电子学报 ›› 2016, Vol. 44 ›› Issue (8): 1806-1813.DOI: 10.3969/j.issn.0372-2112.2016.08.005

• 学术论文 • 上一篇    下一篇

适用于移动云计算的抗中间人攻击的SSP方案

陈凯1,2,3, 许海铭4,5, 徐震1,2, 林东岱1,2, 刘勇6   

  1. 1. 信息安全国家重点实验室, 北京 100093;
    2. 中国科学院信息工程研究所, 北京 100093;
    3. 中国科学院大学, 北京 100049;
    4. 国家能源局安全司, 北京 100824;
    5. 华北电力大学电气与电子工程学院, 北京 102206;
    6. 山东省电力公司调度控制中心自动化处, 山东济南 250000
  • 收稿日期:2015-01-15 修回日期:2015-03-17 出版日期:2016-08-25
    • 作者简介:
    • 陈凯 男,1985年生于天津.中国科学院信息工程研究所博士生.研究方向为网络与系统安全、身份认证、工业控制系统安全.E-mail:chenk@iie.ac.cn;许海铭 男,国家能源局安全司处长,华北电力电力大学电气与电子工程学院博士生,主要从事电力系统安全研究.
    • 基金资助:
    • 中国科学院先导专项子课题 (No.XDA06010701); 信息安全国家重点实验室科研仪器设备专项 (No.Y4D0031302)

Hash-Based Secure Simple Pairing for Preventing Man-in-the-Middle Attacks in Mobile Cloud Computing

CHEN Kai1,2,3, XU Hai-ming4,5, XU Zhen1,2, LIN Dong-dai1,2, LIU Yong6   

  1. 1. State Key Laboratory of Information Security, Beijing 100093, China;
    2. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;
    3. University of Chinese Academy of Science, Beijing 100049, China;
    4. National Energy Administration, Beijing 100824, China;
    5. School of Electrical and Electronic Engineering, North China Electric Power University, Beijing 102206, China;
    6. State Grid Shandong Electric Power Company, Dispatching Control Center, Jinan, Shandong 250000, China
  • Received:2015-01-15 Revised:2015-03-17 Online:2016-08-25 Published:2016-08-25

摘要: 低功率蓝牙(BLE)专为资源受限的设备设计,但现有的研究已经指出其安全简单配对方案(SSP)存在中间人攻击(MITM)漏洞.文章指出造成MITM漏洞的根本原因是:配对信息被篡改以及JW模式自身的漏洞.为此文章中提出了两个适用于移动云计算(MCC)中BLE设备的SSP改进方案,所提出的方案基于哈希函数并利用MCC技术提高SSP的安全性.方案1适用于支持PE或者OOB模式的BLE设备,其利用哈希函数确保配对信息的真实性、可靠性.方案2通过哈希序列来解决仅支持JW模式的BLE设备的MITM攻击漏洞.文章分别从安全角度和性能角度对所提出的方案进行分析,以表明方案在不同级别敌手的攻击下可以提供MITM攻击防护能力.

关键词: 蓝牙低功率, 安全简单配对方案, 中间人攻击, 移动云计算

Abstract: Bluetooth low energy (BLE) is designed for the devices with computational and power limitations.But it has been confirmed that Secure Simple Pairing (SSP) is vulnerable to the MITM attack.We identify the root causes of the problem:the pairing messages being tampered,and the vulnerability of the JW model.In this paper,we propose two hash-based SSP schemes for the devices in Mobile Cloud Computing (MCC).The proposed schemes enhance the SSP security with the help of MCC.Scheme I is applied into the devices which support the PE or OOB model.It uses the hash function to ensure the authenticity and integrity of the pairing messages.Scheme Ⅱ is suitable for the devices which only support the JW model.It improves the security of the JW model through using the hash array.At the end of this paper,we examine the performance for the proposed schemes,and perform the security analysis to show that they can provide the MITM protection against the adversaries with different levels of power.

Key words: bluetooth low energy, secure simple pairing, man-in-the-middle attacks, mobile cloud computing

中图分类号: