基于OTP的移动商务身份认证协议设计与研究.docVIP

基于OTP的移动商务身份认证协议研究 王秦，张润彤 (北京交通大学信息系统研究所，北京) 摘要：安全问题已成为制约移动商务发展的瓶颈。身份认证是网络安全的第一道防线，安全、高效的移动商务身份认证协议是保证移动商务安全的必要条件。OTP认证技术实现简单、成本低、无须第三方认证的特点使其较适合移动商务的身份认证。椭圆曲线密码体制是现有公钥密码体制中运算效率、安全性最高且无须第三方的体制。本文基于OTP的认证思想，利用椭圆曲线密码体制实现数字签名和密钥协商，提出基于OTP的移动商务身份认证协议，设计其注册阶段、登陆阶段和同步重调阶段流程。形式化分析方法是分析认证协议存在安全漏洞的重要途径。串空间方法是现有认证协议形式化分析方法中最为直观、简洁、严格和有效的方法，利用串空间方法证明了基于OTP的移动商务身份认证协议的安全性。 关键字：移动商务；身份认证；OTP；椭圆曲线密码；IMEI；TP393.04 Research of Mobile Commerce Identity Authentication Protocol Based on OTP Wang Qin, Zhang Run-tong (Institute of Information System, Beijing Jiaotong University, Beijing , China) Abtract: The security has greatly limited development of mobile commerce. Identity authentication is the first defense line of network security, so a safety and effective identity authentication protocol is necessary to ensure mobile commerce. OTP(One-Time Password ) technology which is implemented simply, has low cost and needs no third authentication is more suitable for identity authentication in mobile commerce. Elliptic curve cryptography mechanism has the highest effectiveness and security, needs no third authentication among public-key cryptography mechanisms. Through improving the OTP technology, realizing signature and key agreement through elliptic curve cryptography mechanism, the identity authentication protocol is presented on basis of OTP, and its register, login and synchronous resetting procedure are designed. Formal analysis method is the main method to analyze security of authentication protocol and among them Strand Space method is simple, intuitive, strict and effective. The protocol is certificated to be secure through Strand Space method. Key words: Mobile commerce; identity authentication; OTP; Elliptic Curve Cryptography; IMEI; Strand Space 引言 在移动商务环境的安全机制中，身份认证处于核心地位，因为在缺乏对用户身份有效认证的前提下，用户信息的完整性和保密性没有任何意义可言[1]，因此，移动商务环境下身份认证的研究，对移动商务的安全体系，乃至对整个移动商务的推广与发展具有重大意义。 移动商务的身份认证需求 目前，移动商务的身份认证多基于GSM网络、短信息以及简单的用户静态口令认证，这些方法易受到攻击并且口令在无线传输中易被截获。非移动商务环境下的身份认证协议多采用基于公钥的认证体系，必须以完善的CA（C