Transcript 下載/瀏覽Download

A Secure Authentication Scheme
with Anonymity for Wireless
Communications
IEEE COMMUNICATIONS LETTERS,
VOL. 12, NO. 10, OCTOBER 2008
Chia-Chun Wu, Wei-Bin Lee, and Woei-Jiunn Tsaur
Speaker : Hong Ji Wei
Outline
1.
2.
3.
4.
5.
Introduction
Review of Lee,Hwang And Liao’s Scheme
Improved Scheme
Security Analysis
Conclusion
1.Introduction
What is Anonymity meaning ?
Communication
User
Intercept
Hacker
Server
2.Review of Lee,Hwang And Liao’s
Scheme
Internet
R1
HA
Home Network
Other Subnet
R3
R2
FA
Visited Network
MU
Their scheme can be divided into three phases
1. Initial Phase
HA delivers a password and a smart card for MU through
a secure channel
2.
First Phase
FA authenticates to MU and establishes a session key
3.
Second Phase
MU visits FA , and FA serves for MU
Symbols
E PA : Public key of A
MU : Mobile User
HA : Home Agent of a mobile user
ESA : Private key of A
:FA : Foreign Agent of the network
IDA: Identity of A
TA : Timestamp of A
CertA : Certificate of A
(X)K : Symmetric Encryption
EK(X) : Asymmetric Encryption
h(X) : Hash X using hash function
PWA : Password of A
Initial Phase
MU
IDMU
Registration
PWMU , r , IDHA , h(.)
Secure Channel
HA
PWMU=h(N||IDMU)
r  h( N || IDMU )  h( N || IDHA )
 IDHA  IDMU
First Phase
MU
FA
HA
n,(h( IDMU ) || x0 || x) L , IDHA , TMU
n  r  PWMU
b, n,(h( IDMU ) || x0 || x)) L , TMU , CertFA , TFA
ESFA (h(b, n,(h( IDMU ) || x0 || x) L , TMU , CertFA ))
L  h(TMU  PWMU )
h( N || IDHA )  n  IDHA  IDMU
h( IDMU )
L  h(TMU  h( N || IDMU ))
W  EPFA (h( IDMU ) || x0 || x))
(TCertMU || h( x0 || x))k
c,W , ESHA (h(b, c, EPFA (h(W ), CertHA ))), CertHA , THA
FA decrypts W using ESFA
k  h( IDMU || x)  x0
k  h( IDMU || x)  x0
h( x0 || x )
TCertMU ,( x0 || TCertMU || OtherInformations )k
Authentication
h( x0 || x )
Second Phase
In order to enhance the efficiency, while MU stays with
the same FA, the new session key ki can be derived from the
unexpired previous secret knowledge xi−1 and a fixed secret x
as
ki  h( IDMU || x)  xi 1 for i  1, 2,3,..., n
MU
TCertMU ,( xi || TCertMU || OtherInformations)k i
FA
Authentication
k1  h( IDMU || x )  x0
( x1 || TCertMU || OtherInformations )k 1
k2  h( IDMU || x )  x1
( x2 || TCertMU || OtherInformations )k 2
Weakness
1.Anonymity
From Step 3 of the first phase , it is obvious that FA
can obtain the parameter W from HA, and then decrypt it
to obtain h(IDMU). In general, a user’s identity is short and
has a certain format. That is, FA can launch an off-line
guessing attack to find out the real identity of MU, and
therefore defeat the anonymity service.
2.Backward secrecy
In Lee et al.’s scheme , if the session keys ki−1and ki are
known, xi−1and xi can be computed from
and
(xi−1||TCertMU||OtherInformation)ki−1
(xi||TCertMU||OtherInformation)ki
Then the secret h(IDMU||x) can be derived without any problem
from
ki = h(IDMU||x) ⊕ xi−1
Consequently, the next session key
ki+1 = h(IDMU||x) ⊕ xi
It can be easily computed
3.Improved Scheme
Because the original received value h(IDMU) can be used as an
evidence to assure whether the guessed identity is correct, this value
needs to be modified in a way to make it un-comparable.
To do so, we set W =EPFA(h(h(N||IDMU))||x0||x) instead of
old one in Step 3 of the first phase. Moreover, in order to accomplish
the backward secrecy, the corresponding session key ki will be
ki = h(h(h(N||IDMU))||x||xi−1)
= h(h(PWMU)||x||xi−1)
First Phase
MU
FA
HA
n,(h( IDMU ) || x0 || x) L , IDHA , TMU
n  r  PWMU
b, n,(h( IDMU ) || x0 || x)) L , TMU , CertFA , TFA
ESFA (h(b, n,(h( IDMU ) || x0 || x) L , TMU , CertFA ))
L  h(TMU  PWMU )
h ( N || IDHA )  n  IDHA  IDMU
h( IDMU )
L  h(TMU  h( N || IDMU ))
W  EPFA (h( IDMU ) || x0 || x))
(TCertMU || h( x0 || x))k
k  h( IDMU || x)  x0
h( x0 || x ) k  h(h(h( N || IDMU )) || x0 ||x)
TCertMU ,( x0 || TCertMU || OtherInformations )k
Authentication
c,W , ESHA (h(b, c, EPFA (h(W ), CertHA ))), CertHA , THA
W  EPFA (h(h( N || IDMU )) || x0 || x))
FA decrypts W using ESFA
k  h( IDMU || x)  x0
h( x0 || x ) k  h(h(h( N || IDMU )) || x0 ||x)
Second Phase
MU
TCertMU ,( xi || TCertMU || OtherInformations)k i
FA
Authentication
ki  h(h(h( N || IDMU )) || x || xi 1 )
k1  h ( h ( h ( N || IDMU )) || x || x0 )
( x1 || TCertMU || OtherInformations ) k 1
k2  h (h (h ( N || IDMU )) || x || x1 )
( x2 || TCertMU || OtherInformations ) k 2
4.Security Analysis
1. Our improved scheme can achieve anonymity
FA obtains h(h(N||IDMU))instead of h(IDMU).Therefore, FA has
no way of verifying whether the guessed identity is correct or not
without the secret value N. Besides, deriving the h(N||IDMU) from
h(h(N||IDMU)) is also intractable if h(.) is a secure hash function
such as SHA-256.
2.Our improved scheme can achieve backward secrecy
If an attacker knows the session keys ki-1 and ki then xi-1 will be
obtained. Attacker can try to compute h(PWMU)||x from
ki  h(h( PWMU ) || x || xi 1 )
using xi-1 , but he/she still not know the IDMU
5.Conclusion
In this paper , we discuss the properties of anonym
ity and backward secrecy in the authentication scheme
for wireless communications.
We use a very simple way to solve the security issues in the previous scheme.