開放的網路通訊環境中，經由身分認證可以確保通訊的內容不會被接收者以外的人知道，從而確保隱私或是公平性。本篇論文提出了兩種身分認證的方案與一種公平的反向拍賣方法。在第一個身分認證的方法中，我們提出了只使用邏輯互斥或和哈希函數的方案。利用向控制伺服器註冊時得到的密鑰，在身分認證時向控制伺服器認證身分，並取得和通訊對象通訊時使用的對稱加密密鑰。由於使用了運算量較低的操作，此方案擁有了高安全性外，同時維持較低的運算負擔，因此可以運用在如物聯網(IoT)設備等計算力受限的設備上。在第二個身分認證的方法中，則是提出了一個基於環簽名的方案。該方法結合了ECC加密，環簽名保護了訊息送出者的身分，而ECC加密內容則保護了傳送的訊息不會讓接收者以外的人知道。這個方案運用在團體醫療諮詢上，不僅可以保護病人的隱私，在產生醫療糾紛時也可以避免只揭露其中一名醫生身分的不公平。而在第三個方法中，我們提出了一個公平的反向拍賣方案。首先我們討論了在反向拍賣中的賄賂問題，並指出Wenbo Shi的方案中存在的安全問題。我們利用ECC替代Paillier加密來避免賣家的身分洩漏，以防止賄賂問題發生。該方案因為它的賣家匿名和正確性可以使用於政府採購上。所提出的三個方法在對應的應用環境中，在效率和安全性上優於其他幾種身分認證方案或反向拍賣方案。

In the open network communication environment, authentication can ensure that the content of communication will not be known by anyone except the receiver. Therefore, the privacy or fairness will be guaranteed. In this paper, two authentication schemes and a fair reverse auction are proposed. In the first authentication method, we propose an authentication scheme that only using xor operation and hash function. With the secret key received from the control server when registering to it, user can be authenticated by the control server when running the authentication scheme. After the authentication scheme, user can get a symmetric encryption key to communicate with the target. Because using the light calculation operation, this scheme not only has highly security but also keeps the computing load lower. Therefore, this scheme can be used on the equipment with limited computing power such as Internet of Thing (IoT). In the second authentication method, we propose a ring signature based scheme. This scheme combines the Elliptic Curve Cryptography (ECC). Ring signature property protects the identity of the message sender, and the ECC encrypts the message so that the content will not be known by anyone except the receiver. Using this scheme on the group medical consultation can not only protect the patient's privacy but also avoid the unfair that only revealing one doctor's identity when there is a patient-medical care dispute. And in the third method, we propose a fair reverse auction. First we discuss the bribing problem in the reverse auction, then point out the weakness in Wenbo Shi's scheme. We use the ECC instead of Paillier encryption to prevent the leakage of seller's identity so that the bribing problem will not occur. This method can be used in government procurements due to its anonymity of seller and correctness. The proposed three methods have better efficiency and security than several authentication schemes or reverse auctions in the corresponding environment.

[1] Luigi Atzori, Antonio Iera and Giacomo Morabito, “The Internet of Things: A survey,” Computer Networks, Vol. 54, No. 15, pp. 2787-2805, 2010.
[2] Mingping Qi, Jianhua Chen and Yitao Chen, “A secure authentication with key agreement scheme using ECC for satellite communication systems,” International Journal of Satellite Communications and Networking, Vol. 37, No. 3, 2018.
[3] Thomas Kothmayr, Corinna Schmitt, Wen Hu, Michael Brünig and Georg Carle, “DTLS based security and two-way authentication for the Internet of Things,” Ad Hoc Networks, Vol. 11, No. 8, pp. 2710-2723, 2013.
[4] IIung Pranata, Rukshan I. Athauda and Geoff Skinner, “Securing and governing access in ad-hoc networks of Internet of Things,” In Proceedings of the IASTED International Conference on Engineering and Applied Science, Colombo, Sri Lanka, pp. 84-90, 27-29 December 2012.
[5] M. Durairaj and Kaliyanasundaram Muthuramalingam, “A new authentication scheme with elliptical curve cryptography for Internet of Things (IoT) environments,” International Journal of Engineering & Technology, Vol. 7, No. 2.26, pp. 119-124, 2018.
[6] Ning Hong, “A security framework for the Internet of Things based on public key infrastructure,” Advanced Materials Research, Vol. 671-674, pp. 3223-3226, 2013.
[7] Peng Hao, Xianbin Wang and Weiming Shen, “A collaborative PHY-aided technique for end-to-end IoT device authentication,” IEEE Access, Vol. 6, pp. 42279-42293, 2018.
[8] Khalid Mahmood, Shehzad Ashraf Chaudhry, Husnain Naqvi, Taeshik Shon and Hafiz Farooq Ahmad, “A lightweight message authentication scheme for smart grid communications in power sector,” Computers & Electrical Engineering, Vol. 52, pp. 114-124, 2016.
[9] Youngseok Chung, Seokjin Choi, Youngsook Lee, Namje Park and Dongho Won, “An enhanced lightweight anonymous authentication scheme for a scalable localization roaming service in wireless sensor networks,” Sensors, Vol. 16, pp. 1653:1-16, 2016.
[10] Muhamed Turkanović, Boštjan Brumen and Marko Hölbl, “A novel user authentication and key agreement scheme for heterogeneous ad hoc wireless sensor networks, based on the Internet of Things notion,” Ad Hoc Networks, Vol. 20, pp. 96-112, 2014.
[11] Mian Ahmad Jan, Fazlullah Khan, Muhammad Alam and Muhammad Usman, “A payload-based mutual authentication scheme for Internet of Things,” Future Generation Computer Systems, Vol. 92, pp. 1028-1039, 2019.
[12] Xuebin Sun, Shuang Men, Chenglin Zhao and Zheng Zhou, “A security authentication scheme in machine-to-machine home network service,” Security and Communication Networks, Vol. 8, No. 16, pp. 2678-2686, 2012.
[13] Chen Lyu, Dawu Gu, Yunze Zeng and Prasant Mohapatra, “PBA: prediction-based authentication for vehicle-to-vehicle communications,” IEEE Transactions on Dependable and Secure Computing, Vol. 13, No. 1, pp. 71-83, 2016.
[14] Prosanta Gope, Jemin Lee and Tony Q. S. Quek, “Lightweight and practical anonymous authentication protocol for RFID systems using physically unclonable functions,” IEEE Transactions on Information Forensics and Security, Vol. 13, No. 11, pp. 2831-2843, 2018.
[15] He Xu, Jie Ding, Peng Li, Feng Zhu and Ruchuan Wang, “A lightweight RFID mutual authentication protocol based on physical unclonable function,” Sensors, Vol. 18, No. 3, pp. 760:1-20, 2018.
[16] Leslie Lamport, “Password authentication with insecure communication,” Communications of the ACM, Vol. 24, No. 11, pp. 770-772, 1981.
[17] Jonathan Katz, Philip MacKenzie, Gelareh Taban and Virgil Gligor, “Two-server password-only authenticated key exchange” Journal of Computer and System Sciences, Vol. 78, No. 2, pp. 651-669, 2012.
[18] Tao Xiang, Kwok-wo Wong and Xiaofeng Liao, “Cryptanalysis of a password authentication scheme over insecure networks,” Journal of Computer and System Sciences, Vol. 74, No. 5, pp. 657-661, 2008.
[19] Hung-Min Sun and Her-Tyan Yeh, “Password-based authentication and key distribution protocols with perfect forward secrecy,” Journal of Computer and System Sciences, Vol. 72, No. 6, pp. 1002-1011, 2006.
[20] Hung Yu Chien, Jinn Ke Jan and Yuh-Min Tseng, “An efficient and practical solution to remote authentication: smart card,” Computers and Security, Vol. 21, No. 4, pp. 372-375, 2002.
[21] Jing Xu, Wen-Tao Zhu and Deng-Guo Feng, “An improved smart card based password authentication scheme with provable security,” Computer Standards & Interfaces, Vol. 31, No. 4, pp. 723-728, 2009.
[22] Manoj Kumar, Mridul Kumar Gupta and Saru Kumari, “An improved efficient remote password authentication scheme with smart card over insecure networks,” International Journal of Network Security, Vol. 13, No. 2, pp. 167-177, 2011.
[23] Yi-Pin Liao and Shuenn-Shyang Wang, “A secure dynamic ID based remote user authentication scheme for multi-server environment,” Computer Standards & Interfaces, Vol. 31, No. 1, pp. 24-29, 2009.
[24] Han-Cheng Hsiang and Wei-Kuan Shih, “Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment,” Computer Standards & Interfaces, Vol. 31, No. 6, pp. 1118-1123, 2009.
[25] Sandeep K. Sood, Anil K. Sarje and Kuldip Singh, “A secure dynamic identity based authentication protocol for multi-server architecture,” Journal of Network and Computer Applications, Vol. 34, No. 2, pp. 609-618, 2011.
[26] Cheng-Chi Lee, Tsung-Hung Lin and Rui-Xiang Chang, “A secure dynamic ID based remote user authentication scheme for multi-server environment using smart cards,” Expert Systems with Applications, Vol. 38, No. 11, pp. 13863-13870, 2011.
[27] Kaiping Xue, Peilin Hong and Changsha Ma, “A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture,” Journal of Computer and System Sciences, Vol. 80, No. 1, pp. 195-206, 2014.
[28] Ruhul Amin, Neeraj Kumar, G.P. Biswas, R. Iqbal and Victor Chang, “A light weight authentication protocol for IoT-enabled devices in distributed cloud computing environment,” Future Generation Computer Systems, Vol. 78, No. 3, pp. 1005-1019, 2018.
[29] Lu Zhou, Xiong Li, Kuo-Hui Yeh, Chunhua Su and Wayne Chiu, “Lightweight IoT-based authentication scheme in cloud computing circumstance,” Future Generation Computer Systems, Vol. 91, pp. 244-251, 2019.
[30] Chun-Ta Li, Chi-Yao Weng, Cheng-Chi Lee and Chun-Cheng Wang, “Secure user authentication and user anonymity scheme based on quadratic residues for the integrated EPRIS,” Procedia Computer Science, Vol. 52, No. 1, pp. 21-28, 2015.
[31] Kuo-Hui Yeh, Nai-Wei Lo, Ren-Zong Kuo, Chunhua Su and Hsuan-Yu Chen, “Formal analysis on RFID authentication protocols against de-synchronization attack,” Journal of Internet Technology, Vol. 18, No. 4, pp. 765-773, 2017.
[32] Tanmoy Maitra, SK Hafizul Islam, Ruhul Amin, Debasis Giri, Muhammad Khurram Khan and Neeraj Kumar, “An enhanced multi-server authentication protocol using password and smart-card: cryptanalysis and design,” Security and Communication Networks, Vol. 9, No. 17, pp. 4615-4638, 2016.
[33]. Z.Y. Wu, Y.C. Lee, F. Lai, H.C. Lee, Y. Chung, “A secure authentication scheme for telecare medicine information systems,” J. Med. Syst., 36(3):1529-1535, 2012.
[34]. D.B. He, J.H. Chen, R. Zhang, “A more secure authentication scheme for telecare medicine information systems,” J. Med. Syst., 36(3):1989-1995, 2012.
[35]. J.Wei, X. Hu, W. Liu, “An improved authentication scheme for telecare medicine information systems,” J. Med. Syst., 36(6):3597-3604, 2012.
[36]. Z. Zhu, “An efficient authentication scheme for telecare medicine information systems,” J. Med. Syst., 36(6):3833-3838, 2012.
[37]. Q. Pu, J. Wang, R.Y. Zhao, “Strong authentication scheme for telecare medicine information systems,” J. Med. Syst., 36 (4):2609-2619, 2012.
[38]. H.M. Chen, J.W. Lo, C.K. Yeh, “An efficient and secure dynamic ID-based authentication scheme for telecare medical information systems,” J. Med. Syst., 36(6):3907-3915, 2012.
[39]. T.J. Cao, J.X. Zhai, “Improved dynamic ID-based authentication scheme for telecare medical information systems,” J. Med. Syst., 37(2):1-7, 2013.
[40]. Q. Xie, J. Zhang, N. Dong, “Robust anonymous authentication scheme for telecare medical information systems,” J. Med. Syst., 37(2):1-8, 2013.
[41]. H.Y. Lin, “On the security of a dynamic ID-based authentication scheme for telecare medical information systems,” J. Med. Syst., 2013, doi:10.1007/s10916-013-9929-4.
[42]. Q. Jiang, J.F. Ma, Z. Ma, G.S. Li, “A privacy enhanced authentication scheme for telecare medical information systems,” J. Med. Syst., 37(1):1-8, 2013.
[43]. F. Wu, L. Xu, “Security analysis and improvement of a privacy authentication scheme for telecare medical information systems,” J. Med. Syst., 2014. doi:10.1007/s10916-013-9958-z.
[44]. F. Wen, D. Guo, “An improved anonymous authentication scheme for telecare medical information systems,” J. Med. Syst., 38(5):1-11, 2014.
[45]. C. T. Li, C. C. Lee, C. Y. Weng, “A secure chaotic maps and smart cards based password authentication and key agreement scheme with user anonymity for telecare medicine information systems,” J.Med.Syst., 38(9):1-11,2014..
[46]. A.K. Das, A. Goswami, “An enhanced biometric authentication scheme for telecare medicine information systems with nonce using chaotic hash function. J. Med. Syst., 38(6):1-19, 2014.
[47]. J. Liu, Z. Zhang, X. Chen, K. Kwak, “Certificateless remote anonymous authentication schemes for wireless body sensor networks,” IEEE Trans. Parallel Distrib. Syst., 25(2): 332-342, 2014.
[48]. Z. Zhao, “An efficient anonymous authentication scheme for wireless body area networks using elliptic curve cryptosystem,” J. Med.Syst., 38(2):1-7, 2014.
[49]. R.L. Rivest, A. Shamir, Y. Tauman, “How to leak a secret”, in Proceedings of Advances in Cryptology: Asiacrypt’01, LNCS, 2248: 552-565, Springer-Verlag, 2001.
[50]. M. Abe, M. Ohkubo, K. Suzuki, “1-out-of-n signatures from a variety of keys,” in Proceedings of Advances in Cryptology: Asiacrypt’02, LNCS, 2501: 415-432, Springer-Verlag, 2002.
[51]. E. Bresson, J. Stern, M. Szydlo, “Threshold ring signatures and applications to ad-hoc groups,” in Proceedings of Advances in Cryptology: Crypto’02, LNCS, 2442: 465-480, Springer -Verlag, 2002.
[52]. D. Boneh, C. Gentry, B. Lynn, H. Shacham, “Aggregate and verifiably encrypted signatures from bilinear maps,” in Proceedings of Advances in Cryptology: Eurocrypt’03, LNCS, 2656: 416–432, Springer-Verlag, 2003.
[53]. Y. Dodis, A. Kiayias, A. Nicolosi, V. Shoup, “Anonymous identification in ad hoc groups,” in Proceedings of Advances in Cryptology: Erocrypt’04, LNCS, 3027: 609-626,Springer-Verlag, 2004.
[54]. A. Bender, J. Katz, R. Morselli, “Ring signatures: stronger definitions, and constructions without random oracles,” in Proceedings of Third Theory of Cryptography Conference, 60-79, 2006.
[55]. D. Chaum, E. van Heyst, “Group signatures,” in Proceedings of Advances in Cryptology: Erocrypt’91, LNCS, 547: 257-265, 1991.
[56]. M. Bellare, D. Micciancio, B. Warinschi, “Foundations of group signatures: formal definitions, simplified requirements, and a construction based on general assumptions,” in Proceedings of Advances in Cryptology: Eurocrypt’03, LNCS, 2656: 614-629, 2003.
[57]. J. Camenisch, M. Stadler, “Efficient group signature schemes for large groups (Extended Abstract),” in Proceedings of Advances in Cryptology: Crypto’97, LNCS, 1294: 410-424, 1997.
[58]. V. S. Miller, “Use of elliptic curves in cryptography,” in Proceedings of 5th International Cryptology Conference, LNCS, 218: 417-426, 1986.
[59]. N. Koblitz, “Elliptic curve cryptosystems,” Mathematics of Computation, 48(177): 203-209, 1987.
[60]. N. Gura, A. Patel, A. Wander, H. Eberle and S. C. Shantz, “Comparing elliptic curve cryptography and RSA on 8-bit CPUs,” in Proceedings of the 6th Int. Workshop on Cryptographic Hardware and Embedded Systems, LNCS, 3156:119-132, 2004.
[61]. J. Hoffstein, J. Pipher and J. H. Silverman, “An introduction to mathematical cryptography,” Springer-Verlag, New York, 2008.
[62]. J. W. Bos, A. Halderman, N. Heninger, J. Moore, M. Naehrig and E. Wustrow, “Elliptic curve cryptography in practice,” in Proceedings of 18th Int. Conf. on Financial Cryptography and Data Security, LNCS, 8437:157-175:2014.
[63]. Z. Tan, Z. Liu, C. Tang, “Digital proxy blind signature schemes based on DLP and ECDLP,” MM Research preprints, 21(7):212-217, 2002.
[64]. K. A. Shim, “An efficient ring signature scheme from pairings,” Information Sciences, 300: 63-69, 2015.
[65]. S.K. Islam, G.P. Biswas, “A more efficient and secure ID based remote mutual authentication with key agreement scheme for mobile devices on elliptic curve cryptosystem,” J. Syst. Softw., 84(11):1892-1898, 2011.
[66]. C.T. Li, “A new password authentication and user anonymity scheme based on elliptic curve cryptography and smart card,” IET Inforamtion. Security, 7(1):3-10, 2013.
[67]. D. Guo, Q. Wen, W. Li, H. Zhang, Z. Jin, "A novel authentication scheme using self-certified public keys for telecare medical information systems," J. Med. Syst.,39(6 ): 1-8: 2015.
[68]. M.K. Khan, S.K. Kim, K. Alghathbar, “Cryptanalysis and security enhancement of a more efficient & secure dynamic id-based remote user authentication scheme,” Comput. Commun., 34(3):305-309, 2010.
[69] K. Suzuki and M. Yokoo, "Secure Multi-attribute Procurement Auction, " Inf. Secur. Appl., 3786:306-317, 2006.
[70] D. H. Shih, C. H. Cheng, and J. C. Shen, "A secure protocol of reverse discriminatory auction with bid privacy," In Management of Mobile Business, ICMB 2007, International Conference on the, Ontario, Canada, 2007.
[71] D. C. Parkes, M. O. Rabin, S. M. Shieber, and C. Thorpe, "Practical secrecy-preserving, verifiably correct and trustworthy auctions," Electron. Commer. R. A., 7(3): 294-312, 2008.
[72] H. Xiong, Z. Qin, and F. Li, "An anonymous sealed-bid electronic auction based on ring signature," Int. J. Netw. Security, 8(3):236–243, 2009.
[73] T. R. Srinath, S. Kella, and M. Jenamani, "A new secure protocol for multi-attribute multi-round e-reverse auction using online trusted third party," In Emerging Applications of Information Technology (EAIT), 2011 Second International Conference on , IEEE:149-152, 2011.
[74] T. R. Srinath, M. P. Singh, and A. R. Pais, "Anonymity and verifiability in multi-attribute reverse auction," In International Journal of Information Technology Convergence and Services ( IJITCS), 1(4): 2011.
[75] H. Xiong, Z. Chen, and F. Li, "Bidder-anonymous English auction protocol based on revocable ring signature," Expert Syst. Appl., 3(8):7062–7066, 2012.
[76] C. C. Chang, T. F. Cheng, and W. Y. Chen, "A novel electronic English auction system with a secure on-shelf mechanism," IEEE T. Inf. Foren. Sec., 8(4): 657-668, 2013.
[77] M. Nojoumian and D. R. Stinson. "Efficient Sealed-Bid Auction Protocols Using Verifiable Secret Sharing," Information Security Practice and Experience, Springer International Publishing: 302-317, 2014.
[78] W. Shi, "A provable secure sealed‐bid multi‐attribute auction scheme under semi‐honest model," Int. J. Commun. Syst., 27(12): 3738-3747, 2014.
[79] M. J. Freedman, K. Nissim, and B. Pinkas, "Efficient private matching and set intersection," in Advances in Cryptology-EUROCRYPT:1-19, 2004.
[80] P. Paillier, "Public-key cryptosystems based on composite degree residuosity classes," in Proc. EUROCRYPT’99, LNCS, 1592:223-238, 1999.
[81] H. T. Liaw, W. S. Juang, and C. K. Lin, “An electronic online bidding auction protocol with both security and efficiency,” Appl. Math. Comput., 174(2):1487–1497, 2006.
[82] C. C. Chang and T. F. Cheng, “An efficient proxy raffle protocol with anonymity-preserving,” Comput. Stand. Interfaces, 31(4):772–778, 2009.
[83] E. Pinker, A. Seidmann, and Y. Vakrat, “Using bid data for the management of sequential, multi-unit, online auctions with uniformly-distributed bidder valuations,” Eur. J. Oper. Res., 202(2):574–583, 2010.
[84] J. S. Lee and K. S. Lin, “An innovative electronic group-buying system for mobile commerce,” Electron. Commer. Res. Appl, 12(1):1-13, 2013.
[85] R. L. Rivest, A. Shamir, Y. Tauman “How to leak a secret,” Advances in Cryptology—ASIACRYPT 2001. Springer Berlin Heidelberg: 552-565, 2001.
[86] R. L. Rivest, A. Shamir, L. Adleman. “A method for obtaining digital signatures and public-key cryptosystems,” Communications of the ACM, 26(1): 96-99, 1983.
[87] G. Baranwal and D. P. Vidyarthi, "A Truthful and Fair Multi-Attribute Combinatorial Reverse Auction for Resource Procurement in Cloud Computing," in IEEE Transactions on Services Computing, vol. 12, no. 6, pp. 851-864, 1 Nov.-Dec. 2019, doi: 10.1109/TSC.2016.2632719.
[88] Kumar D., Baranwal G., Raza Z., Vidyarthi D.P. (2019) Fair Mechanisms for Combinatorial Reverse Auction-Based Cloud Market. In: Satapathy S., Joshi A. (eds) Information and Communication Technology for Intelligent Systems. Smart Innovation, Systems and Technologies, vol 107. Springer, Singapore