安全子网的双向认证访问控制研究
|
摘要
在开放的互联网络中，构建逻辑安全子网必须要实现三种安全机制：数据保密性机制、身份认证机制和访问控制机制。而安全的访问控制系统可以防止计算机系统中存储的信息受到非授权用户的破坏、篡改、泄漏和复制，任何访问控制系统都要对访问双方进行身份认证。因此，安全的带双向认证的访问控制机制已成为保证子网安全的核心，也是网络安全研究中的热点。
本文的目的是研究安全子网的双向身份认证和访问控制机制，及其实现方案。针对基于Harn数字签名双向认证访问控制实现方案中所存在的问题，运用密码技术改进了原方案的双向认证协议，并作为对原访问控制方案的改进，基于整数二进制表示的唯一性，提出了一种新的单钥-锁对访问控制方案。新的双向认证访问控制方案克服了原方案的缺陷。
本文主要包括三部分内容：
一. 理论概述。简要介绍了开放系统互连安全体系结构，叙述了本文研究所使用的现代密码学的关键技术。
二. 安全子网双向认证访问控制机制的研究。首先以“虚拟专用网络”（VPN）隧道模型和企业级安全子网结构模型为基础，提出安全子网的抽象模型，然后详细讨论了安全子网的双向认证访问控制机制。
三. 双向认证访问控制实现方案研究。详细分析了基于Harn数字签名的双向认证访问控制方案的安全漏洞，并对原方案做了改进。在第五章和第六章给出了本文的主要结果。
作为对原双向认证访问控制方案的改进，改进后的双向身份认证协议可以很好的抵抗中间人攻击和重放攻击，经过严密的BAN逻辑形式分析和论证，结果表明该协议是安全的；改进后的访问控制方案用单钥-锁对方案实现，除保持了一般单钥-锁对方案的良好动态特性外，在不需要访问权限递增假设下，实现了用户对文件的多种访问控制权限，并大大减小了溢出问题的发生可能
Under the open Internet environment, three security mechanisms, including data confidentiality, identity authentication, and access control mechanism, must be realize when constructing logic secure subnet. Access control can prevent data from being destroyed, altered, disclosed, or copied by unauthorized accesses. And every access control system needs to authenticate the identity of user. Secure access control mechanism is key technique that keeps security of subnet, and also the hotspot in the field of network security.
The aim of the thesis is to research identity authentication and access control mechanism of secure subnet, and realizeing scheme. To overcome the shortcoming of the double-way authentication access control scheme based on Harn's digital signature, a new double-way authentication protocol is proposed to improve the old one. A new single-key-lock-pair access control scheme is proposed as a improved access control scheme, based on the property that a integer can be denoted into only one binary digital.
This thesis is composed of three parts:
Firstly, summarize of theoretics. The security framework of open connecting systems is introduced in charpter one. Key technology of modem cryptology used in the thesis is described in charpter two.
Secondly, researchs of identity authentication and access control mechanism in secure subnet. An abstract model of secure subnet is put forward based on channel model of VPN and secure subnet model of enterprise in charpter three. And double-way authentication access control mechanism of secure subnet is analyzed in detail in charpte four.
Thirdly, researchs of the double-way authentication access control scheme. The insecurity of the double-way authentication access control scheme based on Harn's digital signature is analyzed in charpter five. A new scheme is proposed to improve the old one in charpter six.
An improved shceme for the old double-way authentication access control scheme based on Harn's digital signature is proposed. The new double-way authentication protocol of the improved access control scheme can prevent man-in-the-middle attack and replay attack. After strict formal analysis with BAN logic, the result have proved that the authentication protocol is secure. The improved access control scheme is realized by the mode of single-key-lock-pair. Under new access control scheme, user can own several kinds of access right upon one file under the new scheme without the supposition that the access rights is increase by degrees, and the possibility of overflow problem is significantly reduced by our new method
本文的目的是研究安全子网的双向身份认证和访问控制机制，及其实现方案。针对基于Harn数字签名双向认证访问控制实现方案中所存在的问题，运用密码技术改进了原方案的双向认证协议，并作为对原访问控制方案的改进，基于整数二进制表示的唯一性，提出了一种新的单钥-锁对访问控制方案。新的双向认证访问控制方案克服了原方案的缺陷。
本文主要包括三部分内容：
一. 理论概述。简要介绍了开放系统互连安全体系结构，叙述了本文研究所使用的现代密码学的关键技术。
二. 安全子网双向认证访问控制机制的研究。首先以“虚拟专用网络”（VPN）隧道模型和企业级安全子网结构模型为基础，提出安全子网的抽象模型，然后详细讨论了安全子网的双向认证访问控制机制。
三. 双向认证访问控制实现方案研究。详细分析了基于Harn数字签名的双向认证访问控制方案的安全漏洞，并对原方案做了改进。在第五章和第六章给出了本文的主要结果。
作为对原双向认证访问控制方案的改进，改进后的双向身份认证协议可以很好的抵抗中间人攻击和重放攻击，经过严密的BAN逻辑形式分析和论证，结果表明该协议是安全的；改进后的访问控制方案用单钥-锁对方案实现，除保持了一般单钥-锁对方案的良好动态特性外，在不需要访问权限递增假设下，实现了用户对文件的多种访问控制权限，并大大减小了溢出问题的发生可能
Under the open Internet environment, three security mechanisms, including data confidentiality, identity authentication, and access control mechanism, must be realize when constructing logic secure subnet. Access control can prevent data from being destroyed, altered, disclosed, or copied by unauthorized accesses. And every access control system needs to authenticate the identity of user. Secure access control mechanism is key technique that keeps security of subnet, and also the hotspot in the field of network security.
The aim of the thesis is to research identity authentication and access control mechanism of secure subnet, and realizeing scheme. To overcome the shortcoming of the double-way authentication access control scheme based on Harn's digital signature, a new double-way authentication protocol is proposed to improve the old one. A new single-key-lock-pair access control scheme is proposed as a improved access control scheme, based on the property that a integer can be denoted into only one binary digital.
This thesis is composed of three parts:
Firstly, summarize of theoretics. The security framework of open connecting systems is introduced in charpter one. Key technology of modem cryptology used in the thesis is described in charpter two.
Secondly, researchs of identity authentication and access control mechanism in secure subnet. An abstract model of secure subnet is put forward based on channel model of VPN and secure subnet model of enterprise in charpter three. And double-way authentication access control mechanism of secure subnet is analyzed in detail in charpte four.
Thirdly, researchs of the double-way authentication access control scheme. The insecurity of the double-way authentication access control scheme based on Harn's digital signature is analyzed in charpter five. A new scheme is proposed to improve the old one in charpter six.
An improved shceme for the old double-way authentication access control scheme based on Harn's digital signature is proposed. The new double-way authentication protocol of the improved access control scheme can prevent man-in-the-middle attack and replay attack. After strict formal analysis with BAN logic, the result have proved that the authentication protocol is secure. The improved access control scheme is realized by the mode of single-key-lock-pair. Under new access control scheme, user can own several kinds of access right upon one file under the new scheme without the supposition that the access rights is increase by degrees, and the possibility of overflow problem is significantly reduced by our new method
引文
1. Andrew S.Tanenbaum．COMPUTER NETWORK （熊桂喜，王小虎译）．北京：清华大学出版社，1998．368～419，497～512
2. 周明天，汪文勇.TCP/IP网络原理与技术．北京：清华大学出版社，1993，180～198，219～225
3. C.E.Shannon．Communication Theory of Secrecy Systems．Bell System Technical Journal，v.28，n.4，1949，pp.656-715
4. W.Diffie，and M.E.Hellman．New Directions in Cryptography．IEEE Transactions on Information Theory 22 (1976), pp 644-654.
5. B.Schneier．Applied Cryptography: Protocols, Algorithms, and Source Code in C．John Wiley & Sons, 1994.
6. R.L.Rivest，A.Shamir，and L.Adleman．A method for obtaining digital signatures and public key cryptosystems．Commun.of the ACM，21：120-126，1978
7. 戴宗坤，罗万伯，唐三平等．信息系统安全．北京：金城出版社，2000
8. 戴宗坤，唐三平．VPN与网络信息安全．北京：金城出版社，2000
9. NBS．Data Encryption Standard．FIPS PUB 46.National Bureau of Standards．
Washington，D.C.，Jan.1977
10. J.Daemen and V. Rijmen． AES Proposal: Rijndael．AES Algorithm Submission，
September 3，1999
11. NIST．Announcing the Advanced Encryption Standard (AES)． Federal Information Processing Standards Publication 197， November 26， 2001
12. E.Biham and A.Shamir．Power analysis of the key scheduling of AES candidates．NIST，USA
13. T.ElGamal．A public key cryptosystem and a signature scheme based on discrete logarithms．IEEE Transactions on Information Theory，31(1985)，pp.469-472
14. 冯登国，吴文玲．分组密码的设计与分析．北京：清华大学出版社，2000
15. B.M.Abadi and R.M.Needham．A logic of authentication．ACM Transaction on Computer Systems，February 1990， 8(1)：18~36
16. L.Harn．New digital signature scheme based on discrete Logarithm．Electronic Letters，1994，30(5)：396-398
周世斌，董占球．基于密码技术的网络安全方案．计算机工程与科学，2001，
17. Vol. 23，No. 6：30~46
18. 冯运波，林晓东，杨义先．网络访问控制．通信保密，1998，Vol. 2，No. 74：30~35
19. G.S.Graham and P.J.Denning．Protection-Principle and Practice．in Proc. AFTPS 1972 SJCC，Vol.40，pp.417-429
20. 施荣华．一种基于Harn数字签名的双向认证访问控制方案．计算机学报， 2001，24（4）：400-404．
21. M.L. Wu and T.Y.Hwang．Access control with single-key-lock．IEEE Trans. Software Eng.，Vol.10，no.2，pp.185-191，1984
22. C.-C.Chang．On the design of a key-lock-pair mechanism in information protection systems．BIT 26：410-417，1986
23. C.-C.Chang．An information protection scheme based upon number theory．Computer J. 30(3)：249-253，1987
24. C.-S.Laih，L. Harn， and J.-Y. Lee．On the design of a single-key-lock mechanism based on Newton's interpolating polynomial． IEEE Trans. Software Eng.，15(9)：1135-1137(1989)
25. J.-J.Hwang，B.-M.Shao，and P.-C.Wang．A new access control method using prime factorization．Computer J. 35(1)：16-20，1992
26. C.-C.Chang，D.-C.Lou，A binary access control method using prime factorization. Information Science，1997，96(1-2)：15-26
27. C.-C.Chang，J.-K.Jan．An access control scheme for new user and files．International Journal of Policy Information，1988，12(2)：89-98
28. J.Heinanen & G.Armitage．A Framework for IP Based Virtual Private Network．RFC 2674， February 2000
29. View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMPv3)． RFC 2574
30. ISO/IEC 1170-1，信息技术-安全技术-密钥管理-第一部分：框架．国家信息安全测评认证中心资料，1999
31. ISO/IEC 1170-2，信息技术-安全技术-密钥管理-第一部分：使用对称技术的机制．国家信息安全测评认证中心资料，1999
32. ISO/IEC 1170-3，信息技术-安全技术-密钥管理-第一部分：使用非对称技术的机制．国家信息安全测评认证中心资料，1999
2. 周明天，汪文勇.TCP/IP网络原理与技术．北京：清华大学出版社，1993，180～198，219～225
3. C.E.Shannon．Communication Theory of Secrecy Systems．Bell System Technical Journal，v.28，n.4，1949，pp.656-715
4. W.Diffie，and M.E.Hellman．New Directions in Cryptography．IEEE Transactions on Information Theory 22 (1976), pp 644-654.
5. B.Schneier．Applied Cryptography: Protocols, Algorithms, and Source Code in C．John Wiley & Sons, 1994.
6. R.L.Rivest，A.Shamir，and L.Adleman．A method for obtaining digital signatures and public key cryptosystems．Commun.of the ACM，21：120-126，1978
7. 戴宗坤，罗万伯，唐三平等．信息系统安全．北京：金城出版社，2000
8. 戴宗坤，唐三平．VPN与网络信息安全．北京：金城出版社，2000
9. NBS．Data Encryption Standard．FIPS PUB 46.National Bureau of Standards．
Washington，D.C.，Jan.1977
10. J.Daemen and V. Rijmen． AES Proposal: Rijndael．AES Algorithm Submission，
September 3，1999
11. NIST．Announcing the Advanced Encryption Standard (AES)． Federal Information Processing Standards Publication 197， November 26， 2001
12. E.Biham and A.Shamir．Power analysis of the key scheduling of AES candidates．NIST，USA
13. T.ElGamal．A public key cryptosystem and a signature scheme based on discrete logarithms．IEEE Transactions on Information Theory，31(1985)，pp.469-472
14. 冯登国，吴文玲．分组密码的设计与分析．北京：清华大学出版社，2000
15. B.M.Abadi and R.M.Needham．A logic of authentication．ACM Transaction on Computer Systems，February 1990， 8(1)：18~36
16. L.Harn．New digital signature scheme based on discrete Logarithm．Electronic Letters，1994，30(5)：396-398
周世斌，董占球．基于密码技术的网络安全方案．计算机工程与科学，2001，
17. Vol. 23，No. 6：30~46
18. 冯运波，林晓东，杨义先．网络访问控制．通信保密，1998，Vol. 2，No. 74：30~35
19. G.S.Graham and P.J.Denning．Protection-Principle and Practice．in Proc. AFTPS 1972 SJCC，Vol.40，pp.417-429
20. 施荣华．一种基于Harn数字签名的双向认证访问控制方案．计算机学报， 2001，24（4）：400-404．
21. M.L. Wu and T.Y.Hwang．Access control with single-key-lock．IEEE Trans. Software Eng.，Vol.10，no.2，pp.185-191，1984
22. C.-C.Chang．On the design of a key-lock-pair mechanism in information protection systems．BIT 26：410-417，1986
23. C.-C.Chang．An information protection scheme based upon number theory．Computer J. 30(3)：249-253，1987
24. C.-S.Laih，L. Harn， and J.-Y. Lee．On the design of a single-key-lock mechanism based on Newton's interpolating polynomial． IEEE Trans. Software Eng.，15(9)：1135-1137(1989)
25. J.-J.Hwang，B.-M.Shao，and P.-C.Wang．A new access control method using prime factorization．Computer J. 35(1)：16-20，1992
26. C.-C.Chang，D.-C.Lou，A binary access control method using prime factorization. Information Science，1997，96(1-2)：15-26
27. C.-C.Chang，J.-K.Jan．An access control scheme for new user and files．International Journal of Policy Information，1988，12(2)：89-98
28. J.Heinanen & G.Armitage．A Framework for IP Based Virtual Private Network．RFC 2674， February 2000
29. View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMPv3)． RFC 2574
30. ISO/IEC 1170-1，信息技术-安全技术-密钥管理-第一部分：框架．国家信息安全测评认证中心资料，1999
31. ISO/IEC 1170-2，信息技术-安全技术-密钥管理-第一部分：使用对称技术的机制．国家信息安全测评认证中心资料，1999
32. ISO/IEC 1170-3，信息技术-安全技术-密钥管理-第一部分：使用非对称技术的机制．国家信息安全测评认证中心资料，1999