摘要
针对已有隐藏签名认证方案中,由于用户证书完全由CA签发,CA很容易获取用户向服务提供商请求的服务这一安全漏洞,提出一种新的改进方案.该方案仍然采用单CA模式,且分2个阶段执行:a.证书申请阶段,同已有方案不同的是CA为用户签发部分证书,最终证书是通过增加用户秘密值产生;b.服务请求阶段,用户通过计算证书承诺向服务提供商请求服务,该阶段即使CA(或其他攻击者)能正确地猜测出用户的最终证书,要想正确地计算出用户的证书承诺,须要求解离散对数困难问题.本方案不仅解决了已有方案的安全问题,且与同类改进方案相比,其安全性和效率都有明显的提高.
As user′s certification issues by the only certificate authority（CA）,the existing scheme can not prevent CA to get the user′s services from a service provider.An improved scheme was presented.In that scheme,it was still the single CA model and the two stages.Certificate application stage： different with the existing scheme,CA issued the part certificate for the users and the final certificate was generated by adding its own private information.Service request phase： a user requested service to a service provider by calculating the certificate commitment,in the stage,even though CA（or other attackers） could guess correctly the final user certificate,they needed to solve the discrete logarithm problem in order to calculate the user＇s certificate commitment.This new scheme solves the existing scheme security problem and its safety and efficiency have also improved significantly compared with the similar scheme.
出处
《华中科技大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2011年第10期61-63,68,共4页
Journal of Huazhong University of Science and Technology(Natural Science Edition)
基金
国家重点基础研究发展计划资助项目(2007CB311100)
关键词
隐藏签名认证
基于身份的密码体制
认证机构
数字签名
双线性对
身份认证
signature-masked authentication
ID-based cryptography
certificate authority
digital signature
bilinear pairings
authentication
