The security of widely used authentication and signature schemes is based on the difficulty of the discrete logarithm problem and the prime factorization problem. A quantum computer might solve these problems in probabilistic polynomial time. In other words, if a quantum computer is realized, these schemes are expected to eventually become vulnerable. In preparation for the development of a quantum computer, research on post-quantum cryptography is in progress. In addition, authentication and signature schemes using the post-quantum cryptography are also studied. Generally, authentication and signature schemes based on the public key cryptography have the large computational complexity. A zero-knowledge authentication scheme based on the syndrome decoding problem was proposed as a post-quantum authentication scheme. We have proposed the smaller computational complexity authentication scheme by using LDPC codes. This paper presents a post-quantum signature scheme which is constructed from the authentication scheme by Fiat-Shamir transformation.

Most of cryptosystems, identification and signature schemes rely on the discrete logarithm problem and the prime factorization problem. These problems would be broken through Shor's quantum factorization algorithm in the case that quantum computers would come to exist. Code-based cryptography is one of post-quantum cryptography. There are several cryptography to reduce the key size by using the public matrix with the circulant structure, but some attacks have been proposed with the circulant structure as a weak point. In this paper, we propose a code-based identification scheme using high-density parity-check (HDPC) matrices. The poposed scheme is an improvement of Stern's identification scheme based on the binary syndrome decoding (BSD) problem. In the proposed scheme, we apply HDPC matrices to the BSD problem in order to prevent attacks using iterative decoding algorithm. Also, to prevent attack using circulant structure, we construct HDPC matrices of multiple block-row with circulant submatrices of different size. Furthermore, we evaluate the security level, key size, computational cost and security against existing attacks.

Data is accumulated daily in a society where the Internet has infiltrated. In order to further develop the industry, it is effective to establish a framework that can share and use data resources widely. If the IoT devices and various services trade data without human intervention, they will be able to provide new services that enrich our lives. If an authentication and authorization system that can openly confirm the data owners and give authority to them is constructed, various services, not limited to a single service, can authenticate and authorize the devices, and the data sharing will be promoted. In this paper, we propose a system that uses blockchain as a database for storing credentials and authority information and allows users and services to perform authentication and authorization based on that information.

The malicious websites used by drive-by download attacks change their behavior for web client environments. To analyze the behavior of malicious websites, the singleenvironment analysis cannot obtain sufficient information. Hence, it is difficult to analyze the whole aspect of malicious websites. Also, the code obfuscation and cloaking are used in malicious websites to avoid to be analyzed their behavior. In this paper, we propose an analyzing method that combines decoding of the obfuscation code with dynamic analysis using multi-environment analysis system in order to analyze the behavior of the malicious websites in detail. Furthermore, we present two approaches to improve the multi-environment analysis. The first one is automation of traffic log analysis to reduce the cost of analyzing huge traffic logs between the environments and malicious websites. The second one is multimodal analysis for finding the URL of malicious websites.

Intelligent Transport System (ITS) is for resolving traffic accidents and congestion by using information and communications technology. It is important to ensure the reliability of data in ITS. Public key encryption and digital signature are used for data security. Certification authority (CA) issues a certificate for a public key and manages a certificate revocation list (CRL). While a vehicle moves, it cannot always access the network infrastructure such as road side unit (RSU). If the distribution of CRL is slowly, a vehicle cannot verify the validity of a certificate correctly. This paper proposes a CRL distribution scheme by inter-vehicle communication using random network coding in the situations near intersections with high vehicle density.

There are various studies and developments to notice the traffic information to drivers in the field of Intelligent Transport System (ITS) so that they can prevent traffic accidents. Vehicles must be timely transmitted information with integrity, since it influences an action of vehicles indirectly. Digital signature provides reliability for the information. In high vehicle density area, the vehicles may receive many packets. If each vehicle verifies all signatures of received packets, the transmission delay increases. Increasing of the expired packets causes decrease of the received rate. In this paper, we propose a method for controlling the number of verification dynamically in order to decrease the transmission delay. The proposed method can suppress fall of the received rate.

To secure network layer is needed for stable IP network as infrastructure. As TCP SYN flooding attack shows, sender of attack packet generally masquerades as others by spoofing source IP address in the packet. IP network becomes more secure, if backbone network through which IP spoofing packet does not flow can be realized. Egress filtering is a way of not flowing IP spoofing packet into backbone network. Each customer network should activate egress filtering for being an effective stratagem. From not only the view point of IP network security but also suppression of threat to be springboard, egress filter must be applied in all customer networks. However, no tool is ready for easily checking egress filtering. In this paper, we show an egress filter check system which can obtain results of egress filter check on routers in a path to arbitrary host.

生産性，創造性を高める次世代のオフィス環境は，特定の信頼関係で構成されたグループの中で，人，物，情報の関係が動的に変化し，互いに連携，協調しながら作業を進められるオフィスシステムによって実現される．本論文では，人，物，情報の関係が動的に変化する組織内のワークスペースにおいて，オフィスシステムの管理を容易にし，そしてシステム内のエンティティの行動を管理できるアクセス制御方式を提案する．提案方式は，認証機能とセッション転送機能を有するサービスコネクタと呼ぶネットワークサービスを制御する機構を導入することで実現される．安全性，管理の容易さについて考察を与え，提案方式の有効性を示す．更に，サービスコネクタを実装し，Webサービス，Windowsファイル共有サービスを例に，提案方式の実現が容易であることを示している．

In operation of server hosts in client/server model, allowing to connect a service with public is a frequent cause of illegal access. An administrator takes on heavy work load in conventional model of service provision, because access control is implemented in each application level. In this paper, we propose a model for access control using an application gateway which has functions of single sign-on, user authentication and service provisions. We call the application gateway service connector. The proposed model can improve security on server host and realize centralized user management and access-log analysis, and it has an effect to reduce a load of administrator.

Many research projects and implementations related to QoS (Quality of Service) management technologies for providing stable network services have been undertaken. To perform QoS management, traffic classes are required. Generally, traffic is classified by setting priorities for packets, and the methods of setting those priorities include passive admission control in which clients set priorities and active admission control in which network edge routers check traffic and set priorities. To perform active admission control, identification information such as a TCP or UDP header must be inspected. However, with existing security protocols such as ESP (Encapsulating Security Payload) or SSH (Secure Shell), these kinds of information cannot be inspected because they are encrypted. Based on the point of view that active admission control should be performed to simplify QoS management of IP networks, the authors of this paper propose a security protocol named ESPQ (ESP considered QoS) for constructing active admission controllable packets and investigate the stability of that protocol. They also perform implementation experiments to show that existing control equipment such as routers can perform QoS management of ESPQ packets. (C) 2004 Wiley Periodicals, Inc.

A key advantage of SSL VPN is that no specialized client software is required. When a user requests access to a server, the SSL client module, which is a Java applet code, is downloaded into the host at first. However, it is quite likely that not all applications run well, because a client can not connect with a server through an HTTPS tunnel in some applications as we know. Moreover, there is the possibility that we can not use the VPN connections when the SSL port is under Denial of Service (DoS) or Distributed DoS (DDoS) attack. In this paper, we propose a port randomized VPN architecture such that any application can use the VPN and the VPN has strength against DoS or DDoS attack. The proposed VPN uses the same Java applet as existing SSL VPNs use, but the function of the applet, which we call mobile code, is dynamically changed by Java Remote Method Invocation (RMI). The VPN client applet can cooperate with a VPN server and a firewall in server side.

A nonlinear combiner random number generator is a general keystream generator for certain stream ciphers. The generator is composed of several linear feedback shift registers and a nonlinear function; the output is used as a keystream. A fast correlation attack is a typical attack for such keystream generators. Mihaljevic, Fossorier, and Imai have proposed an improved fast correlation attack. The attack is based on error correction of information bits only in the corresponding binary linear block code; APP threshold decoding is employed for the error correction procedure. In this letter, we propose a method which improves the success rate of their attacks with similar complexity. The method adds some intentional error to original parity check equations. Those equations are then used in APP threshold decoding.

Concern about SSL VPN technology as a class of VPNs has been growing recently because a key advantage of SSL VPN is that it requires no specialized client software. When a user requests access to a server, the SSL client module, a Java applet code, is downloaded into the host first. However, it is quite likely that not all applications run well because a client can not connect with a server through an HTTPS tunnel in some applications. This study proposes a remote access VPN architecture that allows any application to use the VPN. The proposed VPN uses the same Java applet as existing SSL VPNs, but the function of the applet, which we call mobile code, is changed dynamically by Java Remote Method Invocation (RMI). The VPN client applet can cooperate with a VPN server and a firewall in server side. As a result, the proposed VPN has strength against Denial of Service (DoS) attacks.

安定したネットワークサービスを提供するためのQoS（Quality of Service）制御技術に関する研究や実装が盛んに行われている．QoS制御をするためにはトラヒックの分類が必要である．一般にパケットに優先度を設定することでトラヒックの分類が行われ，その優先度の設定方法にはクライアントが優先度を設定する受動的受付制御とネットワークのエッジルータ等がトラヒックをチェックして設定する能動的受付制御がある．能動的受付制御を行うためには，TCPヘッダやUDPヘッダ等の識別情報を閲覧しなければならないが，ESP（Encapsulating Security Payload）やSSH（Secure Shell）などの既存のセキュリティプロトコルではそれらの情報は暗号化されているために閲覧することができない．本論文ではネットワークのサービス品質管理を容易化するにあたって能動的受付制御をすることが望ましいという観点から，能動的受付制御可能なパケットを構築するセキュリティプロトコル ESPQ（ESP considered QoS）を提案し，その安全性について検討している．また，実装実験により既存のルータなどの制御機器がESPQパケットをQoS制御可能なことを示している．

モバイル端末に搭載されている TPM(Trusted Platform Module）で生成される署名鍵に証明書を発行すれば，端末を認証トークンとして使える．本論文ではある特定の TPM に紐づいた TPM と関連づいた公開鍵証明書を用いる SSL クライアント認証について検討する．TPM を識別するための RSA 鍵である AIK (Attestation Identity Key） と関連づけられた SSL クライアント証明書をサーバに提示することで端末認証を実現できる．本論文では，AIK の公開鍵証明書を OpenID により発行する方式と，AIK とその公開鍵証明書を用いて特定の TPM に SSL クライアント証明書を発行する方式を提案している．そして，TPM に保管した鍵と SSL クライアント証明書による SSL クライアント認証の実装方法について示している．TPM-embedded terminals can be used as authentication tokens by issuing certificates to signature keys generated by TPM. TPM generates AIK and BK, which are RSA keys. AIK is used to identify TPM. BK is used to encrypt data so that specific TPM can decrypt it. Terminal authentication can be realized by linking SSL client certificates to TPM. We propose a scheme of AIK certificate issuance with OpenID and one of SSL client certificate issuance to specific TPM. And we show how to implement terminal authentication using SSL client certificates.

パスワードの盗用は被害にあうまで気がつきにくく，紛失はサービスへのアクセスができなくなったときにはじめて気がつくことになる．サービス利用時に使われる利用者の所有物である端末を認証の要素とすれば，盗難や紛失に気がつきやすくなり不正アクセスによる被害を未然に防ぐことができる．モバイル端末への搭載が進んでいるセキュリティチップ TPM （Trusted Platform Module） で生成される署名鍵 AIK （Attestation Identity Key） に証明書を発行すれば，端末を認証トークンとして使えるようになる．AIK の証明書は，利用者の実在性の確認と認証をした上での発行が求められる．利用者が申請時に入力したメールアドレスに認証局がメールを送信し，その返答により利用者の実在性を確認する方式では，証明書を発行するたびに利用者と認証局で認証を行う秘密情報が生成される．サービス提供者が直接認証することなく，外部の認証サービスを利用できる枠組みである OpenID を導入すれば，利用者の実在性確認と認証の機能を OpenID Provider （OP） に分離できる．本論文では，利用者が OP に登録済みのアカウントで利用者の実在性確認と認証する方式を提案する．複数の証明書を利用する際に利用者が管理するアカウントが一つになり，また，認証局は利用者の秘密情報を管理する必要がなくなることを確認した．Plagiarism of passwords is hard to be found out until explicit damage is caused, and loss of them cannot be found out until we lose access right to service. If the terminal we use during service utilization participates in authentication, detection of plagiarism and loss would become easy. Thus damage caused by unauthorized access can be avoided. Terminals can be used as authentication token as long as we issue certificates for Attestation Identity Key(AIK) generated by Trusted Platform Module(TPM) mounted on more and more terminals. AIK certificates should be issued after the existence confirmation and authentication. In an existence confirmation scheme, which makes sure if the response to CA's E-mail will be returned from the user who enter E-mail address on application, CA generates secrets required in authentication between users and CA every issuance of certificates. Suppose OpenID removing the burden of authentication from service providers is introduced, delegation of existence confirmation and authentication to OpenID Provider(OP) can be realized. We propose an AIK certificate issuing scheme which confirms existence and authenticate users by the account registered into OP. Users should acquire only one account on the occasion of using multiple certificates, and CA need not manage user's secrets.

運動と認知処理を行う脳活動の関連性を明らかにする運動認知機能評価が認知能対策のアプローチにある.特定の作業と認知処理を明らかにする脳解析法にfMRIがあるが,装置の物理的制約から大きな身体動作を必要とする課題の採用は難しい.我々はfMRIで脳活動解析を行うための疑似課題として,体力測定と概念形成までの認知処理過程を同一とする課題提示ソフトウェアを関発した.そして,高齢者の計測実験と脳機能イメージングを通して開発ソフトウェアの提示課題が実際の体力測定と運動概念を共通とし,fMRIを用いた脳解析へ適用可能であるという見通しを得た.

サーバを用いてグループでファイル共有する場合,事故や不正操作による情報漏洩を考慮する必要がある.サーバ管理者であってもファイルを閲覧できないように共有ファイルを暗号化してサーバ上に置き,その復号鍵をグループのメンバが持ち,ファイルを共有する方法が考えられる.復号鍵はグループごとに異なるのが一般的であり,ユーザが管理する必要のある鍵数は,多重帰属するグループ数が増えるほど増加し,管理負担が増えることになる.そこで本稿では,ファイル復号鍵をElGamal閾値暗号により管理し,グループ秘密鍵を木構造に分散してサーバとメンバで分散所有するファイル共有システムにおけるファイル共有プロトコルおよびグループ管理に関するプロトコルを提案する.提案プロトコルは複数のグループに多重帰属するユーザであっても,グループ数によらず一つの鍵だけで各グループで共有しているファイルを復号できるという特徴を持つ.

ストリーム暗号用の擬似乱数生成器である非線形コンバイナ型乱数生成器(NCG)の予測不可能性の解析アプローチとして高速相関攻撃(FCA)がよく知られている.FCAは,NCGの構成を既知と仮定し,平文と暗号文の対からNCGの出力ビット列を求め,NCGを構成する線形フィードバックシフトレジスタ(LFSR)の出力ビット列とNCGの出力ビット列の相関関係からLFSRの初期値を再構成する攻撃である.先に福田,白石,森井らは,事後確率復号法を利用して量LFSRの初期値を推定する際に,推定済みのビット情報からパリティ検査式の集合を動的に構成,それを使用するFCA(D-FCA)を提案している.本稿では,D-FCAにおける,LFSRの初期値推定アルゴリズムの改良手法を提案し,計算機上のシミュレーション実験により攻撃のリミットノイズが向上することを示す.

ユーザ情報の保護という観点から,セキュリティに対して異なる信頼度のサービス提供者が混在するP2P型サービスにおいては,利用者の秘密情報をサービス提供者に登録しない方法が望ましい.秘密情報を登録しない方法としてPKIに基づくサービスが考えられるが,認証局に署名の検証依頼が集中すること,公開鍵の更新が容易でないこと,などの問題があげられる.本稿では,サービス提供者に秘密情報を登録することなく,サービス提供者が共通に使える使い捨て鍵型認証基盤を提案する.

高速相関攻撃(FCA)は、擬似乱数生成器の構造を既知と仮定して、平文系列と暗号文系列の対から得られる擬似乱数系列から、擬似乱数生成器の内部状態を再構成するという既知平文攻撃である。FCAの議論では、一般に、攻撃対象として、非線形コンバイナ型乱数生成器(NCG)と呼ばれる複数の2元の線形フィードバックシフトレジスタ(LFSR)と非線形ブール関数から構成された擬似乱数生成器が想定されている。本研究では、LFSRの出力系列を推定する際に、過去に推定したビットの情報を用いてパリティ検査式の集合を動的に構成し、それを用いてビットを推定するというFCAの手法を提案し、攻撃の成功確率、攻撃に要する計算量、メモリサイズの式を導出して、提案手法が既存手法に比べてLFSRの出力系列を高い精度で推定できることを示した。