Secure and convenient authentication in global networks

1.基于挑战-响应的直接身份认证方案的评价与其他直接身份认证方案相比，基于挑战-响应的直接身份认证方案具有两个优点。首先，它们比只使用密码的更健壮。其次，它们不需要高成本的特殊设备，如指纹验证器来识别用户。然而，我们的研究表明，为了使基于挑战响应的方案能够安全地抵御实际中可能遇到的诸如偷窥等攻击，证明者必须记住的秘密数据集的大小必须很大，这使得这些方案由于人类有限的记忆能力而无法在实际中使用.可视秘密共享方案在身份识别中的应用作为对1.中问题的解决，提出了将视觉秘密共享（VSS）方案应用于基于挑战-响应的直接身份认证方案。我们的建议可以使人类身份认证计划非常安全，对偷窥攻击，主要是由于在我们的建议，挑战pattaerns不能被攻击者看到的事实，并因此攻击者不能猜测证明者的秘密信息在所有。另外，由于VSS可以用普通的单片机和简单的显示器实现，所以实现成本低是本方案的另一个突出优点.对象认证和访问控制我们还提出了一些系统，以实现安全的访问控制和对象认证，通过使用密码学（特别是密钥预分配系统或KPS）。与使用防火墙或路由器的系统不同，我们提出的系统的安全性不依赖于底层操作系统（OS）。因此，这些系统更适合于由一系列不同操作系统管理的全球网络。

1. Evaluation of challenge-response based direct human identification schemesCompared with other direct human identification schemes, challenge response based ones have two advantages. Frist they are more robust than ones using passwords only. Second they do not require high-cost special devices such as fingerprint verifier to identify a user. However, our investigation shows that in order to make chalenge-response based schemes secure against such attacks as peeping which may be encountered in practice, the size of a set of secret data which have to be remenbered by a prover must be large, which renders these shcemes unusable in practice due to a limited memory capacity of human being.2. Applications of visual secret sharing schemes to human identificationAs a solution of the problem mentioned in 1., we proposed to apply visual secret sharing (VSS) schemes to the challenge-response based direct human identification schemes. Our proposal can make the human identification schemes extremely secure against peeping attackes, mainly due to the fact that in our proposal, challenge pattaerns cannot be seen by attackers, and bence the attackers cannot guess the prover's secret information at all. In addition, since VSS can be realized by ordinary transparencies and a simple display, low implementation cost is another outstanding advantage of out proposal.3. Object authentication and access controlWe also proposed a number of systems to achieve secure access control and object authentication by using cryptography (in particular key predistribution system or KPS). Being differenct from systems using firewalls or routers, security of our proposed systems do not rely on the underlying operating system (OS). Thus these systems are more suitable for global networks which are managed by an array of different operating systems.