• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.3A
• /
• pp.310-318
• /
• 2007

The RFID system is a non-contact automatic identification system that identifies tags through a reading device by attaching small, inexpensive tags on goods. This system is expected to supplant barcodes, the contactless reading technique that is most widely used at present. The RFID system can be applied in a variety of areas. Among those, Ari Juels proposed an environment to prove that a pair of tags has been scanned simultaneously And he presented a yoking proof protocol for this. But the yoking-proof protocol is vulnerable to replay attack. Although modified yoking-proof protocols for alleviating this drawback have been proposed, they are not immune to replay attack, either. In this paper, we analyze problems of existing yoking-proof protocols and present a new protocol, which will make replay attack difficult, based on this analysis. We have also extend this protocol so that it can provide yoking proofs for n tags.

• Proceedings of the IEEK Conference
• /
• 2001.09a
• /
• pp.227-230
• /
• 2001

반향(Echo)을 이용한 워터마킹은 오디오 신호에 인위적인 반향을 첨가함으로써 정보를 삽입한다. 다른 오디오 워터마킹 방법과 마찬가지로 반향 오디오 워터마킹은 시간축 공격에 대해 강인하지 못한 단점을 가지고 있다. 특히, 오디오 신호의 피치를 보존하면서 재생 시간을 변형시키는 시간 스케일 변형 (Time Scale Modification)에 대해서는 별도의 방어를 위한 알고리듬이 없을 경우 전혀 복호화가 이뤄지지 않는다. 본 논문에서는 반향 오디오 워터마킹의 성능 향상을 위해 시간 스케일 변형 공격에 대응하여, 변형된 정도를 검출하고 보상하여 복호화가 가능하도록 하는 새로운 알고리듬을 제안한다.

• Journal of the Korea Society of Computer and Information
• /
• v.28 no.5
• /
• pp.67-74
• /
• 2023

In this paper, we analyze the authentication protocol for DRM proposed by Hussain et al. in 2022, and present an improved solution. Hussain et al. argued that their authentication protocol guarantees man-in-the-middle attack, replay attacks, and mutual authentication. However, as a result of analyzing Hussain et al.'s authentication protocol in this paper, Hussain et al.'s authentication protocol still has an insider attack problem, a problem with Yu et al.'s authentication protocol that they pointed out. For this reason, when an inside attacker acquires information on a mobile device, a user impersonation attack was also possible. In addition, there were problems with the user's lack of ID format verification and the problem of the secret key mismatch of the digital contents between the server and the user. Therefore, this paper proposes an improved solution to solve these problems. As a result of analysis in this paper, the improved solution is safe from various attacks such as smart card attack, insider attack, and password guessing attack and can safely authenticate users of DRM.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.405-415
• /
• 2012

In many applications a reader needs to determine whether a particular tag exists within a group of tags without a server. This is referred to as serverless RFID tag searching. A few protocols for the serverless RFID searching are proposed but they are the single tag search protocol which can search a tag at one time. In this paper, we propose a multi-tag search protocol based on a hash function and a random number generator which can search some tags at one time. For this study, we introduce a protocol which can resolve the problem of synchronization of seeds when communication error occurs in the S3PR protocol[1], and propose a multi-tag search protocol which can reduce the communication overhead. The proposed protocol is secure against tracking attack, impersonation attack, replay attack and denial-of-service attack. This study will be the basis of research for multi-tag serach protocol.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.2
• /
• pp.159-166
• /
• 2012

Many biometrics-based user authentication schemes using smart cards have been proposed to improve the security weaknesses in user authentication system. In 2010, Chang et al. proposed an improved biometrics-based user authentication scheme without concurrency system which can withstand forgery attack, off-line password guessing attack, replay attack, etc. In this paper, we analyze the security weaknesses of Chang et al.'s scheme and we have shown that Chang et al.'s scheme is still insecure against man-in-the-middle attack, off-line biometrics guessing attack, and does not provide mutual authentication between the user and the server. And we proposed the improved scheme to overcome these security weaknesses, even if the secret information stored in the smart card is revealed. As a result, the proposed scheme is secure for the user authentication attack, the server masquerading attack, the man-in-the-middle attack, and the off-line biometrics guessing attack, does provide the mutual authentication between the user and the remote server. And, in terms of computational complexities, the proposed scheme is more effective than Chang et al.'s scheme.

• Journal of the Korea Society of Computer and Information
• /
• v.29 no.6
• /
• pp.53-60
• /
• 2024

In this paper, we analyze the authentication scheme of Hwang et al. proposed in 2023 and propose a new authentication scheme that improves its problems. Hwang et al. claimed that their authentication scheme was practical and secure, but as a result of analysis in this paper, it is possible to attack the password/ID guessing attack and session key disclosure attack due to insider attack and stolen smart card attack. In addition, Hwang et al.'s authentication scheme, which provides user anonymity, does not provide user untraceability due to its unstable design. The proposed authentication scheme, which improves these problems, not only provides user untraceability, but also is secure for stolen smart card attack, insider attack, session key disclosure attack, and replay attack. In addition, except for one fuzzy extraction operation, it shows the same complexity or very similar one as related authentication schemes. Therefore, the proposed authentication scheme can be said to be an authentication scheme with safety and practicality.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.1
• /
• pp.11-24
• /
• 2012

Without a proper protection mechanism for the signaling messages to be used for the mobility support in the Proxy Mobile IPv6 (PMIPv6), it is also vulnerable to several security attacks such as redirect attack, MITM (Man-In-The-Middle) attack, replay attack and DoS (Denial of Service) attack as in Mobile IPv6. In this paper, we point out some problems of previous authentication mechanisms associated with PMIPv6, and also propose a new fast and secure authentication mechanism applicable to PMIPv6. In addition, it is also shown that the proposed one is more efficient and secure than the previous ones.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.6
• /
• pp.83-92
• /
• 2009

Ari Juels proposed Yoking-Proof protocol for authenticating multiple tags simultaneously using RFID system. Because common Yoking-Proof methods authenticate by using MAC (Message Authentication Code), it is difficult to apply them to inexpensive tags. It is also difficult to implement common hash functions such as MD5 in inexpensive tags. So, Ari Juels also proposed a lightweighted Yoking-Proof method with only 1 authentication. However, Minimalist MAC, which is a lightweighted MAC used in the proposed method is for single-use, and the proposed structure is vulnerable to replay attacks. Therefore, in this study, the minimalist MAC using Lamport's digital signature scheme was adopted, and a new type of Yoking-Proof protocol was proposed where it uses tags that are safe from replay attacks while being able to save multiple key values.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2006.06a
• /
• pp.563-568
• /
• 2006

RFID 시스템 상에서의 보안 문제를 해결하기 위한 다양한 노력에도 불구하고 대부분의 기존 연구들은 안전한 RFID 시스템을 위한 보안 요구 사항을 완벽하게 충족시키지 못하였다. 또한, 일부 시스템은 RFID 태그의 연산 능력만을 고려할 뿐 백엔드 데이터베이스(Back-end Database)의 연산 부하는 비교적 고려대상이 아니었다. 하지만, 실용적인 RFID 시스템 설계를 위해서는 제한된 능력을 지닌 RFID 태그뿐만 아니라 데이터베이스의 연산량 또한 고려되어야 한다. 따라서 본 논문에서는 이 두 개체의 연산 부하를 줄이기 위한 효율적인 프로토콜을 제시한다. 제안된 프로토콜은 위치 추적 방지, 데이터베이스와 태그간의 상호 인증을 보장하며 재생 공격 및 스푸핑 공격에도 강인한 특성을 지니고 있다. 특히, 통신 장애나 악의적인 공격에 의해 비동기상태가 발생할 경우에도 데이터베이스와 태그는 손쉽게 동기를 회복할 수 있다.

• Review of KIISC
• /
• v.22 no.5
• /
• pp.73-78
• /
• 2012

스마트그리드는 기존 전력망에 IT 기술을 융합한 차세대 전력망이다. 전력망에 IT 기술을 도입함으로써 운영효율이 증가하고 다양한 부가서비스가 창출되지만 반대로 사이버 보안위협은 증가하게 된다. 사이버 보안위협의 기술적 증가요인으로는 신재생에너지의 보급으로 인한 전력망 연결 접점 증가와 실시간 양방향 통신으로 인한 스마트그리드 기기 공격, 양방향 통신 프로토콜 공격 가능성 존재 등이 있다. 또한, 환경적 증가요인으로는 스마트그리드는 전력망 특성상 사고 발생시 피해 규모가 크므로, 상대국 및 테러집단에 의한 주요 공격대상이 되고 있다는 점이다. 본 논문에서는 이러한 스마트 그리드 사이버 보안위협을 사전에 차단하기 위해, 스마트그리드의 핵심 기술이라 할 수 있는 AMI의 보안 취약점을 발견할 수 있는 현실적인 취약점 점검 항목을 제시한다.