一种物联网轻量级匿名认证协议的仿冒攻击  

An Impersonation Attack on Lightweight Anonymous Authentication Protocol for IoT

作　　者：姚海龙[1] YAO Hai-long(School of Information Engineering,Lanzhou City University,Lanzhou Gansu 730070)

机构地区：[1]兰州城市学院信息工程学院,甘肃兰州730070

出　　处：《甘肃高师学报》2023年第2期12-15,共4页Journal of Gansu Normal Colleges

基　　金：国家自然科学基金面上项目“面向网络安全的对抗机器学习研究”(61976142);兰州城市学院博士基金“面向物联网的基于ECC的轻量级认证与访问控制方案研究”(LZCU-BS2021-03);甘肃省高等学校科研项目“基于易采集生物特征的安全关系认证方案研究”(2022A-140).

摘　　要：面向物联网的轻量级匿名认证密钥交换方案大多基于对称密码设计,相比基于公钥密码的方案确实获得了更好的计算性能,但密码分析显示这类方案因远端设备自证能力差使得相互认证性脆弱,容易招致用户仿冒攻击和设备仿冒攻击.文章以Banerjee等人的方案为例,展示了攻击者在捕获任意远端设备后利用设备-网关的相互认证脆弱性仿冒任一用户欺骗该设备和仿冒任一远端设备欺骗相关用户的过程.Most of the lightweight anonymous authenticated key exchange schemes for the IoT are based on symmetric cryptography design,which has better computing performance than public-key cryptography-based schemes,but cryptoanalysis shows that such schemes make mutual authentication vulnerable due to the poor self-certification ability of remote devices,and even incurs user impersonation attack and device impersonation attack.Taking the scheme of Banerjee et al.as an example,this article demonstrates the process of an attacker using the mutual authentication vulnerability of the device-gateway to impersonate any user to spoof the device and impersonate any remote device to spoof the user after capturing any remote device.

关 键 词：认证密钥交换 仿冒攻击 用户仿冒 设备仿冒 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]