基于身份的跨域直接匿名认证机制  

Direct anonymous authentication scheme in cross-domain based on identity

作　　者：周彦伟[1,2] 杨波[2] 吴振强[1,2] 何聚厚[1,2] 李骏[1] 

机构地区：[1]现代教学技术教育部重点实验室,西安710062 [2]陕西师范大学计算机科学学院,西安710062

出　　处：《中国科学：信息科学》2014年第9期1102-1120,共19页Scientia Sinica(Informationis)

基　　金：国家自然科学基金(批准号:61173190;61272436;61272404);广东省自然科学基金(批准号:10351806001000000);陕西省自然科学基础研究计划(批准号:2012JQ8023)资助项目

摘　　要：针对现有DAA方案存在计算开销大和无法满足跨域匿名认证需求的不足,本文提出基于身份的直接匿名认证机制,采用代理签名和直接匿名证明技术实现移动互联网下可信移动平台(TMP)的跨域匿名认证;验证者基于签名的合法性完成对TMP平台的真实性鉴别,并在认证过程中协商了会话密钥,增强了跨域证明系统的安全性;同时基于CK模型的安全性证明表明本文机制是可证安全的.分析显示,本文机制具有匿名性、无关联性和高性能等性质的同时,能够抵抗平台的伪装攻击、替换攻击和重放攻击等敌手攻击行为,其性能更适用于移动互联网等无线网络环境.In view of the shortcomings of high computational overhead and failure in cross-domain anonymous authentication existed in TCG DAA program, this paper proposes a cross-domain direct anonymous attestation scheme based on identity, in which the proxy signature and direct anonymous attestation technology are employed for the trusted mobile platform （TMP） in mobile Internet. On the base of the legitimacy of the DAA signature, the verifier of remote domain identifies the authenticity of TMP, during which the remote attestation system is security-enhanced by a key agreement. Analyzed in Canetti-Krawczyk （CK） model, this authentication scheme is anonymous, unrelated and high-performance. We demonstrate that it can resist masquerade attacks, reply attacks and platform substitution attacks. It is effective and more suitable for the mobile Internet and other wireless networks.

关 键 词：直接匿名认证 移动可信模块 可信移动平台 跨域 身份隐私 CK安全模型 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]