对两个基于智能卡的多服务器身份认证方案的密码学分析与改进.docx

第PAGE\*MERGEFORMAT18页共NUMPAGES\*MERGEFORMAT18页对两个基于智能卡的多效劳器身份认证方案的密码学分析与改进摘要：身份认证是用户访问网络资源时的一个重要平安问题。近来，Xu等（XUC，JIAZ，WENF，etal.CryptanalysisandimprovementofadynamicIDbasedremoteuserauthenticationschemeusingsmartcards[J].JournalofComputationalInformationSystems，，9（14）：55135520）提出了一个基于智能卡的动态身份用户认证方案。分析指出其方案不能抵抗中间人攻击和会话密钥泄露攻击，且无法实现会话密钥前向平安性。此外，指出Choi等（CHOIY，NAMJ，LEED，etal.Securityenhancedanonymousmultiserverauthenticatedkeyagreementschemeusingsmartcardsandbiometrics[J].TheScientificWorldJournal，，：281305）提出的基于智能卡和生物特征的匿名多效劳器身份认证方案（简称CNL方案）易遭受智能卡丧失攻击、效劳器模仿攻击，且不能提保护用户的匿名性。最后，基于生物特征和扩展混沌映射，提出了一个平安的多效劳器认证方案，平安分析结果说明，新方案消除了Xu方案和CNL方案的平安漏洞。关键词：多效劳器；认证；中间人攻击；前向平安；匿名中图分类号：TP393.08文献标志码：ACryptanalysisandimprovementoftwomultiserverremoteuserauthenticationschemesusingsmartcardsQUJuan1*，LIYanping2，WUXili11.CollegeofMathematicsandStatistics，ChongqingThreeGorgesUniversity，Chongqing404000，China2.CollegeofMathematicsandInformationScience，ShaanxiNormalUniversity，XianShaanxi710062，ChinaAbstract：Userauthenticationisanimportantsecurityissuewhenuseraccessresourcesfromnetwork.Recently，Xuetal.（XUC，JIAZ，WENF，etal.CryptanalysisandimprovementofadynamicIDbasedremoteuserauthenticationschemeusingsmartcards[J].JournalofComputationalInformationSystems，，9（14）：55135520）proposedadynamicIDbasedremoteuserauthenticationschemeusingsmartcards.Thoughtherigoroussecurityanalysis，itwasfoundthatXuschemecouldnotresistmaninthemiddleattackandsessionkeydisclosureattack，andcouldnotprovideperfectforwardsecrecyforsessionkey.Additionally，itwasalsodemonstratedthattheschemeproposedbyChoietal.（CHOIY，NAMJ，LEED，etal.Securityenhancedanonymousmultiserverauthenticatedkeyagreementschemeusingsmartcardsandbiometrics[J].TheScientificWorldJournal，，：281305）wasvulnerabletosmartcardlossattack，serverspoofingattack，andcouldnotprovideuseranonymity.Therefore，thesetwoschemescouldnotbesuitableforpracticalapplications.Atlast，animprovedschemewasproposedbasedonbiometricsandextendedchaoticmapstoovercomethelackofXuschemeandCNLscheme.Keywords