The gap between intractable problem and adaptive chosen ciphertext security

To describe the design approaches of IND-CCA2 (adaptive chosen ciphertext attack) secure public key encryption schemes systematically, the gaps between different kinds of intractable problems and IND-CCA2 security are studied. This paper points out that the construction of IND-CCA2 secure schemes is essentially to bridge these gaps. These gaps are categorized, analyzed and measured. Finally the methods to bridge these gaps are described. This explains the existing design approaches and gives an intuition about the difficulty of designing IND-CCA2 secure public key encryption schemes based on different types of assumptions.     

Directed proxy signature in the standard model

A directed signature is a type of signature with restricted verification ability. Directed signatures allow only a designated verifier to check the validity of the signature issued to him, and at the time of trouble or if necessary, any third party can verify the signature with the help of the signer or the designated verifier. Directed signature schemes are widely used in situations where the receiver’s privacy should be protected. Proxy signatures allow an entity to delegate its signing capability to another entity in such a way that the latter can sign message on behalf of the former when the former is not available. Proxy signature schemes have found numerous practical applications such as distributed systems and mobile agent applications. In this paper, we firstly define the notion of the directed proxy signature by combining the proxy signature and directed signature. Then, we formalize its security model and present a concrete scheme in the standard model. Finally, we use the techniques from provable security to show that the proposed scheme is unforgeable under the gap Diffie-Hellman assumption, and invisible under the decisional Diffie-Hellman assumption.     

基于博弈论的公平安全两方计算协议

针对传统安全两方计算无法实现完全公平性的问题,结合博弈论方法,将参与者看作是理性的,提出了理性安全两方计算协议。首先,在扩展式博弈框架下,给出安全两方计算的博弈模型;其次,根据博弈模型描述,给出理性安全两方计算理想函数FRPCP以及理性安全两方计算协议RPCP;最后对协议的安全性、公平性及纳什均衡进行了分析。分析结果表明,在混合模型下,协议RPCP能安全地实现理想函数FRPCP,并且在BDH困难假设下,协议RPCP中各理性参与者的最佳策略是选择合作,当博弈达到纳什均衡时,参与者双方能公平地获得计算结果。      

Identity-based verifiably committed signature scheme without random oracles

An identity-based verifiably committed signature scheme （IB-VCS） was proposed, which is proved secure in the standard model （i.e., without random oracles）. It enjoys the setup-free property and stand-alone property, both of which make an exchange protocol more practical. The scheme is unconditionally secure against the cheating signer, its security against the cheating verifier is reduced to the computational Diffie-Hellman （CDH） problem in the underlying group, it is secure against the cheating trusted third party if the underlying Paterson Schuldt＇s identity based signature （IBS） scheme is secure, which is proven true based on the CDH assumption in the standard model.     

基于Pairing抗选择密文攻击的新门限密码体制

为提高Baek-Zheng方案的解密效率,用逆运算代替Baek-Zheng方案中所用的点乘运算设计验证过程.由于验证过程只需1次Pairing操作,故在保持Baek-Zheng方案的加密速度以及密文和解密碎片的长度的前提下,新方案将每个门限解密参与者的效率提高了近1倍.新方案在O rac le D iffie-Hellm an假设下被证明可以抗选择密文攻击.     

一种基于历史的密文检索排序方案

为了解决密文检索实际应用过程中,存在的安全性问题、检索效率低下及检索结果存在冗余,对用户的需求针对性不强等问题,通过对现有的密文检索进行分析与研究.提出改进的密文索引构建策略,提出基于历史的密文检索结果排序方案,设计并实现密文检索原型系统,在保证密文检索安全和检索效率的同时,使检索的结果更加符合用户的需求.     

Efficient and provably-secure certificateless proxy re-encryption scheme for secure cloud data sharing

In current cloud computing system, large amounts of sensitive data are shared to other cloud users. To keep these data confidentiality, data owners should encrypt their data before outsourcing. We choose proxy reencryption （PRE） as the cloud data encryption technique. In a PRE system, a semi-trusted proxy can transform a ciphertext under one public key into a ciphertext of the same message under another public key, but the proxy cannot gain any information about the message. In this paper, we propose a certificateless PRE （CL-PRE） scheme without pairings. The security of the proposed scheme can be proved to be equivalent to the computational Dire- Hellman （CDH） problem in the random oracle model. Compared with other existing CL-PRE schemes, our scheme requires less computation cost and is significantly more efficient. The new scheme does not need the public key certificates to guarantee validity of public keys and solves the key escrow problem in identity-based public key cryptography.     

ID-Based Threshold Decryption Secure Against Chosen Plaintext Attack

Introduction Inthresholddecryptioncryptosystems,the powertodecryptissharedamongasetofdecryp-tionservers.In2001,D.BonehandM.Franklin proposedapracticalidentity-basedencryption(IBE)schemefromtheweilpairing.Combining thetwoconceptstogether,some“ID-basedthresh-olddecryption”schemeshavebeenconstructed.In suchschemes,anentity'spublickeyisderiveddi-rectlyfromitsidentity.Atrustedthirdparty calledtheprivatekeygenerator(PKG)usesthe masterkeytogenerateprivatekeysforallentities.Eachdecryptionserve…     

Democratic group signatures with linkability from gap Diffie-Hellman group

Democratic group signatures(DGSs) attract many researchers due to their appealing properties, i.e., anonymity, traceability and no group manager.Security results of existing work are based on decisional Diffie-Hellman(DDH) assumption.In this paper, we present a democratic group signature scheme based on any gap Diffie-Hellman(GDH) group where DDH problem is easily but computational Diffie-Hellman(CDH) problem is hard to be solved.Besides the properties of ordinary DGSs, our scheme also provides the property of linkability, i.e., any public verifier can tell whether two group signatures are generated using the same private key.Security properties of our scheme employ a new and independently interesting decisional product Diffie-Hellman(DPDH) assumption which is weaker than DDH one.     

基于自更新哈希链的安全高效车-地鉴权方案

针对下一代高速铁路无线通信系统LTE-R （long term evolution-railway）对安全性和实时性的特殊需求，基于哈希链技术，提出一种完全基于对称密码体制的的车-地通信鉴权方案. 用户归属服务器（home subscriber sever，HSS）利用身份授权主密钥为车载设备（on-board unit，OBU）生成动态可变的匿名身份（temporary identity，TID），以在接入认证请求信令中保护车载设备的隐私，同时能够抵挡去同步攻击. 在列车高速移动过程中，方案采用高效的哈希链代替认证向量完成列车和服务网络之间的双向认证，哈希链的本地更新可解决认证向量耗尽导致的全认证重启问题. 此外，通过引入身份证明票据实现基于基站协同的高效无缝切换认证. 安全性和性能分析表明:在同样条件下，所提出的全认证协议、重认证协议和切换认证协议与目前性能最优的LTE （long term evolution）标准协议相比，计算量分别下降41.67%、44.44%和45.45%，通信量分别下降62.11%、50.91%和84.91%，能够满足LTE-R接入网络的安全性和实时性要求.      

Keyword search encryption scheme resistant against keyword-guessing attack by the untrusted server

The user data stored in an untrusted server, such as the centralized data center or cloud computing server, may be dangerous of eavesdropping if the data format is a plaintext. However, the general ciphertext is difficult to search and thus limited for practical usage. The keyword search encryption is a helpful mechanism that provides a searchable ciphertext for some predefined keywords. The previous studies failed to consider the attack from the data storage server to guess the keyword. This kind of attack may cause some critical information revealed to the untrusted server. This paper proposes a new keyword search encryption model that can effectively resist the keyword-guessing attack performed by the untrusted data storage （testing） server. The testing （query） secret is divided into multiple shares so that the security can be guaranteed if the servers cannot conspire with each other to retrieve all shares of the secret.     

A secure trust model for P2P systems based on trusted computing

Trust is one of the most important security requirements in the design and implementation of peer-to-peer （P2P） systems. In an environment where peers＇ identity privacy is important, it may conflict with trustworthiness that is based on the knowledge related to the peer＇s identity, while identity privacy is usually achieved by hiding such knowledge. A trust model based on trusted computing （TC） technology was proposed to enhance the identity privacy of peers during the trustworthiness evaluation process between peers from different groups. The simulation results show that, the model can be implemented in an efficient way, and when the degree of anonymity within group （DAWG） is up to 0.6 and the percentage of malicious peers is up to 70%7 the service selection failure rate is less than 0.15.     

Identity-based broadcast encryption with shorter transmissions

This paper describes two identity-based broadcast encryption(IBBE) schemes for mobile ad hoc networks.The first scheme proposed achieves sub-linear size cipertexts and the second scheme achieves O(1)-size ciphertexts.Furthermore, when the public keys are transmitted, the two schemes have short transmissions and achieve O(1) user storage cost, which are important for a mobile ad hoc network.Finally, the proposed schemes are provable security under the decision generalized bilinear Di?-Hellman(GBDH) assumption in the random oracles model.     

Intrusion detection model with twin support vector machines

Intrusion detection system （IDS） is becoming a critical component of network security. However, the performance of many proposed intelligent intrusion detection models is still not competent to be applied to real network security. This paper aims to explore a novel and effective approach to significantly improve the performance of IDS. An intrusion detection model with twin support vector machines （TWSVMs） is proposed. In this model, an etficient algorithm is also proposed to determine the parameter of TWSVMs. The performance of the proposed intrusion detection model is evaluated with KDD＇99 dataset and is compared with those of some recent intrusion detection models. The results demonstrate that the proposed intrusion detection model achieves remarkable improvement in intrusion detection rate and more balanced performance on each type of attacks. Moreover, TWSVMs consume much less training time than standard support vector machines （SVMs）.     

One construction of chameleon all-but-one trapdoor functions

Chameleon all-but-one trapdoor functions （ABO-TDFs） were introduced by Lai et al. An important component of the existing constructions of chameleon ABO-TDFs based on the decisional Diffie-Hellman （DDH） assumption was the chameleon hash functions. In this paper, we instantiate the first chameleon ABO-TDFs based on DDH free of chameleon hash functions.     

Identity-based Encryption with Non-Interactive Opening

An identity-based encryption(IBE) was studied with non-interactively opening property that the plain text of a ciphertext can be revealed without affecting the security of the encryption system.Two kinds of non-interactive opening properties for IBE schemes were defined along with a concrete scheme in each case.     

Identity-based key-insulated proxy signature without random oracles

In an identity based proxy signature (IBPS) scheme, a designated proxy signer can generate the signature on behalf of an original signer. Traditional IBPS schemes normally rely on the assumption that private keys are kept perfectly secure. However, due to viruses, worms or other break-ins allowed by operating-system holes, key exposure seems inevitable. To minimize the damage caused by key exposure in IBPS, we propose an identity-based key-insulated proxy signature (IBKIPS) scheme in the standard model, i.e. without random oracles.     

一体化标识网络中的用户身份认证协议

一体化标识网络解决了传统网络中IP地址二义性问题,是一种基于网络的身份与位置分离体系.本文在一体化标识网络中提出一种用户身份认证协议,基于该协议设计了一种利用数字证书构建的接入标识.这种接入标识唯一的表示一体化标识网络中的终端,实现用户身份信息与终端的绑定.该用户身份认证协议基于Diffie-Hellman密钥交换完成用户到用户真实身份的双向认证,采用谜题机制和无认证状态防止应答方受到DoS攻击.通过C-K安全模型分析用户身份认证协议的安全性,分析表明该协议是会话密钥安全的.     

Provably Secure Short Proxy Signature Scheme from Bilinear Maps

An enhanced formal model of security for proxy signature schemes is presented and a provably secure short proxy signature scheme is proposed from bilinear maps. The proposed proxy signature scheme is based on two short secure signature schemes. One is used for delegating the signing rights and computing the standard signature; the other is used for computing proxy signature. Finally, a security proof of the proposed proxy signature scheme is showed by reducing tightly the security of the proposed proxy signature scheme to the security of the two basic signature schemes. The proposed proxy signature scheme has the shortest ordinary signatures and proxy signatures. Moreover, the proxy signature generation needs no pairing operation and verification needs just two pairing operation.     

基于混沌系统和DNA编码的量子图像加密算法

为了确保量子信息的安全,结合混沌系统和DNA编码理论,提出了一种基于混沌系统和DNA编码的量子图像加密算法. 首先将图像进行量子编码;然后利用Logistic混沌产生幺正矩阵对量子图像进行置乱;再利用Lorenz混沌产生自然DNA矩阵并且动态选择DNA加法操作进行DNA运算,计算后得到幺正矩阵对量子图像再次加密;最后对量子图像进行测量得到经典密文图像. 通过仿真实验和直方图、相关性、NPCR （number of pixel change rate）像素改变率等指标分析,结果表明加密后的图像灰度分布均匀,各灰度级均分布于在1 000左右,相邻像素相关性更低,相关系数平均值0.002,NPCR像素改变率为99.6%,加密效果好且具有良好的安全性.