KR20170068437A - Quantum authentication method for access control between three elements of cloud computing - Google Patents

Abstract

The present invention relates to a method for quantum authentication of three-way access control of cloud computing wherein the three cloud computing elements are data owner DOwner, data user DUser, and cloud computing service provider CSP, , Carrying out the mutual quantum authentication between the CSP and the DUser holding the same ID serial number; Establishing DOwner and CSP as tangled pairs of ERPs, carrying the same identity serial number ID and proceeding mutual quantum authentication between DOwner and CSP; If mutual quantum authentication between the CSP and the DUser and mutual quantum authentication between the DOwner and the CSP are successful, succession of the DOwner, the DUser and the CSP three-way quantum authentication succeeds; And DOwner, DUser and CSP triplicate quantum authentication fail if not otherwise.

Description

TECHNICAL FIELD [0001] The present invention relates to a quantum authentication method for controlling access between three elements of a cloud computing system. BACKGROUND OF THE INVENTION 1. Field of the Invention < RTI ID =

FIELD OF THE INVENTION The present invention relates to the field of quantum safety communication, and more particularly, to a quantum authentication method for controlling access between three elements of cloud computing.

Cloud computing is an increasing, use, and delivery model of related services based on the Internet, typically providing dynamic extensions over the Internet and generally associated with virtualized resources. A cloud is a term that is analogous to a network or the Internet. In the past, drawings often used clouds to represent the network, and later they were also used as abstract terms to describe the Internet and underlying infrastructure equipment. Thus, cloud computing can enable users to experience 10 trillion calculations per second, and this powerful computing capability enables them to simulate nuclear explosion, climate change forecasting, and market development trends. The user can connect to the data center through a PC, a notebook computer, a mobile phone, etc., and perform calculations according to his / her demand.

Cloud computing is the convergence of traditional computer and network technology advances, including distributed computing, parallel computing, utility computing, network storage, virtualization, load balancing, and hot backup redundancy. Cloud computing distributes computing tasks to a large number of distributed computers rather than to local or remote servers, and the operation of enterprise data centers is more similar to the Internet. This allows businesses to turn resources into the required applications and visit computers and storage systems on demand. (2) virtualization; (3) high reliability; (4) universality; (5) high scalability; (6) services based on demand; and (7) Fairly low prices, and (8) potential risks. In addition to providing computing services, cloud computing services inevitably provide storage services. However, cloud computing services are now monopolized by private organizations, which can only provide commercial credit. Government agencies and commercial entities (especially commercial entities that have sensitive data, such as banks) should choose cloud computing services with sufficient alertness. Once commercial entities use large-scale cloud computing services provided by private organizations, no matter how powerful their technology competitiveness may be, private institutions can threaten the whole society by using "data" (information) and such risks can not be avoided. In the information society, "information" is very important. In another aspect, data in cloud computing is secured for cloud computing users other than the data owner. However, security is not maintained for commercial organizations that provide cloud computing. All of these potential risks are an important factor that commercial and government agencies should consider when choosing cloud computing services, especially when foreign institutions are providing cloud computing services.

As the Internet is widely opened and shared, users' personal information leakage problems are becoming more and more problematic. Cloud-based network-based identity theft still remains an important security threat for cloud computing. Attackers can exploit these identity information to break into cloud computing services and compromise data security in cloud computing in many ways.

To overcome the disadvantages of the prior art, the present invention proposes a quantum authentication method for controlling access between three elements of cloud computing. The three elements of cloud computing are the data owner DOwner, the data user DUser, and the cloud computing service provider CSP. The method is to make DOwner and CSP an entangled pair, mapping DOwner to Alice, and CSP to BoB Mutual identity authentication is performed through the mutual authentication method to achieve secure access control among the three elements of cloud computing.

In order to achieve the above object, the present invention adopts the following technique.

CLAIMS 1. A quantum authentication method for controlling access between three elements of a cloud computing system, the three elements of cloud computing comprising a data owner DOwner, a data user DUser and a cloud computing service provider CSP,

Establishing a CSP and a DUser as an ERP tangled pair, legally holding the same ID serial number, and performing mutual quantum authentication between the CSP and the DUser;

Establishing DOwner and CSP as a tangled pair of ERPs, legally holding the same identity serial number ID, and proceeding with mutual quantum authentication between DOwner and CSP; And

If both the quantum authentication between the CSP and the DUser and the quantum authentication between the DOwner and the CSP are successful, the quantum communication between the DOwner, the DUser and the CSP is successful, or the quantum communication between the DOwner, the DUser and the CSP fails do.

The mutual quantum authentication process between the CSP and the DUser is the same as the mutual quantum authentication process between the DOwner and the CSP.

In the mutual quantum authentication between the CSP and the DUser and the mutual quantum authentication between the DOwner and the CSP,

One of the ERP entangled pairs is mapped to the identifier Alice and the other is mapped to the verifier Bob; Alice and Bob share a secret key; Alice generates ERP bilateral tangential photon pair < A, B > based on ERP tangled pairs, distributes photonic assembly A to Alice, and sends photon assembly B to Bob (1);

Bob and Alice use the same quadrature base to measure the safety of the channel; If the channel is not secure, end the authentication; If the channel is safe, Bob measures the quantum state of the received photon set B , obtains the verification information B _v, and notifies Alice (step 2);

Alice measures the quantum state of the photon set A and judges whether Bob is a false validator according to the quantum state represented by the measurement result. If the false validator, Alice rejects the identification and ends the authentication process; Otherwise (3) Alice obtains the identification information A _p ;

Alice encrypts the identification information A _p through the shared secret key and sends it to Bob; Bob proceeds with the decryption based on the identification information received by the shared secret key pair, compares the identification information A _p obtained after decrypting with its own verification information B _v , and if A _p = B _v, If the verification succeeds, otherwise (4) Bob's identity verification for Alice fails.

In the step (2), the channel-

Alice randomly selects a few photons from the photon A set, and the selected photon selects the corresponding photons from the B set based on the sequence number in the set A;

Selecting the same quadrature base to measure photons randomly selected from the set A and photons corresponding to the set B, respectively; And

If the comparative measurements are the same, the channel is safe, otherwise the channel may be eavesdropped or attacked.

Process of obtaining the verification data B _v in the above step (2),

이고; ID가 1이면 Bob의 측정 베이스는

인 단계;After Bob receives photon set B, he establishes Bob's measurement base based on the same identification serial ID value that Bob and Alice legally hold, and if ID is 0, Bob's measurement base is

ego; If ID is 1 Bob's measurement base is

In step;

중 하나인 경우, 측정 결과는

에 의거하여 일련번호를 고전 정보(classic information)로 변환하고, 최종적으로 검증 정보 B_v를 얻는 단계를 포함한다.Bob uses a corresponding measurement base to measure the photons in photonic set B in order, and the measurement results in two quantum states

, The measurement result is

Converting the serial number into classical information based on the received information, and finally obtaining the verification information B _v .

In the step (3), the process of determining whether Bob is a false verifier based on the quantum state appearing in the measurement result,

이고; ID가 1이면 Alice의 측정 기저는

인 단계;Bob's measurement base is determined based on the same identification serial number ID value that Alice and Bob legally hold, and if ID is 0, Alice's measurement base is

ego; If ID is 1, Alice's measurement base is

In step;

이면 Bob은 가짜 검증자이고; 측정 결과에서 나타나는 양자 상태가

중 하나이면 Bob은 가짜 검증자가 아닌 단계를 포함한다.Alice employs a corresponding measurement base to measure the photons in photonic assembly A in order, and if the quantum state

Bob is a fake validator; The quantum states that appear in the measurement results are

Bob contains a step that is not a fake validator.

In the step (3), in the process of Alice obtaining the identification information A _p ,

중 하나인 경우, 측정 결과는

에 의거해 일련번호를 고전 정보로 변환하고, 최종적으로 검증 정보 A _p를 얻는 단계를 포함한다.Alice employs a corresponding measurement base to measure the photons in photonic assembly A in order,

, The measurement result is

, Converting the serial number into classical information, and finally obtaining the verification information A _p .

The shared secret key establishment between Alice and Bob in step (1) above is implemented through the quantum distribution protocol BB84.

Advantageous effects of the present invention are as follows.

(1) In the present invention, the three elements of cloud computing are divided into two groups of ERP pairs CSP, DUser, DOwner, and CSP according to the access function. This provides mutual identity authentication and privacy protection through necessary quantum transfer, Improve safety, reliability and processing efficiency and increase communication efficiency.

(2) The method of the present invention monitors the safety of a quantum channel to effectively prevent the attack, theft, fraud or other attacks of others, thereby assuring the reliability of cloud computing to a reliable level.

FIG. 1 is an explanatory diagram of a process of mutual quantum authentication of two elements in three cloud computing elements in the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in more detail with reference to the drawings.

은 한 세트의 직교 베이스이고 C _χ로 기록하고;

는 한 세트의 직교 베이스이고 C _y로 기록하고; C _χ와 C _y 간에는 다음과 같은 관계가 존재한다.In this embodiment,

Is a set of orthogonal bases and is written as C [ _chi] ;

Is a set of orthogonal bases and is written with C _y ; The following relationship exists between C _χ and C _y .

(1)

(One)

As follows.

(2)

(2)

C _χ and C _y satisfy the following formula:

(3)

(3)

The two-photon EPR tangent pair in < A, B > is in the next entangled state.

(4)

(4)

As shown in FIG. 1, the process of mutual quantum authentication between the CSP and the DUser among the cloud models is as follows.

(1) Establish shared secret key between CSP and DUser:

A shared secret key K _AB is constructed between the sender CSP (Alice) and the receiver DUser (Bob), and the construction of the secret key can be implemented through the quantum distribution protocol BB84.

(2) Production of a quantum state:

In the cloud model based on quantum authentication, the identifier Alice creates an n-group EPR quantum entangled photon pair < A, B > based on equation (4). Alice sends the corresponding photon set B = { b ₁ , b ₂ , ..., b _n } to the verifier Bob, leaving the photon set A = { a ₁ , a ₂ , ..., a _n } .

(3) Security monitoring of channels:

The CSP randomly selects m photons from the photon A set, adopts C _χ and C _y alternately, randomly measures and notifies the DUser of the serial number of these photons and the measurement result. The DUser measures the quantum state of the corresponding photon B in sequence using the same base. As can be seen from Equation (4), in the absence of attacks and fraud, CSP and DUser always get the same results. As a result of comparing the measurement results with each other, it means that the channel is safe and reliable, otherwise it means that it can be eavesdropped or attacked. Here, the detection of the safety of the quantum channel can effectively prevent the attack, the theft, the fraud or other attacks of the others.

(4) DUser measurement progress:

Because CSP and DUser have the same legal ID number, the corresponding photon is measured using the measurement base established in the open rule below. For convenience, the measurement base of measurement base is denoted by MB, the measurement base of CSP is denoted by A _MB , and the measurement base of DUser is denoted by B _MB .

(5)

(5)

중 하나이고, 이 2개의 양자 상태도 아래 공식에 따라 일련번호를 고전 정보로 변환할 수 있다.After making the DUser receive the photon B set, proceed according to rule (5) and measure it in + x direction or + y direction using a specific measuring tool, and the measurement result is valid. The result of the measurement is that two quantum states

, And the two quantum states can also convert the serial number into classical information according to the formula below.

(6)

(6)

로 기록하고, 이를 검증 정보로 정의하고, DUser는

에 대해 비밀이 유지된다. DUser 측정 완료 후 CSP에 식별 진행을 고지한다.The DUser in turn sets the classical set obtained from the upper photon set B measurement

, Which is defined as verification information, and DUser

Is kept secret. After completion of the DUser measurement, notice the identification progress to the CSP.

(5) CSP identifies the result of DUser measurement

이면, DUser는 가짜 검증자이고 CSP는 식별을 거절한다. 인정 과정은 종료된다. 만약 측정 결과가

중 하나이면, CSP는 아래 단계를 계속한다.The CSP measures the photon set A based on the above formula (5). If the quantum state in the measurement result is

, The DUser is a fake validator and the CSP rejects the identification. The accreditation process is terminated. If the measurement result is

, Then the CSP continues with the steps below.

(6) Obtain identification information by CSP measurement

로 기록하고, 이를 식별 정보로 삼는다.CSP encodes the measurement results into classical information according to equation (6), and measures the measured photon set A and the acquired classical set

And records it as identification information.

(7) The CSP encrypts the identification information and transmits it to the DUser

에 대해 공유 비밀 키

를 통해 암호화를 진행한 후 이를 DUser 검증자에게 발송한다.CSP identification information

Shared secret key for

And sends it to the DUser verifier.

(8) DUser verifies CSP identification information

에 의거해 암호를 해독하여

를 얻는다. 그 후 자신의 검증 정보

와 비교 대조하는데, 만약

이면 DUser가 CSP에 대한 신분 검증을 통과했다는 것을 의미하다.After the DUser receives the encrypted identification information sent from the CSP, the public secret key

Decrypt the password based on

. After that,

And contrasts with

This means that the DUser has passed verification of the identity of the CSP.

(9) They mutually change roles and conduct mutual verification

The CSP and the DUser change their roles so that the DUser is the identifier, the CSP is the verifier, and the identity verification of the DUser of the CSP can be implemented in the same way. In this way, identity verification between CSP and DUser is implemented.

It can be deduced that the principle of quantum identity authentication between DOwner (Alice) and CSP (Bob) is the same. In this way, the quantum authentication process of the three elements of cloud computing is completed.

The safety analysis and communication efficiency analysis of the quantum authentication method of the present invention are as follows.

1) Physical attack that eavesdropper Eve pretended to be Alice

와

를 사용하기 때문에, 공격자의 상기 유형 조작은 검출된다.Eve attempts to initiate an attack via photon r,

Wow

, The type operation of the attacker is detected.

, 그 직교 베이스는

이다. 즉,

로 구성된 양자 상태는

이고, 그 표현식은 다음과 같다.Assuming that Eve impersonates Alice, the resulting photon is R ,

, The quadrature base

to be. In other words,

A quantum state consisting of

And the expression is as follows.

Assuming the following,

The above equation can be modified as follows.

상황 하에서, 광자 A, B 간의 간섭성은 바뀌며, 이 때 공격이 존재하는 것을 발견하게 된다.Base

Under the circumstances, the coherence between photons A and B changes, and at this point an attack is found.

2) The eavesdropper impersonates Bob and attacks

밖에 없고, Bob의 공격과 가장은 Alice가 정확한 측정 결과를 얻을 수 없게 만들기 때문에 결국에는 발견된다.Bob assumes that it does not have an ID serial number, and even if the ID serial number is stolen through the Alice identification process, the CSP can be identified during the process of identifying the DUser measurement result, The quantum state is

Bob's attack and impersonation are eventually found because Alice makes it impossible to get accurate measurement results.

인 상황 분석3) The quantum state that the eavesdropper

In Situation Analysis

이다. 도청자는 Alice의 정확한 정보를 획득해야 하는데, 다시 말해 이는 클라우드 모형 중의 CSP 또는 DOwner이고, 그 확률은

에 불과하다.There are four situations in Alice's measured quantum state,

to be. The eavesdropper must obtain Alice's exact information, which is the CSP or the DOwner in the cloud model,

.

라고 가정할 경우, 도청자가 정확한 정보를 획득할 확률은

이다. 그러나 실제 작업에서 테스트 횟수는 128보다 훨씬 많다.The number of measurements

, The probability that an eavesdropper will obtain accurate information

to be. However, in practice, the number of tests is much greater than 128.

4) Communication efficiency analysis

이나, 실제 유효 응용 정보 수량은

이다. 다시 말해 인증 과정에서 실제 전송되는 스트링의 자릿수는

이나, 실제 획득하는 정확한 유효 스트링 자릿수는

이다. 따라서 그 통신효율은

이다.If the method does not consider the situation of data loss and data retransmission, the amount of Alice and Bob mutual transmission information during the authentication process

However, the actual effective application information quantity

to be. In other words, the number of digits of the string actually transmitted in the authentication process is

However, the exact number of valid string digits actually acquired is

to be. Therefore,

to be.

는 편차를 나타내고, n, m과

는 양의 정수이다. 상기 실험은 상기 방법이 아주 높은 통신효율을 유지할 수 있다는 것을 검증한다.Where n is the number of EPR quantum entangled photon pair groups produced by the identifier Alice and m is the number of photons randomly selected from the photon A set by the CSP during the channel safety monitoring process,

Represents the deviation, and n, m and

Is a positive integer. The experiment verifies that the method can maintain very high communication efficiency.

The drawings illustrate specific embodiments of the invention and do not limit the scope of protection of the invention. Those skilled in the art will appreciate that various modifications and variations can be made without departing from the spirit and scope of the present invention.

Claims (8)

The three elements of cloud computing include the data owner DOwner, the data user DUser, and the cloud computing service provider CSP,
Establishing a CSP and a DUser as an ERP tangled pair, legally holding the same ID serial number, and performing mutual quantum authentication between the CSP and the DUser;
Establishing DOwner and CSP as a tangled pair of ERPs, legally holding the same identity serial number ID, and proceeding with mutual quantum authentication between DOwner and CSP; And
If both the quantum authentication between the CSP and the DUser and the quantum authentication between the DOwner and the CSP are successful, the quantum communication between the DOwner, the DUser and the CSP is successful, or the quantum communication between the DOwner, the DUser and the CSP fails And a third step of controlling access to the third computing element in the cloud computing system. The method according to claim 1,
Wherein the mutual quantum authentication process between the CSP and the DUser is the same as the mutual quantum authentication process between the DOwner and the CSP, and the quantum authentication method for controlling access between the three elements of the cloud computing. 3. The method of claim 2,
In the mutual quantum authentication between the CSP and the DUser and the mutual quantum authentication between the DOwner and the CSP,
One of the ERP entangled pairs is mapped to the identifier Alice and the other is mapped to the verifier Bob; Alice and Bob share a secret key; Alice generates ERP bilateral tangential photon pair <A, B> based on ERP tangled pairs, distributes photonic assembly A to Alice, and sends photon assembly B to Bob (1);
Bob and Alice use the same quadrature base to measure the safety of the channel; If the channel is not secure, end the authentication; If the channel is safe, Bob measures the quantum state of the received photon set B , obtains the verification information B _v, and notifies Alice (step 2);
Alice measures the quantum state of the photon set A and judges whether Bob is a false validator according to the quantum state represented by the measurement result. If the false validator, Alice rejects the identification and ends the authentication process; Otherwise (3) Alice obtains the identification information A _p ;
Alice encrypts the identification information A _p through the shared secret key and sends it to Bob; Bob proceeds with the decryption based on the identification information received by the shared secret key pair, compares the identification information A _p obtained after decrypting with its own verification information B _v , and if A _p = B _v, (4) that the verification of Bob's Alice is unsuccessful if the verification is successful, and if not, the failure of Bob's identity verification to Alice (4). The method of claim 3,
In the step (2), the channel-
Alice randomly selects a few photons from the photon A set, and the selected photon selects the corresponding photons from the B set based on the sequence number in the set A;
Selecting the same quadrature base to measure photons randomly selected from the set A and photons corresponding to the set B, respectively; And
Wherein the channel is secure if the results of the comparative measurements are identical to each other, and the channel may be eavesdropped or attacked otherwise. The method of claim 3,
Process of obtaining the verification data B _v in the above step (2),
After Bob receives photon set B , he establishes Bob's measurement base based on the same identification serial ID value that Bob and Alice legally hold, and if ID is 0, Bob's measurement base is

ego; If ID is 1 Bob's measurement base is

In step;
Bob uses a corresponding measurement base to measure the photons in photonic set B in order, and the measurement results in two quantum states

, The measurement result is

Transforming the serial number into classic information based on the received information, and finally obtaining the verification information B _v . The quantum authentication method for controlling access between three elements of a cloud computing. The method of claim 3,
In the step (3), the process of determining whether Bob is a false verifier based on the quantum state appearing in the measurement result,
Bob's measurement base is determined based on the same identification serial number ID value that Alice and Bob legally hold, and if ID is 0, Alice's measurement base is

ego; If ID is 1, Alice's measurement base is

In step;
Alice employs a corresponding measurement base to measure the photons in photonic assembly A in order, and if the quantum state

Bob is a fake validator; The quantum states that appear in the measurement results are

Wherein Bob includes a step that is not a fake validator. &Lt; RTI ID = 0.0 &gt; [0031] &lt; / RTI &gt; The method according to claim 6,
In the step (3), in the process of Alice obtaining the identification information A _p ,
Alice employs a corresponding measurement base to measure the photons in photonic assembly A in order,

, The measurement result is

To convert the serial number into the classic information, both authentication methods to control the final approach between cloud computing three elements comprising the step of obtaining the verification data based on the A _p. The method of claim 3,
Wherein the shared secret key establishment between Alice and Bob in step (1) is implemented through a quantum distribution protocol BB84.

Images