摘要： 针对基于无证书的身份认证方案无法满足跨域匿名认证需求的不足,利用双线性映射提出一种云环境下的跨域身份认证方案。基于无证书签名的合法性和消息的有效性,实现用户与云服务提供商的身份真实性鉴别,并在双向跨域认证过程中完成会话密钥的协商。引入分层ID树结构确保身份的唯一性,“口令+密钥”的双因子认证过程增强跨域身份认证方案的安全性。利用临时身份实现用户身份的匿名性,对用户的恶意匿名行为具有可控性。分析结果表明,该认证方案在CK模型中是安全的,并能抵抗伪造、重放与替换攻击,具有较高的安全性。

关键词: 云计算, 跨域, 无证书签名, 身份认证, CK模型, 匿名性

Abstract: In view of the shortcoming of failure in cross-domain anonymous authentication scheme based on certificateless public key cryptography,a cross-domain authentication scheme in cloud environment is proposed by using bilinear mapping.On the basis of the validity of certificateless signature and the legitimacy of the message,the proposed scheme can identify the authenticity of user and cloud service provider,and the negotiation of the session key is completed in the bidirectional cross-domain authentication process.Furthermore,the introduction of hierarchical ID tree structure ensures the uniqueness of identity,and the two-factor authentication process of "password + key" strengthens the security of the cross-domain authentication scheme.The scheme realizes the anonymity of user identity by using temporary identity and has controllability for anonymous malicious behavior.Analysis results show that the proposed scheme is secure in CK model,it can resist forgery attacks,replay attacks and replace attacks,and has higher safety performance.

Key words: cloud computing, cross-domain, certificateless signature, identity authentication, CK model, anonymity

中图分类号: 

• TP391