 Formal Analysis Using AVISPA 30
4.3 Performance Analysis 32
4.4 Software Performance 33
Chapter 5 Conclusions 35
References 36
Appendix A. HLPSL code of the proposed protocol 40

References
[1] W. Diffie and M. E. Hellman, "New directions in cryptography," IEEE Transactions on Information Theory, vol. 22, no. 6, pp. 644-654, 1976.
[2] W. Diffie, P. Van Oorschot, and M. Wiener, "Authentication and authenticated key exchanges," Designs, Codes and Cryptography, vol. 2, no. 2, pp. 107-125, 1992.
[3] M. Abdalla and D. Pointcheval, "Simple Password-Based Encrypted Key Exchange Protocols," Topics in Cryptology – CT-RSA 2005, vol. 3376, no. 14, pp. 191-208, 2005.
[4] R. L. Rivest, A. Shamir, and L. Adleman, "A method for obtaining digital signatures and public-key cryptosystems," Communications of the ACM, vol. 21, no. 2, pp. 120-126, 1978.
[5] C. T. Li and M. S. Hwang, "An efficient biometrics-based remote user authentication scheme using smart cards," Journal of Network and Computer Applications, vol. 33, no. 1, pp. 1-5, 2010.
[6] C. S. Tsai, C. C. Lee, and M. S. Hwang, "Password Authentication Schemes: Current Status and Key Issues," International Journal of Network Security, vol. 3, no. 3, pp. 101-115, 2006.
[7] A. Shamir, "Identity-Based Cryptosystems and Signature Schemes," Advances in Cryptology, vol. 196, no. 5, pp. 47-53, 1985.
[8] D. Boneh and M. Franklin, "Identity-Based Encryption from the Weil Pairing," Advances in Cryptology — CRYPTO 2001, vol. 2139, no. 13, pp. 213-229, 2001.
[9] D. Boneh and X. Boyen, "Secure Identity Based Encryption Without Random Oracles," Advances in Cryptology – CRYPTO 2004, vol. 3152, no. 27, pp. 443-459, 2004.
[10] B. Waters, "Efficient Identity-Based Encryption Without Random Oracles," Advances in Cryptology – EUROCRYPT 2005, vol. 3494, no. 17, pp. 114-127, 2005.
[11] C. Gentry, "Practical Identity-Based Encryption Without Random Oracles," Advances in Cryptology - EUROCRYPT 2006, vol. 4004, no. 27, pp. 445-464, 2006.
[12] A. Joux, "A One Round Protocol for Tripartite Diffie–Hellman," Algorithmic Number Theory, vol. 1838, no. 23, pp. 385-393, 2000.
[13] S. Al-Riyami and K. Paterson, "Tripartite Authenticated Key Agreement Protocols from Pairings," Cryptography and Coding, vol. 2898, no. 27, pp. 332-359, 2003.
[14] M. H. Lim, S. Lee, and S. Moon, "Cryptanalysis of Tso et al.’s ID-Based Tripartite Authenticated Key Agreement Protocol," Information Systems Security, vol. 4812, no. 6, pp. 64-76, 2007.
[15] M. Hölbl, T. Welzer, and B. Brumen, "Two proposed identity-based three-party authenticated key agreement protocols from pairings," Computers & Security, vol. 29, no. 2, pp. 244-252, 2010.
[16] H. Xiong, Z. Chen, and F. Li, "New identity-based three-party authenticated key agreement protocol with provable security," Journal of Network and Computer Applications, vol. 36, no. 2, pp. 927-932, 2013.
[17] H. T. Yeh and H. M. Sun, "Password-based user authentication and key distribution protocols for client–server applications," Journal of Systems and Software, vol. 72, no. 1, pp. 97-103, 2004.
[18] J. T. Kohl, B. C. Neuman, and T. Y. Tso, "The evolution of the Kerberos authentication system. In: Distributed Open System," IEEE Computer Society Press, pp. 78-94, 1991.
[19] H. T. Yeh and H. M. Sun, "Password authenticated key exchange protocols among diverse network domains," Computers & Electrical Engineering, vol. 31, no. 3, pp. 175-189, 2005.
[20] G. Li, "Optimal authentification protocols resistant to password guessing attacks," Computer Security Foundations Workshop, 1995. Proceedings, Eighth IEEE, pp. 24-29, 1995.
[21] T. Kwon, M. Kang, S. Jung, and J. Song, "An Improvement of the Password-Based Authentication Protocol (K1P) on Security against Replay Attacks," IEICE transactions on communications, vol. 82, no. 7, pp. 991-997, 1999.
[22] T. Kwon and J. Song, "Authenticated key exchange protocols resistant to password guessing attacks," Communications, IEE Proceedings, vol. 145, no. 5, pp. 304-308, 1998.
[23] T. Y. Chang, M. S. Hwang, and W. P. Yang, "A communication-efficient three-party password authenticated key exchange protocol," Information Sciences, vol. 181, no. 1, pp. 217-226, 2011.
[24] L. Ni, G. Chen, and J. Li, "Escrowable identity-based authenticated key agreement protocol with strong security," Computers & Mathematics with Applications, vol. 65, no. 9, pp. 1339-1349, 2013.
[25] H. A. Wen, C. L. Lin, and T. Hwang, "Provably secure authenticated key exchange protocols for low power computing clients," Computers & Security, vol. 25, no. 2, pp. 106-113, 2006.
[26] D. S. Wong and A. H. Chan, "Efficient and mutually authenticated key exchange for low power computing devices," Advances in Cryptology - ASIACRYPT 2008, vol. 2248, no. 17, pp. 272-289, 2001.
[27] M. Jakobsson and D. Pointcheval, "Mutual Authentication for Low-Power Mobile Devices," Financial Cryptography, vol. 2339, no. 17, pp. 178-195, 2002.
[28] K. Choi, J. Hwang, D. Lee, and I. Seo, "ID-based Authenticated Key Agreement for Low-Power Mobile Devices," Information Security and Privacy, vol. 3574, no. 41, pp. 494-505, 2005.
[29] Y. H. Chuang and Y. M. Tseng, "Towards generalized ID-based user authentication for mobile multi-server," International Journal of Communication Systems, vol. 25, no. 4, pp. 447-460, 2012.
[30] T. Y. Wu and Y. M. Tseng, "An efficient user authentication and key exchange protocol for mobile client–server environment," Computer Networks, vol. 53, no. 7, pp. 1062-1070, 2010.
[31] Y. M. Tseng and L. Tseng, "Ephemeral-Secret-Leakage Secure ID-Based Authenticated Key Exchange Protocol for Mobile Client-Server Environments," 24th Cryptology and Information Security Conference, 2014.
[32] T. Y. Chang, C. J. Tsai, and J. H. Lin, "A graphical-based password keystroke dynamic authentication system for touch screen handheld mobile decices," Journal of Systems and Software, vol. 85, no. 5, pp. 1157-1165, 2012.
[33] S. Blake-Wilson and A. Menezes, "Authenticated Diffe-Hellman Key Agreement Protocols," Selected Areas in Cryptography, vol. 1556, no. 26, pp. 339-361, 1999.
[34] AVISPA v1.1 User Manual, 2006. Available: <http://www.avispa-project.org/>.
[35] T. H. Chen, W. B. Lee, and H. B. Chen, "A round- and computation-efficient three-party authenticated key exchange protocol," Journal of Systems and Software, vol. 81, no. 9, pp. 1581-1590, 2008.
[36] C. Metz, "AAA protocols: authentication, authorization, and accounting for the Internet," IEEE Internet Computing, vol. 3, no. 6, pp. 75-79, 1999.
[37] C. Rensing, M. Karsten and B. Stiller, "AAA: a survery and a policy-based architecture and framework," IEEE Network, vol. 16, no. 6, pp. 22-27, 2002.
[38] S. Decugis, "Towards a Global AAA Framework for Internet," 2009 Ninth Annual International Symposium on Applications and the Internet, pp. 227-230, 2009.
[39] D. Dolev and A. Y. Yao, "On the Security of Public Key Protocols," IEEE Information Teory Society, vol. 29, no. 2, pp. 198-208, 1983.
[40] AVISPA Web tool. Automated Validation of Internet Secuirty Protocols and Applications. <http://www.avispa-project.org/web-interface>.
[41] M. Scott, N. Costigan, and W. Abdulwahab, "Implementing Cryptographic Pairings on Smartcards," Cryptographic Hardware and Embedded Systems - CHES 2006, vol. 4249, no. 11, pp. 134-147, 2006.
[42] L. B. Oliveira, D. F. Aranha, C. P. L. Gouvêa, M. Scott, D. F. Câmara, and J. López, "TinyPBC: Pairings for authenticated identity-based non-interactive key distribution in sensor networks," Computer Communications, vol. 34, no. 3, pp. 485-493, 2011.
[43] L. Hu, J. W. Dong, and D. Y. Pei, "Implementation of Cryptosystem Based on Tate Pairing," Journal of Computer Science and Technology, vol. 20, no. 2, pp. 264-269, 2005.