Efficient Identity Based Signcryption Scheme with Public Verifiability and Forward Security

In this paper, we point out that Libert and Quisquater’s signcryption scheme cannot provide public verifiability. Then we present a new identity based signcryption scheme using quadratic residue and pairings over elliptic curves. It combines the functionalities of both public verifiability and forward security at the same time. Under the Bilinear Diffie-Hellman and quadratic residue assumption, we describe the new scheme that is more secure and can be some-what more efficient than Libert and Quisquater’s one.

ESMD-Flow: An Intelligent Flow Forwarding Scheme with Endogenous Security Based on Mimic Defense in Space-Air-Ground Integrated Network

The Space-Air-Ground Integrated Network(SAGIN) realizes the integration of space, air,and ground networks, obtaining the global communication coverage.Software-Defined Networking(SDN) architecture in SAGIN has become a promising solution to guarantee the Quality of Service(QoS).However, the current routing algorithms mainly focus on the QoS of the service, rarely considering the security requirement of flow. To realize the secure transmission of flows in SAGIN, we propose an intelligent flow forwarding scheme with endogenous security based on Mimic Defense(ESMD-Flow). In this scheme, SDN controller will evaluate the reliability of nodes and links, isolate malicious nodes based on the reliability evaluation value, and adapt multipath routing strategy to ensure that flows are always forwarded along the most reliable multiple paths. In addition, in order to meet the security requirement of flows, we introduce the programming data plane to design a multiprotocol forwarding strategy for realizing the multiprotocol dynamic forwarding of flows. ESMD-Flow can reduce the network attack surface and improve the secure transmission capability of flows by implementing multipath routing and multi-protocol hybrid forwarding mechanism. The extensive simulations demonstrate that ESMD-Flow can significantly improve the average path reliability for routing and increase the difficulty of network eavesdropping while improving the network throughput and reducing the average packet delay.

CLORKE-SFS:Certificateless One-Round Key Exchange Protocol with Strong Forward Security in Limited Communication Scenarios

Certificateless one-round key exchange(CL-ORKE)protocols enable each participant to share a common key with only one round of communication which greatly saves communication cost.CLORKE protocols can be applied to scenarios with limited communication,such as space communication.Although CL-ORKE protocols have been researched for years,lots of them only consider what secrets can be compromised but ignore the time when the secrets have been corrupted.In CL-ORKE protocols,the reveal of the long-term key attacks can be divided into two different attacks according to the time of the long-term key revealed:the attack to weak Forward Security(wFS)and the attack to strong Forward Security(sFS).Many CLKE protocols did not take into account the sFS property or considered sFS as wFS.In this paper,we first propose a new security model for CL-ORKE protocols which considers the sFS property as well as the Ephemeral Key Reveal attack.Then,we give a CL-ORKE protocol which is called CLORKE-SFS.CLORKE-SFS is provably secure under the proposed model provided the Elliptic Curve Computational Diffie-Hellman(ECCDH)and the Bilinear Computational Diffie-Hellman problem(BCDH)assumption hold.The security model and the protocol may give inspiration for constructing oneround key exchange protocols with perfect forward security in certificateless scenarios.

A New Forward-Secure Authenticated Encryption Scheme with Message Linkages

Yoon and Yoo recently proposed a robust authenticated encryption scheme and claimed their scheme has the properties of forward secrecy and confidentiality. The current paper, however, points out that Yoon-Yoo＇s scheme also can not provide forward secrecy and confidentiality such that any adversary can easily recover the transferred message. Based on intractability of reversing the one-way hash function and discrete logarithm problem, an improved authenticated encryption scheme with messages linkage is proposed. The above security faults get solved perfectly. The new scheme is proven to satisfy all the basic security requirements of the authenticated encryption scheme. And by the concrete comparison, it has the similar efficiency of the original scheme.

Forward-Secure Digital Signature Scheme with Tamper Evidence

Based on the definition of tamper evidence, the authors define a new notion of tamper evidence forward secure signature scheme （TE-FSig）, and propose a general method to build a TE-FSig scheme. Based on this method, they also give out a concrete instance. A TE-FSig scheme is constructed by the standard signature scheme, forward secures signature scheme and the aggregate signature scheme. It has an additional property of tamper evidence besides the property of forward secure, which can detect the time period when the key is exposed. In the standard model, the scheme constructed in the paper is proved to satisfy the prop- erties of forward secure, strong forward tamper-evidence secure, and strongly unforgeable under the chosen-message attack.

Server-Assisted Forward-Secure Threshold Signature

Forward secure signature can protect the security of signatures previous to the key exposure. Server-assisted signature is a special digital signature in which the signer allies one server to produce the signatures. In this paper, server-assisted for-ward-secure threshold signature is proposed. The system is composed of n1 servers and n2 users. Each user and each server holds a partial secret, respectively. To produce a valid signature, users and servers need to cooperate to complete the work. The partial secrets of the users and servers are updated by a one-way function at regular intervals, while the public key is always fixed. Even if all the current partial secrets are exposed, the signatures pertaining to previous periods are still valid.

An Efficient Forward Secure Signature Scheme

A new efficient forward secure signature scheme based on bilinear pairings is presented m this paper. Each complexity of key generation, key update, signing and verifying algorithms in this scheme is O（1） in terms of the total number of time periods T. Because a new structure in node secret key storage and a unique strategy in key update are employed, the signing and verifying costs don＇t grow when T increases. At the same time, the key generation and key update algorithms are efficiently constructed thanks to using the pre-order traversal technique of binary trees. Compared with other schemes based on bilinear pairings, the signature size in this scheme is very short, which doesn＇t change with T increasing. The scheme is forward secure in random oracle model assuming CDH problem is hard.

Improved QoS-Secure Routing in MANET Using Real-Time Regional ME Feature Approximation

Mobile Ad-hoc Network(MANET)routing problems are thoroughly studied several approaches are identified in support of MANET.Improve the Quality of Service(QoS)performance of MANET is achieving higher performance.To reduce this drawback,this paper proposes a new secure routing algorithm based on real-time partial ME(Mobility,energy)approximation.The routing method RRME(Real-time Regional Mobility Energy)divides the whole network into several parts,and each node’s various characteristics like mobility and energy are randomly selected neighbors accordingly.It is done in the path discovery phase,estimated to identify and remove malicious nodes.In addition,Trusted Forwarding Factor(TFF)calculates the various nodes based on historical records and other characteristics of multiple nodes.Similarly,the calculated QoS Support Factor(QoSSF)calculating by the Data Forwarding Support(DFS),Throughput Support(TS),and Lifetime Maximization Support(LMS)to any given path.One route was found to implement the path of maximizing MANET QoS based on QoSSF value.Hence the proposed technique produces the QoS based on real-time regional ME feature approximation.The proposed simulation implementation is done by the Network Simulator version 2(NS2)tool to produce better performance than other methods.It achieved a throughput performance had 98.5%and a routing performance had 98.2%.

基于区块链的前向安全群签名方案

针对当前群签名算法的中心化问题和依赖于可信第三方的局限性,提出一种基于区块链的前向安全群签名方案。该方案通过智能合约替代传统的可信第三方角色,旨在解决单点故障和缺乏可信第三方的问题;提出一种群管理员代理签名机制,利用哈希值将原始签名存证于区块链以增强数据的不可篡改性和安全性;通过基础方案、加方案和乘方案设计安全时间为T=2^(k)的前向安全性群签名算法。理论分析和实验验证的结果表明,该方案提高了群签名的安全性和效率。该研究为解决群签名的中心化问题提供了新思路。

支持模糊多关键字的动态可搜索加密方案

随着云计算的发展,云存储的便捷性和经济性使得大量用户将个人数据存储在第三方云服务器上.云端数据的加密存储可确保数据的安全性,但也增加了数据检索的难度.动态对称可搜索加密技术应运而生,其不仅能有效保护数据隐私,还可实现多关键字联合搜索的功能.同时,该技术在实际应用中引入的模糊搜索还可以增强用户的搜索体验和提高搜索效率.当前支持模糊搜索的可搜索加密方案存在一定的安全隐患,其未考虑动态更新时潜在的信息泄露问题.为此,提出了一种支持模糊多关键字的动态可搜索加密方案,在保证动态更新时信息安全的同时,支持多关键字联合搜索以及模糊搜索.该方案设计了一种关键字编码算法和局部敏感哈希函数构建模糊索引,并使用布隆过滤器加密算法对该索引进行加密,以实现模糊搜索.此外,引入了可信执行环境降低用户和服务器之间的通信开销、计算开销以及交互次数.最后,通过实验验证了该方案的安全性和有效性.

基于格密码的5G-R车地认证密钥协商方案

5G-R作为我国下一代高速铁路无线通信系统,其安全性对于保障行车安全至关重要。针对5G-AKA协议存在隐私泄露、根密钥不变和效率低等问题,基于格密码理论提出一种新型5G-R车地认证方案。首先,使用临时身份信息GUTI代替SUCI,克服了SUCI明文传输的缺点。其次,设计基于格密码的根密钥更新策略,采用格上公钥密码体制、近似平滑投射散列函数和密钥共识算法,实现了根密钥的动态更新和前后向安全性。再次,加入随机质询和消息认证码,实现了通信三方的相互认证,可有效防范重放、DoS等多种恶意攻击。最后,采用串空间形式化方法进行安全验证,结果表明:本文方法较其他方法有更高的安全性,被攻击成功的概率最低,仅为O(n^(2))×2^(-128),且有较低的计算开销和通信开销,能够满足5G-R高安全性的需求。

基于可更新加密的保护搜索模式的动态可搜索加密方案

动态可搜索对称加密(Dynamic Searchable Symmetric Encryption,DSSE)技术作为静态可搜索加密技术的拓展,因解决了数据密态场景下的安全检索问题并支持数据动态更新而备受关注。众所周知,目前大多数DSSE方案会泄露一些额外的信息以寻求更好的效率,如搜索模式与访问模式。最近的研究表明,这些泄露的信息面临着严重的安全问题,拥有数据库背景知识的敌手可能利用这些泄露信息恢复查询或重构数据库。由于这些泄露是伴随着查询的过程泄露出来的,因此不少学者提出在搜索时更新加密数据库来降低上述潜在的风险,即用户下载搜索到的密文数据到本地,解密后重新加密再上传到云服务器端。但这种方法会导致巨大的客户端通信、存储和计算开销。针对这一问题,提出了一种基于可更新加密的保护搜索模式的DSSE方案,该方案可以在不泄露数据隐私的情况下直接在服务器端进行数据更新,从而降低传统更新方法的通信开销以及客户端的计算开销。安全性分析表明,所提方案能有效保护搜索模式泄露;性能分析表明,所提方案相比传统利用更新密文方法保护搜索模式的方案能有效降低通信开销。在关键词匹配100个文档的情况下,与下载到本地重加密重传方式相比,所提方案的通信开销降低了70.92%。

一种改进的动态多用户前向安全可搜索加密方案

最近Wang等[14]提出了一种在多用户环境下满足前向安全的动态可搜索加密方案。然而该方案利用双线性对实现多用户的访问控制搜索效率低下,在此基础上通过构造两个静态哈希表相互映射构建矩阵索引,并用伪随机函数和Hash函数代替双线性对生成密钥提高方案的搜索效率。通过形式化安全证明,该方案满足前向安全。

基于发射天线选择的修改转发协作D2D网络的物理层安全

为了进一步提升与蜂窝网络共享频谱资源的解码转发(decode-and-forward,DF)协作终端直通(device-to-device,D2D)网络的物理层安全(physical layer security,PLS)性能,提出了一种D2D发送端采用发射天线选择(transmit antenna selection,TAS)的修改转发(modify-and-forward,MF)协作D2D-蜂窝网络PLS模型。配备多根发射天线的D2D发送端采用TAS技术,选择使D2D发送端至MF中继节点链路信干噪比最大的天线发送信号;中继采用MF协议将解码得到的合法信息进行修改后再转发,以避免被动窃听者能够解码出此阶段发送的合法信息,从而改善了D2D网络的PLS性能。推导了MF协作D2D网络的安全中断概率、非零安全容量概率和渐近安全中断概率的解析表达式,并与DF协作D2D网络的PLS性能进行对比分析。数值计算与仿真结果表明,MF协作D2D网络的PLS性能优于DF协作D2D网络,并且增大D2D发送端的发射天线数量,可以增强D2D网络的PLS性能。

中继选择NOMA无线系统的物理层安全

针对解码转发协作非正交多址接入(non-orthogonal multiple access,NOMA)系统物理层安全(physical layer security,PLS)性能较差,以及在多窃听者场景下PLS性能恶化的问题,提出了一种采用修改转发(modify-and-forward,MF)协议的多中继选择NOMA无线系统PLS模型。利用高斯-切比雪夫正交定理推导了非合谋或合谋窃听场景下多中继选择MF-NOMA无线系统的安全中断概率和渐近安全中断概率的近似表达式。仿真结果验证了多中继选择MF-NOMA无线系统PLS性能分析的准确性。结果同时也表明中继数目越多或窃听者数目越少,多中继选择MF-NOMA无线系统的PLS性能越好;合谋窃听比非合谋窃听更不利于多中继MF-NOMA无线系统的安全传输。

基于vORAM的前向和后向安全动态可搜索加密方案

为了解决将敏感数据加密存储在云平台所带来的关键字检索问题,引进vORAM提出新的前向和后向安全动态可搜索加密方案--FBDSE-Ⅰ方案。该方案利用茫然数据结构的历史独立性以及安全删除性,实现了关键词/文件标识符对的直接删除,在保证数据更新安全的同时,简化了动态更新过程。为了实现更加高效的查询操作,进一步提出方案FBDSE-Ⅱ,利用映射字典结构解耦茫然原语与检索结果,减少查询过程中对vORAM的访问次数。给出了形式化的安全证明,证明了FBDSE-Ⅰ和FBDSE-Ⅱ方案在保证前向安全的同时,分别满足Type-Ⅰ和Type-Ⅲ后向安全。仿真实验结果显示,相对于同等安全级别的前向和后向安全动态可搜索加密方案,FBDSE-I和FBDSE-Ⅱ方案具有更高的查询和更新效率,而且数据集合规模越大,优势越显著。

一个可证安全和前向安全的群盲签名方案

在公共资源的管理、重要情报的签发和电子现金系统中,群签名都发挥着重要作用。但是群签名效率不高,且无法保证信息的匿名性。为此,通过盲化信息和简化签名过程,提出一种基于中国剩余定理的、高效的、具有前向安全性的群盲签名方案,并在随机预言机模型下证明其安全性。该方案可以动态地增加或删除群成员而不需要频繁地改变其余群成员的密钥信息,仅需通过计算改变群公开信息。通过群成员私钥随时间更新,使方案具有前向安全性。对该方案进行效率分析,方案系统开销较小,签名长度较短,更适用于公开且低带宽的通信环境。

党的十八大以来我国社会保障制度的改革发展与前瞻

社会保障是治国安邦的大问题和中国式现代化的重大任务。党的十八大以来,我国社会保障制度在实践中不断创新探索和改革发展,形成了中国特色社会保障制度体系。面对前所未有的新挑战和长期以来存在的问题,社会保障制度改革发展要树立战略眼光并推动“破窗性”变革,确立新发展目标,厘清底层逻辑,理顺基本保障和福利性保障,重新划分各项社会保障角色,重构相关主体权责关系,更加注重系统集成,以制度建设为主线,在基本保障层之基础上,不断丰富福利性保障层的项目和内容,拓展高质量社会保障制度体系新境界。

基于格的身份基认证密钥交换协议

基于格理论密码体制已逐渐成为后量子领域的研究热点.身份基认证密钥交换协议在通信领域中应用广泛,具有很强的实用性.然而大多数格上构造的此类协议计算复杂度较大,并且没有实现完美前向安全性.本文基于环上带误差学习问题构造了一个格上基于身份的认证密钥交换协议.协议采用Peikert式误差协调机制实现密钥比特的均匀性,并且在系统初始化阶段不需要额外运算生成主公钥;此外,协议提供了双向认证、完美前向安全以及临时密钥泄露安全性.形式化的安全性分析和性能评估表明所提协议是安全且高效的.

基于SM2的强前向安全性两方共同签名方案

现存SM2数字签名研究已不能满足长期使用主私钥的安全。为更好保证成员私钥安全,结合两方共同签名与SM2算法,在现存方案的基础上加入强前向安全性,无可信中心,可避免可信中心权威欺诈与长期使用主私钥被窃取问题。该方案具有3个特点:前向安全性、后向安全性、无可信中心。方案需要两轮通信,线上两方各需要一次标量乘,保持高效率不变的同时,使得攻击者难以窃取成员密钥,更好保证成员长期使用密钥的安全性。