摘要:近年来，为保护用户的隐私安全性，大量适用于全球移动网络环境的匿名漫游认证协议相继被提出.其中，部分协议采用临时身份代替真实身份的方法实现漫游过程中用户身份的匿名性需求，然而临时身份的重复使用，在一定程度上增加了用户的存储负担；部分协议采用身份更新的方法实现临时身份的一次一变性，但是相关信息的存储及更新操作，导致协议的执行效率较低.针对上述不足，提出模糊的直接匿名漫游认证协议.无需家乡代理的协助，通过1轮消息交互，外部代理即可直接完成对移动用户的身份合法性验证.同时，无需更新操作，即可实现漫游过程中临时身份的一次一变性.该机制在实现身份合法性匿名认证的同时，提高了协议的存储和执行效率，并且降低了通信时延.安全性证明表明，该协议在Canetti-Krawczyk（CK）安全模型下可证明是安全的.相较于传统漫游认证协议而言，该协议在存储、通信和计算等方面具有更优的性能，更适用于全球移动网络.



Abstract:To provide secure roaming services for mobile users in global mobility networks, many anonymous authentication protocols have been proposed in recent years. But most of them focus only on authentication and fail to satisfy many practical security requirements. In order to achieve anonymity, the traditional anonymous roaming protocols depend on a temporary identity instead of real identity. However, these schemes have storage, communication and computing overheads due to the update operations. To overcome the shortcomings mentioned above, this paper proposes a fuzzy direct anonymous roaming mechanism for global mobility networks, in which the roaming users can fulfill the legitimacy authentication of their identity through one round message exchange with FA. This mechanism not only achieves the legitimate authentication of anonymous identity through fuzzy identity, but also avoids the update operations to get the property of "one at a time" of temporary identity in the process of roaming. Additionally, a security proof shows that this mechanism is provably secure in the CK security model. Moreover, comparative analysis shows that the presented proposal has stronger security, achieves stronger anonymity, and has lower storage, communication and computing overheads. Compared with the traditional anonymous roaming mechanism, the mechanism proposed in this paper is more suitable for the global mobility networks.



PDF全文下载地址:

http://jos.org.cn/jos/article/pdf/5302