基于密钥超图和身份密码的多域光网络密钥管理方案

发布时间：2018-06-25 21:21

本文选题：多域光网络 + 密钥管理　；参考：《工程科学与技术》2017年05期

【摘要】：针对分层PCE架构下多域光网络的特点及其密钥管理需求,提出一种新型的基于密钥超图和身份密码的密钥管理方案(简称为KMS-KI)。与基于逻辑密钥树的经典分散式密钥管理方案不同,该方案首先将多域光网络的密钥关系建模成两层密钥超图,即用点表示顶点,用超边描述各层级密钥关系,使网络的密钥层次关系能够更好地反映在密钥超图模型中;然后使用基于分层的身份密码系统和改进的私钥生成策略分别完成主密钥、公私钥、会话密钥、层组密钥、域间密钥的生成和动态管理,较好地解决了私钥的安全保护和私钥生成中心存在的单点失效问题。同时,通过融合成员特征值思想,当群组成员加入或离开时,剩余群组成员利用pPCE或者cPCE传递的密钥特征值自行计算和更新组密钥,大大降低了新的组密钥被敌手破获的风险。通过分析表明,KMS-KI方案具备前向安全性、后向安全性、私钥保密性和抗共谋攻击能力,与典型的基于逻辑密钥树的分散式方案相比,不但支持分层身份密码系统,且在密钥存储量、cPCE通信量和加解密次数等方面取得了综合较优的性能。
[Abstract]:A new key management scheme based on key hypergraph and identity cipher (KMS-KI) is proposed for multi-domain optical networks based on hierarchical PCE architecture and its key management requirements. Different from the classical decentralized key management scheme based on logical key tree, the key relation of multi-domain optical network is modeled as a two-layer key hypergraph, namely, the vertex is represented by a point and the key relationship of each level is described by a super-edge. The key hierarchy of the network can be better reflected in the key hypergraph model, and then the master key, the public key, the session key and the layer group key are completed by using the hierarchical identity cryptosystem and the improved private key generation strategy, respectively. The generation and dynamic management of inter-domain keys solve the problem of the security protection of private keys and the single point failure of private key generation centers. At the same time, by integrating the member eigenvalue idea, when the group members join or leave, the remaining group members use the key eigenvalues transmitted by pPCE or cPCE to calculate and update the group key by themselves, which greatly reduces the risk of the new group key being broken by the enemy. The analysis shows that the KMS-KI scheme has the ability of forward security, backward security, privacy of private key and ability of resisting collusion attack. Compared with the typical decentralized scheme based on logical key tree, it not only supports hierarchical identity cryptosystem. Moreover, the performance of key storage and encryption and decryption are optimized.
【作者单位】：武警工程大学信息工程系;
【基金】：国家自然科学基金资助项目(61402529;61402147;61402531) 陕西省自然科学基金研究计划资助项目(2015JQ6266)
【分类号】：TN918.4;TN929.1

【相似文献】