• Journal of the Korea Society of Computer and Information
• /
• v.19 no.7
• /
• pp.87-93
• /
• 2014

TIn analysis as the first step of S/W development, security requirements of identification and authentication, ID and password management, authentication process, authentication method, ete. should be defined. Identification is to uniquely identify certain users and applications running on a certain system. Authentication means the function to determine true or false users and applications in some cases. This paper is to suggest the security requirements for identification and authentication in analysis step. Firstly, individual ID should be uniquely identified. The second element is to apply the length limitations, combination and periodic changes of passwords. The third should require the more reinforced authentication methods besides ID and passwords and satisfy the defined security elements on authentication process. In this paper, the security requirements for the step of identification and authentication have been explained through several practical implementation methods.

• Journal of Digital Convergence
• /
• v.13 no.7
• /
• pp.197-205
• /
• 2015

Existing Web authentication method utilizes the resident registration number by credit rating agencies separating i-PIN authentication method which has been improved authentication using resident registration number via the real name confirmation database. By improving the existing authentication method, and it provides the available integrated ID authentication on Web. In order to enhance safety, the proposed authentication method by encrypting the user of the verification value, and stores the unique identifier in the database of the certificate authority. Then, the password required to log in to the Web is for receiving a disposable random from the certificate authority, the user does not need to remember a separate password and receives the random number by using the smart phone. It does not save the user's personal information in the database, and it is easy to management of personal information. Only the integration ID needs to be remembered with random number on every time. It doesn't need to use various IDs and passwords if you use this proposed authentication methods.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.3
• /
• pp.9-21
• /
• 2010

Recently, famous online shopping websites were hit by hacking attack, and many users' personal information such as ID, password, account number, personal number, credit card number etc. were compromised. Hackers are continuing to attack online shopping websites, and the number of victims of these hacking is increasing. Especially, the exposure of credit card numbers is dangerous, because hackers maliciously use disclosed card numbers to gain money. In 2007 Financial Cryptography Conference, Ian Molly et al. firstly proposed dynamic card number generator, but it doesn't meet reuse resistant. In this paper, we analyzed security weaknesses of Ian Molly's scheme, and we proposed a new one-time virtual card number generator using a mobile device which meets security requirements of one-time virtual card numbers. Then, we propose one-time credit card number generation and transaction protocol using Integrated Authentication Center for user convenience and security enhancement.

• The Journal of the Korea Contents Association
• /
• v.2 no.4
• /
• pp.40-45
• /
• 2002

The network community provides people a new area which is called a cyber area, not physical area. However, today in the cyber area, the negative function has been causing social problem. In fact, it has not been causing by original function. Specifically speaking, main reason why it's leading to the negative function is that teenagers are logging into inappropriate sites (such as: violent, adult sites) to unnecessary sites (such as: e-mails with unknown signs combined with words, inappropriate language used in certain web board). Not only that, private password and ID's are being used by unknown user to accomplish illegal access. If this problem does not get solved through immediate development of technologies method, the cyber crime will increase in short period of time. The purpose of this paper is to understand each analyzed method which can cope with negative internet function, to discuss suitable management in certain web board an to check with fuzzy intercommunication mood.

• Journal of KIISE:Information Networking
• /
• v.29 no.4
• /
• pp.346-351
• /
• 2002

We improve a new probabilistic public key cryptosystem, in which the one wav function was defined only on the discrete logarithmic functions, proposed by Okamoto and Uchiyama. The plaintexts are calculated from the modular product of two these functions, one of which has a fixed value depending on a given public key. The improvement is achieved by a well-chosen public key assuming an unit element 1 as the fixed function value. Because it is possible to reduce the number of operations at the decryption. Also the concrete method for a public key of our improved scheme is suggested.

• Journal of Digital Convergence
• /
• v.10 no.2
• /
• pp.183-191
• /
• 2012

This study proposes dual certification model using both what users know and what users own. In detail, this mobile OTP generation model is made up of mobile OTP generation and extraction algorithm satisfying the conditions for reviewing mobile OTP implementation. In order to improve the security of the existing OTP-based systems, the suggested method utilizes user's ID and random number at the mobile OTP generation stage.

• Proceedings of the IEEK Conference
• /
• 2001.06c
• /
• pp.51-54
• /
• 2001

Recently Hwang and Li［1］ proposed a remote user authentication scheme using smart cards. Their scheme is based on the ElGamal public key cryptosystem and does not need to maintain a password table for verifying the legitimacy of the login users. In this paper, we proposed an advanced user authentication scheme using smart cards. Unlike Hwang and Li's scheme, smart card contains a pair of public parameters(h, P) where h is a hash function which is used in login phase. In result, we reduce one exponential computation frequency in login phase and two exponential computation frequencies in authentication phase with comparing the Hwang and Li's scheme. The proposed scheme not only provides the advantages as security of Hwang and Li's scheme, but also reduces computation cost.

• Management & Information Systems Review
• /
• v.6
• /
• pp.1-19
• /
• 2001

Partial transactions which use computer networks are formed in the cyberspace due to rapid progress of communication and computer technology. Electronic business transactions have security problems according to the special quality of opening networks, while it can be approached easily by anyone without being tied to time and places through Internets. To revitalize the electronic business transactions, security technology which can establish its security and trust is the prior task and both safe information communication and better information security service offer are essential factors. The method to exchange information through Internets must be made after confirming one another's exact connection in the mutual identity certification to prevent a lot of threat which can occur in the use of password techniques. To satisfy these electronic business transactions, we intend to increase understanding of authentication algorithm provided with authentication function of messages and users as well to plan safety and trust of business information and contents in the electronic business transactions.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.286-288
• /
• 2004

무선 통신의 발달로 언제 어디서나 누구와도 통신이 자유롭게 되었다 하지만, 무선 통신을 사용하게 됨으로써 통신 사용자와 액세스 포인트, 액세스 포인트와 서버(Server)가 통신을 할 경우 유선 네트워크와는 다른 인증 방식이 요구되었다. 무선 네트워크에서 사용자 인증을 위해 801.x EAP, SSID, CHAP 및 WEP를 이용한 다양한 인증 방식이 사용되고 있다. 본 논문에서는 사용자를 안전하게 인증할 수 있는 효율적인 인증 방법을 제안한다. 절기서는 기존의 PPP CHAP을 수정하여 인증 서버와 사용자간의 상호 인증을 할 수 있도록 했다. 또한 강한 일-방향 해시 함수(Strength One-Way Hash Function)을 사용하여 생성된 결과 값을 일회용 패스워드(One Time Password:OTP)로 사용하여 재공격(Reply Attack)을 방지했다.

• Proceedings of the Korean Institute of Intelligent Systems Conference
• /
• 2004.10a
• /
• pp.553-559
• /
• 2004

In todays security industry, personal identification is also based on biometric. Biometric identification is performed basing on the measurement and comparison of physiological and behavioral characteristics, Biometric for recognition includes voice dynamics, signature dynamics, hand geometry, fingerprint, iris, etc. Iris can serve as a kind of living passport or living password. Iris recognition system is the one of the most reliable biometrics recognition system. This is applied to client/server system such as the electronic commerce and electronic banking from stand-alone system or networks, ATMs, etc. A new algorithm using nonlinear function in recognition process is proposed in this paper. An algorithm is proposed to determine the localized iris from the iris image received from iris input camera in client. For the first step, the algorithm determines the center of pupil. For the second step, the algorithm determines the outer boundary of the iris and the pupillary boundary. The localized iris area is transform into polar coordinates. After performing three times Wavelet transformation, normalization was done using sigmoid function. The converting binary process performs normalized value of pixel from 0 to 255 to be binary value, and then the converting binary process is compare pairs of two adjacent pixels. The binary code of the iris is transmitted to the by server. the network. In the server, the comparing process compares the binary value of presented iris to the reference value in the University database. Process of recognition or rejection is dependent on the value of Hamming Distance. After matching the binary value of presented iris with the database stored in the server, the result is transmitted to the client.