可证明安全的多信任域认证密钥协商协议  

Security-proved authenticated key agreement protocol for multi-domain

作　　者：朱辉[1] 李晖[1] 王育民[1] 

机构地区：[1]西安电子科技大学计算机网络与信息安全教育部重点实验室,陕西西安710071

出　　处：《华中科技大学学报（自然科学版）》2009年第5期53-56,共4页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(60772136;60803151);国家高技术研究发展计划资助项目(2007AA01Z435);高等学校学科创新引智计划资助项目(B08038)

摘　　要：为解决采用基于证书认证方式的网络用户与采用基于身份认证方式的网络用户之间相互认证的问题,利用对称加密、数字签名和消息认证码等技术,首先构造一个认证链路模型下会话密钥安全的认证协议,然后设计消息认证器把该协议转换成非认证链路模型下的会话密钥安全的认证协议,并对该协议的安全性进行了分析.分析表明,该协议实现了不同认证方式的信任域中用户间的认证、密钥协商以及密钥更新,并在Canetti-Krawczyk(CK)模型下满足安全属性需求.此外,该协议仅需4次通信即可完成,且扩展性好,为不同认证机制的网络用户间认证提供了一种较为实用的解决方案.Considered the especial requirements in multi-domain environment where the users used difference authentication frameworks in difference domains, with the the message authentication code, a new authentication protocol for the multi-domain was proposed. The security of the proposed protocol in the implementation plan with the Canetti-Krawczyk （CK） model was analyzed. Moreover, entity authentication for cross-domain was supported in the protocol. It is showed that the proposed protocol was secure and could achieve the security requirements. The implementation of the protocol was just four times communications and a little computation. It could be an efficient authentication method between the networks that use the difference authentication frameworks.

关 键 词：密码学 认证密钥协商 多信任域 对称加密 消息认证码 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]