面向数字版权管理系统的轻量级三因素认证方案的分析与改进

Analysis and Improvement on a Lightweight Three-Factor Authentication Scheme for Digital Rights Management System

摘要: 随着嵌入式技术和低功耗设备的发展，数字内容开始在物联网、智能家居、车联网等各种资源有限的环境中进行传输和存储。但是，在公开信道上数字内容很容易被复制和分发，这使数字内容的提供者和合法的使用者的权益遭受严重的安全威胁。为了保护与数字内容相关参与者的合法权利，数字版权管理系统应运而生。2020年，Yu等人提出了一个基于生物特征的数字版权管理系统认证方案。本文对其进行了安全分析，发现Yu等人的方案不能正常运行并且容易受到用户的跟踪攻击和假冒许可服务器攻击。为了克服Yu等人方案的安全缺陷，本文提出了一个改进的面向数字版权管理系统的三因素认证方案，分析了它的安全性，并比较了它与同类方案的计算成本。

Abstract: With the development of embedded technology and low-power devices, digital content has begun to be transmitted and stored in various resource-limited environments such as the Internet of Things, smart homes, and Internet of Vehicles. However, digital content is easily copied and distributed on open channels, which causes serious security threats to the rights and interests of digital content providers and legitimate users. In order to protect the legal rights of participants related to digital content, a digital rights management system came into being. In 2020, Yu et al. proposed a biometric-based digital rights management system authentication scheme. This article conducted a security analysis on it and found that the scheme of Yu et al. does not work properly and is vulnerable to user tracking attacks and licensing server fake attacks. In order to overcome the security flaws of Yu et al.’s scheme, this paper proposes an improved three-factor authentication scheme for digital rights management system, analyzes its security, and compares its computational cost with similar schemes.