一种适用于基于身份的认证密钥协商的逆向防火墙协议  

A reverse firewall protocol for identity-based authenticated key agreement

作　　者：刘畅 王晋 田里 王捷 叶净宇 秦帆[3] 周雨阳 LIU Chang;WANG Jin;TIAN Li;WANG Jie;YE Jingyu;QIN Fan;ZHOU Yuyang(Energy Internet Technology Center,State Grid Hubei Electric Power Research Institute,Wuhan 430077,P.R.China;Government and Enterprise Department,Digital Guangxi Group,Nanning 530219,P.R.China;School of Big Data and Software Engineering,Chongqing University,Chongqing 400044,P.R.China;School of Computer Science and Engineering,University of Electronic Science and Technology of China,Chengdu 611731,P.R.China)

机构地区：[1]国网湖北省电力有限公司电力科学研究院能源互联网技术中心,武汉430077 [2]数字广西集团政企事业部,南宁530219 [3]重庆大学大数据与软件学院,重庆400044 [4]电子科技大学计算机科学与工程学院,成都611731

出　　处：《重庆大学学报》2022年第5期21-32,42,共13页Journal of Chongqing University

基　　金：四川省科学技术资助项目(2020JDRC0100)。

摘　　要：基于身份的认证密钥协商允许两方或者多方在不安全信道上建立安全的会话密钥。目前的认证密钥协商协议无法抵抗导致随机数泄露的后门攻击,比如已知特定于会话的临时攻击。基于此,我们设计了一种适用于基于身份的两方认证密钥协商的逆向防火墙协议。该协议在随机预言机模型下是安全的,能够抵抗强的临时会话秘密值泄露攻击,提供了消息抗泄露性。同时该协议不使用双线性对,节省了系统运行时间。最后,利用JPBC库实现了该协议。实验结果表明了该协议与同类型的协议相比,具有较小的带宽和较短的运行时间,十分适合应用于资源受限的系统中。Identity-based authenticated key agreement allows two or more parties to establish secure session keys over insecure channels.Current authenticated key agreement protocols are unable to resist the backdoor attacks that lead to random number disclosure,such as known session-specific temporary attack.Therefore,we propose a reverse firewall protocol for identity-based authenticated key agreement.The protocol is secure under the random oracle model.In addition,it can resist strong temporary session secret value leakage attack and can provide message leakage resistance.Meanwhile,the protocol saves the system’s running time because it does not use bilinear pairing.Finally,we implement the protocol using JPBC library.The experimental results show that the protocol has smaller bandwidth and shorter running time compared with other protocols of the same type.It is very suitable for resource-constrained systems.

关 键 词：基于身份密码体制 认证密钥协商 逆向防火墙 抗信息泄露 离散对数 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]