• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.14 no.8
• /
• pp.1855-1860
• /
• 2010

This paper describes construction of web services system for secure message transmission appling web services standards. This system composes single sign on module, SSL module and secure message module. We applied these modules to price comparison site. Single sign on module used SAML standards. This module was designed, in order to provide authentication and authorization. As SSL module processes message encryption among end to end, messages of this system are secure. Secure message module is designed according to WS-Security standards and processes authentication, XML signature and XML encryption.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.6 no.4
• /
• pp.3-38
• /
• 1996

The mobile station shall convolutionally encode the data transmitted on the reverse traffic channel and the access channel prior to interleaving. Code symbols output from the convolutional encoder are repeated before being interleaved except the 9600 bps data rate. All the symbols are then interleaved, 64-ary orthogonal modulation, direct-sequence spreading, quadrature spreading, baseband filtering and QPSK transmission. The sync, paging, and forward traffic channel except the pilot channel in the forward CDMA channel are convolutionally encoded, block interleaved, spread with Walsh function at a fixed chip rate of 1.2288 Mcps to provide orthogonal channelization among all code channels. Following the spreading operation, the I and Q impulses are applied to respective baseband filters. After that, these impulses shall be transmitted by QPSK. Authentication in the CDMA system is the process for confirming the identity of the mobile station by exchanging information between a mobile station and the base station. The authentication scheme is to generate a 18-bit hash code from the 152-bit message length appended with 24-bit or 40-bit padding. Several techniques are proposed for the authentication data computation in this paper. To protect sensitive subscriber information, it shall be required enciphering ceratin fields of selected traffic channel signaling messages. The message encryption can be accomplished in two ways, i.e., external encryption and internal encryption.

• Journal of KIISE:Information Networking
• /
• v.32 no.5
• /
• pp.551-560
• /
• 2005

To reduce the amount of the signaling messages occurred in movement, HMIPv6 has been introduced as the hierarchical mobility management architecture tor MIPv6 by regarding the locality of movements. When approaching the visited link, the authentication procedure should be done successfully prior to any motility support message exchanges. The AAA(Authentication, Authorization and Account) authentication service is applied gradually to the wireless LAN and Cellular networks. However, It may bring about the service latency for the sessions of requiring the real-time processing due to not providing the optimized signaling in local and frequent movements. In this paper, we propose the authentication architecture with 'delegation' scheme to reduce the amount of signaling message and latency to resume for local movements by integrating it with HMIPv6 architecture. We provide the integrated authentication model and analyze the performance and effectivity of our proposal and finally offer the analysis materials comparing to the exiting authentication scheme. It cuts down the cost to $33.6\%$ at average measurement.

• Journal of Communications and Networks
• /
• v.11 no.6
• /
• pp.574-588
• /
• 2009

Although much research has been conducted in the area of authentication in wireless networks, vehicular ad-hoc networks (VANETs) pose unique challenges, such as real-time constraints, processing limitations, memory constraints, frequently changing senders, requirements for interoperability with existing standards, extensibility and flexibility for future requirements, etc. No currently proposed technique addresses all of the requirements for message and entity authentication in VANETs. After analyzing the requirements for viable VANET message authentication, we propose a modified version of TESLA, TESLA++, which provides the same computationally efficient broadcast authentication as TESLA with reduced memory requirements. To address the range of needs within VANETs we propose a new hybrid authentication mechanism, VANET authentication using signatures and TESLA++ (VAST), that combines the advantages of ECDSA signatures and TESLA++. Elliptic curve digital signature algorithm (ECDSA) signatures provide fast authentication and non-repudiation, but are computationally expensive. TESLA++ prevents memory and computation-based denial of service attacks. We analyze the security of our mechanism and simulate VAST in realistic highway conditions under varying network and vehicular traffic scenarios. Simulation results show that VAST outperforms either signatures or TESLA on its own. Even under heavy loads VAST is able to authenticate 100% of the received messages within 107ms. VANETs use certificates to achieve entity authentication (i.e., validate senders). To reduce certificate bandwidth usage, we use Hu et al.'s strategy of broadcasting certificates at fixed intervals, independent of the arrival of new entities. We propose a new certificate verification strategy that prevents denial of service attacks while requiring zero additional sender overhead. Our analysis shows that these solutions introduce a small delay, but still allow drivers in a worst case scenario over 3 seconds to respond to a dangerous situation.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.42 no.2
• /
• pp.349-357
• /
• 2017

Many Web sites adopt SMS(Short Message Service)-based user authentication when a user loses her password or approves an online payment. In SMS-based authentication, the authentication server sends a text in plaintext to a user's phone, and it allows an attacker who eavesdrops or intercepts the text to impersonate a valid user(victim). We propose a challenge-response scheme to prove to the authentication server that a user is in a certain place at the moment with her smartphone beside her. The proposed scheme generates a response using a challenge by the server, user's current location, and a secret on the user's smartphone all together. Consequently, the scheme is much more secure than SMS-based authentication that simply asks a user to send the same text arrived on her phone back to the server. In addition to entering the response, which substitutes the SMS text, the scheme also requests a user to input a passphrase to get the authentication process started. We believe, however, the additional typing should be tolerable to most users considering the enhanced security level of the scheme.

• The KIPS Transactions:PartC
• /
• v.9C no.4
• /
• pp.551-562
• /
• 2002

We usually applied PPP CHAP when the visited ISP subscriber accesses to authentication server in own home ISP network and IP Assignment for remote Internet service. But PPP CHAP doesn't support in case of visited ISP subscriber in GPRS network accesses to authentication sorrel in own home ISP network for wireless Internet service. We suggest solution for this problem with PPP CHAP improvement. For this we propose the modified PPP CHAP message format, PCO Message format at MT, and interworking message and format between GGSN and RADIUS in home ISP network for wireless internet service of mobile ISP subscriber at GPRS network in this paper. We also show authentication results when visited mobile ISP subscriber via PPP CHAP at GPRS network accesses the RADIUS server in home ISP network.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.34 no.2B
• /
• pp.162-169
• /
• 2009

Message Authentication Code (MAC) assures integrity of messages. In Mobile WiMAX, 128-bit Cipher-based MAC (CMAC) is calculated for management messages but only the least significant half is actually used truncating the most significant 64 bits. Naming these unused most significant 64bits Shared Authentication Information (SAI), we suggest that SAI can be applied to protect the network from DDoS attack which exploits idle mode vulnerabilities. Since SAI is the unused half of CMAC, it is as secure as 64bits of CMAC and no additional calculations are needed to obtain it. Moreover, SAI doesn't have to be exchanged through air interface and shared only among MS, BS, and ASN Gateway. With these good properties, SAI can efficiently reduce the overheads of BS and ASN GW under the DDoS attack.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.25 no.4B
• /
• pp.700-707
• /
• 2000

In this paper, we address vulnerabilities of legacy VOD system and implement secure-VOD system to protect security holes of it. Our secure-VOD system provide user authentication using one-time password, message authentication and encryption/decryption for video server information. To improve security of existing fixed password system, our secure-VOD system use one-time password. Also, our secure-VOD system provides integrity for video server information by generating and verifying message authentication code using HMAC-HAS 160 algorithm. Finally, our secure-VOD system uses RC5 encryption algorithm to guarantee confidentiality for video server information.

• Proceedings of the IEEK Conference
• /
• 2000.07b
• /
• pp.961-964
• /
• 2000

With the advance of wireless communications technology, mobile communications has become more convenient than ever. However because of the openness of wireless communications, how to protect the privacy between communicating parties is becoming a very important issue. In this paper an authentication and encryption algorithm of the GSM network for roaming user is proposed. In the proposed algorithms, we use a new hash function for user authentication and LFSR (Linear Feedback Shift Register) based stream cipher for message encryption and decryption. Each algorithm is programmed with C language and simulated on IBM-PC system and we analyze the randomness properties of the developed algorithm using statistical analysis.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.813-816
• /
• 2002

현재 인터넷은 IPv4(Internetworking Protocol, version 4)를 사용하고 있다. 하지만 데이터 통신은 1970년대에 IPv4가 나온 이래에 발전을 거듭하여 왔다. IPv4는 빠르게 발전하는 인터넷에의 요구를 수용하기 위해 IPv6가 제안되었고 현재 표준이 되었다. IPv6에서는 암호화와 인증옵션들은 패킷의 신뢰성과 무결성을 등을 제공한다. 인터넷에서의 정보보호는 인터넷을 구성하는 여러 계층에서 이루어 질 수 있지만, IPsec에서는 AH(Authentication Header)프로토콜과 IPsec ESP(Encapsulating Security Payload)프로토콜 두 가지의 암호 프로토콜이 사용되지만 AH에서는 HMAC를 이용한 HMAC-MD5나 HMAC-SHA-1 중 하나를 반드시 기본 인증 알고리즘으로 지원하여야 한다. 본 논문에서는 MD5를 이용한 HMAC-MD5를 기준으로 설계하였으며, Iterative Architecture과 Full loop unrolling Architecture의 두 가지 구조를 설계하였다.