Anti-Spoofing:Integrated Information Authentication of BeiDou-ⅡCivil Navigation Message

The BeiDou-Ⅱcivil navigation message(BDⅡ-CNAV)is transmitted in an open environment and no information integrity protection measures are provided.Hence,the BDⅡ-CNAV faces the threat of spoofing attacks,which can lead to wrong location reports and time indication.In order to deal with this threat,we proposed a scheme of anti-spoofing for BDⅡ-CNAV based on integrated information authentication.This scheme generates two type authentication information,one is authentication code information(ACI),which is applied to confirm the authenticity and reliability of satellite time information,and the other is signature information,which is used to authenticate the integrity of satellite location information and other information.Both authentication information is designed to embed into the reserved bits in BDⅡ-CNAV without changing the frame structure.In order to avoid authentication failure caused by public key error or key error,the key or public key prompt information(KPKPI)are designed to remind the receiver to update both keys in time.Experimental results indicate that the scheme can successfully detect spoofing attacks,and the authentication delay is less than 1%of the transmission delay,which meets the requirements of BDⅡ-CNAV information authentication.

BDSec:Security Authentication Protocol for BeiDou-Ⅱ Civil Navigation Message

Due to the lack of authentication mechanism in BeiDou navigation satellite system(BDS),BD-Ⅱ civil navigation message(BDⅡ-CNAV) are vulnerable to spoofing attack and replay attack.To solve this problem,we present a security authentication protocol,called as BDSec,which is designed by using China’s cryptography Shangyong Mima(SM) series algorithms,such as SM2/4/9 and Zu Chongzhi(ZUC)algorithm.In BDSec protocol,both of BDⅡ-CNAV and signature information are encrypted using the SM4 algorithm(Symmetric encryption mechanism).The encrypted result is used as the subject authentication information.BDSec protocol applies SM9 algorithm(Identity-based cryptography mechanism) to protect the integrity of the BDⅡ-CNAV,adopts the SM2 algorithm(Public key cryptosystem) to guarantee the confidentiality of the important session information,and uses the ZUC algorithm(Encryption and integrity algorithm) to verify the integrity of the message authentication serial number and initial information and the information in authentication initialization sub-protocol respectively.The results of the SVO logic reasoning and performance analysis show that BDSec protocol meets security requirements for the dual user identity authentication in BDS and can realize the security authentication of BDⅡ-CNAV.

Blockchain-Based Message Authentication Scheme for Internet of Vehicles in an Edge Computing Environment

As an important application of intelligent transportation system,Internet of Vehicles(IoV)provides great convenience for users.Users can obtain real-time traffic conditions through the IoV’s services,plan users’travel routes,and improve travel efficiency.However,in the IoV system,there are always malicious vehicle nodes publishing false information.Therefore,it is essential to ensure the legitimacy of the source.In addition,during the peak period of vehicle travel,the vehicle releases a large number of messages,and IoV authentication efficiency is prone to performance bottlenecks.Most existing authentication schemes have the problem of low authentication efficiency in the scenario.To address the above problems,this paper designs a novel reliable anonymous authentication scheme in IoV for Rush-hour Traffic.Here,our scheme uses blockchain and elliptic curve cryptography(ECC)to design authentication algorithms for message authentication between vehicles and roadside units(RSU).Additionally,we introduce the idea of edge computing into the scheme,RSU will select themost suitable vehicle as the edge computing node for message authentication.In addition,we used the ProVerif tool for Internet security protocols and applications to test its security,ensuring that it is secure under different network attacks.In the simulation experiment,we compare our scheme with other existing works.Our scheme has a significant improvement in computational overhead,authentication efficiency and packet loss rate,and is suitable for traffic scenarios with large message volume.

TESLA-Based Authentication for BeiDou Civil Navigation Message

Due to the civil BeiDou navigation system is open,unauthenticated,and non-encrypted,civilian BeiDou navigation signals may have great security loopholes during transmission or reception.The main security loophole here is spoofing attacks.Spoofing attacks make the positioning or timing results of BeiDou civilian receivers wrong.Such errors may cause a series of security problems,which lays a serious hidden danger for Bei-Dou satellite information security.This article proposes an anti-spoofing method for BeiDou navigation system based on the combination of SM commercial cryptographic algorithm and Timed Efficient Stream Loss-tolerant Authentication(TESLA)for spoofing attacks.In this solution,we use the SM3 algorithm to generate a TESLA key chain with time information,and then use the key in the key chain to generate the message authentication code for the BeiDou D2 navigation message.The message authentication code is inserted into a reserved bit of the D2 navigation message.In addition,this solution uses the SM2 algorithm to protect and encrypt time information in the TESLA key chain to prevent key replay attacks in TESLA.The experimental results tested on the experimental platform built in this paper show that this scheme reduces the possibility of the BeiDou navigation system being deceived and enhances the safety of the BeiDou navigation system.

Secure authentication of classical messages with single photons

This paper proposes a scheme for secure authentication of classical messages with single photons and a hashed function. The security analysis of this scheme is also given, which shows that anyone cannot forge valid message authentication codes （MACs）. In addition, the lengths of the authentication key and the MACs are invariable and shorter, in comparison with those presented authentication schemes. Moreover, quantum data storage and entanglement are not required in this scheme. Therefore, this scheme is more efficient and economical.

Message Authentication with a New Quantum Hash Function

To ensure the security during the communication,we often adopt different ways to encrypt the messages to resist various attacks.However,with the computing power improving,the existing encryption and authentication schemes are being faced with big challenges.We take the message authentication as an example into a careful consideration.Then,we proposed a new message authentication scheme with the Advanced Encryption Standard as the encryption function and the new quantum Hash function as the authentication function.Firstly,the Advanced Encryption Standard algorithm is used to encrypt the result of the initial message cascading the corresponding Hash values,which ensures that the initial message can resist eavesdropping attack.Secondly,utilizing the new quantum Hash function with quantum walks can be much more secure than traditional classical Hash functions with keeping the common properties,such as one-wayness,resisting different collisions and easy implementation.Based on these two points,the message authentication scheme can be much more secure than previous ones.Finally,it is a new way to design the message authentication scheme,which provides a new thought for other researchers in the future.Our works will contribute to the study on the new encryption and authentication functions and the combination of quantum computing with traditional cryptology in the future.

Two Modifications on IKE Protocol with Pre-shared Key Authentication

This paper proposed two modifications on IKE protocol with pre-shared key authentication. The first modification can improve its immunity against DDoS attack by authenticating the initiator before the responder generates the computation-intensive Diffie-Hellman public value. The second modification can improve its efficiency when the attack on messages occurs because it can detect the attack quickly by replacing the centralized authentication in origical IKE protocol with immediate authentication. In addition, the two modifications can be integrated into one protocol compactly.

A Secure Short Message Communication Protocol

According to the security requirement of the short message service （SMS） industry application, a secure short message communication protocol is proposed. This is an application level protocol constructed on the standard SMS communication protocol using public key authentication and key agreement without the need of wireless public key infrastructure （WPKI）. Secure short message transmission and dynamic key agreement between mobile terminals and the accessing gateway axe realized. The security of the proposed protocol is validated through the BAN logic. Compared with the standard SMS protocol, the effective payload rate of our protocol can reach 91.4%, and subscriber identity module （SIM） tool kit （STK） applications based on our protocol suit well for all kinds of mobile terminals in practical application.

A Novel Video Data-Source Authentication Model Based on Digital Watermarking and MAC in Multicast

A novel video data authentication model based on digital video watermarking and MAC （message authentication code） in multicast protocol is proposed in this paper, The digital watermarking which composes of the MAC of the significant vid eo content, the key and instant authentication data is embedded into the insignificant video component by the MLUT （modified look-up table） video watermarking technology. We explain a method that does not require storage of each data packet for a time, thus making receiver not vulnerable to DOS （denial of service） attack. So the video packets can be authenticated instantly without large volume buffer in the receivers. TESLA （timed efficient stream loss tolerant authentication） does not explain how to select the suitable value for d, which is an important parameter in multicast source authentication. So we give a method to calculate the key disclosure delay （number of intervals）. Simulation results show that the proposed algorithms improve the performance of data source authentication in multicast.

Improving Computation Efficiency of Source Authentication by Elliptic Curve Cryptosystem

The overload of traditional cryptosystems is too high for real-time applications so there is a need to design a new encryption and signature scheme for the multicast applications. In this paper, we use the elliptic curve cryptosystem to design a source authentication scheme for real-time applications. The proposed scheme uses the message recovery signature to reduce the computation cost. Thus, the proposed source authentication scheme is more suitable for real-time applications, such as online meeting, online movie, and online music.

Active Authentication Protocol for IoV Environment with Distributed Servers

The Internet of Vehicles(IoV)has evolved as an advancement over the conventional Vehicular Ad-hoc Networks(VANETs)in pursuing a more optimal intelligent transportation system that can provide various intelligent solutions and enable a variety of applications for vehicular traffic.Massive volumes of data are produced and communicated wirelessly among the different relayed entities in these vehicular networks,which might entice adversaries and endanger the system with a wide range of security attacks.To ensure the security of such a sensitive network,we proposed a distributed authentication mechanism for IoV based on blockchain technology as a distributed ledger with an ouroboros algorithm.Using timestamp and challenge-responsemechanisms,the proposed authentication model can withstand several security attacks such asMan-in-Middle(MiM)attacks,Distributed Denial of Service(DDoS)attacks,server spoofing attacks and more.The proposed method also provides a solution for single-point failure,forward secrecy,revocability,etc.We exhibit the security of our proposed model by using formal(mathematical)analysis and informal analysis.We used Random Oracle Model to perform themathematical analysis.In addition,we compared the communication cost,computation cost,and security of the proposed model with the related existing studies.We have verified the security of the model by using AVISPA tool simulation.The security analysis and computation analysis show that the proposed protocol is viable.

Cryptanalysis of quantum broadcast communication and authentication protocol with a one-time pad

Chang et al.[Chin.Phys.623 010305（2014）]have proposed a quantum broadcast communication and authentication protocol.However,we find that an intercept-resend attack can be preformed successfully by a potential eavesdropper,who will be able to destroy the authentication function.Afterwards,he or she can acquire the secret transmitted message or even modify it while escaping detection,by implementing an efficient man-in-the-middle attack.Furthermore,we show a simple scheme to defend this attack,that is,applying non-reusable identity strings.

Design and Implementation of End to End Encrypted Short Message Service (SMS) Using Hybrid Cipher Algorithm

The study on design and implementation of end to end encrypted Short Message Service (SMS) using hybrid cipher algorithm is motivated by high rate of insecurity of data observed during Short Message Service (SMS) on Mobile devices. SMS messages are one of the popular ways of communication. The aim therefore is to design a software for end to end encryption short message service (SMS) that can conceal message while on transit to another mobile device using Hybrid Cipher Algorithm on Android Operating System and implement it for security of mobile SMS. Hybrid encryption incorporates a combination of asymmetric and symmetric encryption to benefit from the strengths of each form of encryption. Various encryption algorithms have been discussed. Secondary sources were employed in gathering useful data. In this research work three methodologies are employed—Structured System Analysis Design Methodology (SSADM), Object Oriented Analysis Design Methodology (OOADM) and prototyping. With the help of the three cryptographic algorithms employed—Message digest 5 (MD5), Blowfish and Rivest-Shamir Adleman (RSA);integrity, confidentiality, authentication and security of messages were achieved. The messages encrypted by developed application are also resistant to brute force attack. The implementing programs were coded in Java.

EBAKE-SE: A novel ECC-based authenticated key exchange between industrial IoT devices using secure element

Industrial IoT(IIoT)aims to enhance services provided by various industries,such as manufacturing and product processing.IIoT suffers from various challenges,and security is one of the key challenge among those challenges.Authentication and access control are two notable challenges for any IIoT based industrial deployment.Any IoT based Industry 4.0 enterprise designs networks between hundreds of tiny devices such as sensors,actuators,fog devices and gateways.Thus,articulating a secure authentication protocol between sensing devices or a sensing device and user devices is an essential step in IoT security.In this paper,first,we present cryptanalysis for the certificate-based scheme proposed for a similar environment by Das et al.and prove that their scheme is vulnerable to various traditional attacks such as device anonymity,MITM,and DoS.We then put forward an interdevice authentication scheme using an ECC(Elliptic Curve Cryptography)that is highly secure and lightweight compared to other existing schemes for a similar environment.Furthermore,we set forth a formal security analysis using the random oracle-based ROR model and informal security analysis over the Doleve-Yao channel.In this paper,we present comparison of the proposed scheme with existing schemes based on communication cost,computation cost and security index to prove that the proposed EBAKE-SE is highly efficient,reliable,and trustworthy compared to other existing schemes for an inter-device authentication.At long last,we present an implementation for the proposed EBAKE-SE using MQTT protocol.

车联网中的无证书批量认证方案

针对车联网中网络带宽和计算能力有限导致消息认证效率低的问题,提出一种车联网中的无证书批量认证方案.权威机构为每个注册车辆生成一个评估证明,并基于全部注册车辆计算一个全局承诺,车辆基于评估证明参与消息认证过程.在认证过程中,可信机构能够利用全局承诺通过双线性配对来检验车辆、评估证明的有效性,以实现认证消息的快速批量认证.在隐私安全方面,所提出方案在区块链架构的基础上引入零知识证明,为车辆提供匿名性、不可链接性等隐私保护属性,并通过区块链状态数据库实现对车辆身份的准确追溯与快速撤销.针对所提出方案进行了安全性分析、计算效率分析以及仿真试验.结果表明,所提出方案能够满足匿名性、不可链接性等多种安全需求,其平均认证时间为0.357 ms,至少优于现有同类方案12.46%.

面向BDSBAS电文认证的OTAR设计与仿真

星基增强系统(Satellite Based Augmentation System,SBAS)的电文格式公开,为防止SBAS服务遭受生成式欺骗攻击,国际民航组织积极推进SBAS认证服务标准的制定.本文面向北斗星基增强系统(BeiDou SatelliteBased Augmentation System,BDSBAS)阐述了基于中国商用密码算法的椭圆曲线数字签名(Elliptic Curve Digital Signature Algorithm,ECDSA)电文认证方案与时间效应流丢失容错(Time Efficient Stream Loss-tolerant Authentication,TESLA)电文认证方案,设计了BDSBAS认证电文,依据空中密钥管理OTAR(Over The Air Rekeying)的策略制定了OTAR电文(OTAR Message Type,OMT)与播发方案.通过蒙特卡洛OTAR仿真器开展仿真,对不同OTAR电文接收时间进行分析,本文设计的方案与国外方案对比结果有明显的提升,有效的减少了接收机完成认证使用SBAS增强服务的时间,对BDSBAS电文认证服务提供一定参考与建议.

基于区块链的GEO/LEO卫星网络安全认证技术研究

由于卫星网络高暴露、高时延的特点,不同系统星座组网进行遥控指令发布及遥测信息回传时,容易受到其他卫星恶意接入导致信息泄露。卫星网络安全认证成为天基测控实现过程中必须解决的技术问题。面向高轨和低轨双层卫星网络场景下的安全组网需求,提出了一种基于区块链的星间组网认证技术,该技术包括基于区块链的卫星身份认证和星间消息认证。研究设计将卫星临时身份登记上区块链,通过比对链上信息完成卫星的身份认证。为进一步增强消息传输安全性,采用椭圆曲线数字签名算法对星间消息进行签名验证。通过仿真分析,验证了所提技术能够以较小的时间开销满足卫星在组网认证阶段的多种安全需求。

语音实验室端到端即时通信认证协议设计

为保证语音实验室端到端即时通信安全,确保语音内容不被窃听和篡改,提出一种基于混合加解密的语音实验室端到端即时通信认证协议的设计方法。利用RSA方法加解密发送方传输的即时通信会话密钥,通过3DES方法将发送方发送的明文语音信息进行加解密。在加解密过程中,加密信息打包为加密包后发送至信息接收方,信息接收方获取加密包后,使用RSA方法、3DES方法进行有效的密钥解密认证、明文语音消息解密,获取语音实验室端到端的明文语音信息。实验结果显示,此协议使用下,语音实验室端到端即时通信的认证加速比提升,且仅在密钥输入内容准确的情况下,信息接收方才可得到准确的明文语音消息内容,且不存在内容失真问题。

具有隐私保护的可验证计算研究进展

随着信息产业的高速发展,复杂的计算任务与用户有限的计算能力之间的矛盾愈加突出,如何借助云平台提供的计算服务,实现安全可靠的外包计算,引起了人们的广泛关注。具有隐私保护的可验证计算为该问题提供了有效途径,它能够解决外包计算中的两大安全问题——计算结果不可信和用户隐私数据泄露。根据客户端存储能力是否受限,可验证计算可分为计算外包模式和数据外包模式,本文分别对这两种模式下具有隐私保护的可验证计算进行梳理和总结。对于计算外包模式,本文以方案涉及的服务器数量为分类依据,分别梳理了单服务器情形和多服务器情形下的相关工作。其中,对于单服务器情形下具有隐私保护的可验证计算,提炼出了一般化的通用构造方法和针对具体函数的构造技术,并对多服务器情形下的相关方案进行了分析对比。对于数据外包模式,本文根据实现工具的不同,分别梳理了基于同态认证加密的可验证计算和基于上下文隐藏的同态签名的可验证计算。具体地,本文从函数类型、安全强度、困难假设、验证方式、证明规模等多个维度对现有的同态认证加密方案进行了分析对比;此外,本文还对同态签名不同的隐私性定义进行了总结对比,包括单密钥情形下的弱上下文隐藏性、强上下文隐藏性、完全上下文隐藏性和基于模拟的上下文隐藏性,以及多密钥情形下的内部上下文隐藏性和外部上下文隐藏性。最后,通过分析现有方案在性能、功能和安全性三个方面的优势及不足,对具有隐私保护的可验证计算未来的研究重点进行了讨论与展望。