【作者】 黄献格；

【导师】 沈磊；

【作者基本信息】 山东大学 ， 计算机应用技术， 2008， 硕士

【摘要】 对移动通信系统而言,无线接入域是其区别于固定通信网络的标志,移动信道的开放特性和衰落特性,对移动接入的安全机制提出了更高的要求。第二代移动通信的GSM系统引入了智能卡作为用户身份认证模块,把SIM卡应用于移动通信网络实现网络对用户进行认证并产生会话密钥。第三代移动通信系统的用户安全接入,使用USIM卡进行认证,虽然实现了用户和网络之间的双向认证,弥补了GSM的用户认证缺陷,但是无线网络安全体系缺乏可扩展性、不可否认性,对移动终端的安全考虑不够充分和基于对称算法实现的身份认证技术,不能满足下一代通信系统——B3G(Beyond 3G)通信系统的安全需求。以电子商务为主的无线应用和增值业务不断发展。以移动商务为例,可以开展移动股票、移动证券,移动采购,移动支付等多种类型的移动交易,在采用终端这种“非面对面”、“非面向连接”的交易方式时,除了交易本身的安全之外,交易者的身份真实性与交易的不可抵赖性显得尤其重要。高级的移动业务需要身份安全,身份安全要求移动终端具备可靠的身份认证能力。电信智能卡的安全体系结构和认证功能处于不断完善的过程中,更新一代的身份认证技术——指纹识别技术已经发展成熟,并开始被广泛应用。本论文在这样的背景下,分析了第三代通信系统的安全机制和UMTS鉴权中的身份认证,针对认证存在的问题、算法的漏洞、鉴权模式的脆弱性,结合B3G通信系统的安全需求和发展趋势,构建B3G的用户认证模块——USIM卡,并基于这个平台结合PIN码、用户指纹特征实现用户安全身份认证,以满足下一代通信系统的接入安全和认证体系结构。USIM卡的数据安全写机制,保证了卡片在写数据操作中数据的完整性和合法性,避免由于数据更新操作中断而造成卡内数据紊乱。本文身份认证方案基于USIM卡的安全特性,利用RSA机制和SHA-1算法将PIN码和指纹紧密融合,选择随机数代替时间戳技术抵抗重放攻击,并由示证和认证双方共同生成随机因子;用户请求采用预计算的方式,有效减少了实时计算量。更主要的是这种身份认证的机制依赖认证流程中的采用非对称算法的关键环节,实现了对身份认证信息在一定程度上的不可否认性保护,强化了B3G用户域安全。更多还原

【Abstract】 For mobile radio communications, the wireless access is the most important icon compared with fixed networks. The openness and fading features appeal for higher security. The second Generation (2G) Mobile system GSM uses smart card as subscriber identity module, which assures that the network authenticates the users and generates session keys. Secure access based on USIM in the third Generation (3G) Mobile radio network completes duplex authentication and covers the authentication weaknesses in GSM system. But their secure architecture is short of extensible, non-repudiation, identity authentication technology based on symmetrical algorithm, which is can’t satisfy the new requirements of next communications. With the development of multi-application, multi-system, wireless network e-commerce and value-added services, the existing security mechanisms can’t meet a high level of security demand in the Beyond 3G (B3G) network.The e-commerce-based wireless application and value-added services develop fast. For example, various services such as mobile stock, mobile securities, mobile procurement, and mobile payments all can be offered by mobile business. During the process of the transactions which make use of a ’non-face-to-face’, ’non-connection-oriented’ skills, the identity of the authenticity and non-repudiation of transactions are particularly important, in addition to the safety of the transaction itself. Advanced mobile business needs the security of identity which make a high requirement for the mobile terminals’ capability at the aspect of identity authenticity. The security architecture and authentication mechanism of telecommunication smart card developed continuously. A new set of identity authenticity technology, fingerprint recognition, has been developed, and began to be widely used.Therefore, this article analysis the security mechanism and identity authentication technology in 3G network and UMTS authentication model, discuss access security features and mechanism in B3G Network for the security weaknesses, the algorithm shortcomings, the authentication vulnerabilities in 3G. In order to meet the development trend and security needs in B3G communication systems, this article designs and construct a multi-application smart card platform for access security in B3G, puts forward an identity authentication scheme based on the PIN code, fingerprint characteristics, Universal Subscriber Identity Module (USIM) card. This solution will satisfy the access security and identity authentication architecture for the next generation communication systems.Writing data security mechanism of the USIM card ensures the card data integrity and legitimacy, and avoids data disorder caused by interruption of data updating operations. The identity authentication based on PIN code, fingerprint and USIM card makes use of RSA cryptosystem and SHA-1 hash algorithm, and realizes mutual identity authentication among user, USIM card and the network. The scheme avoids masquerade attack, replay attack and the harm caused by illegal theft. The random factor is generated by the mutual parties to guarantee the authentication fairness. Pre-calculation is used in user ends to reduce the real-time calculation and make the scheme satisfy real-time requirement of mobile communication system. What is more important is that the article presents a non-symmetrical algorithm to protect the authentication information’s non-repudiation and strengthen the user’s domain security. It protects the information in authentication more safely. To a certain extent the expense of the single authentication time gains security enhancement.更多还原