• Journal of Industrial Convergence
• /
• v.20 no.11
• /
• pp.191-196
• /
• 2022

In the fintech field, financial transactions with smart phones are actively conducted. User authentication technology is essential for safe financial transactions. PIN authentication through the existing security keypads is convenient to input but has weaknesses in security and others. The biometric authentication technique is secure, but there is a possibility of false positive and false negative authentication. To compensate for this, two-factor authentication is used. In this paper, we propose the 1.5-factor authentication that can increase convenience and security through PIN input with biometric authentication. It provides the stability of fingerprint authentication and convenience of two or three PIN inputs, and this makes safe financial transaction possible. Since biometric authentication is performed at the same time when entering PIN, while security is required by applying fingerprint authentication to the area touched while entering PIN. The User authentication is performed while ensuring convenience to input through additional PIN input in situations where high safety is required, and Safe financial transactions are possible.

• Journal of Practical Engineering Education
• /
• v.16 no.3_spc
• /
• pp.327-332
• /
• 2024

The spread of smart phones provides users with a variety of services, making their lives more convenient. In particular, financial transactions can be easily made online after user authentication using a smart phone. Users easily access the service by authenticating using a PIN, but this makes them vulnerable to social engineering attacks such as spying or recording. We aim to increase security against social engineering attacks by applying the authentication method including imaginary numbers when entering a password at the door lock to smart phones. Door locks perform PIN authentication within the terminal, but in smart phones, PIN authentication is handled by the server, so there is a problem in transmitting PIN information safely. Through the proposed technique, multiple PINs containing imaginary numbers are generated and transmitted as processed values such as hash values, thereby ensuring the stability of transmission and enabling safe user authentication through a technique that allows the PIN to be entered without exposure.

• The KIPS Transactions:PartC
• /
• v.13C no.3 s.106
• /
• pp.359-368
• /
• 2006

AAA(Authentication, Authorization, Accounting) is the service that offers authentication, authorization, and accounting method, and every terminal that accesses the network requires this AAA service. The authentication process of a mobile terminal is as follows: a mobile phone accesses an authentication server in a home network via the authentication service in an external network, which receives the authentication result. And, for the home authentication server to offer secure service, a unique key is distributed for the secure communication between the external agent and the user, the external agent and the home authentication server, and the user and the home authentication server. This paper discusses and proposes the key distribution for secure communication among external authentication servers when a mobile terminal travels to an external network. As the proposed method does not require the home authentication server to reissue another authentication when a user travels to other external networks, it reduces the overload in the home authentication server. It can also distribute a PIN-driven key.

• Journal of Korea Multimedia Society
• /
• v.25 no.7
• /
• pp.932-944
• /
• 2022

Smartphones, are currently equipped with high-performance hardware to process large amounts of data and provide most of the functions provided by desktop PCs. In addition, the smartphones enable quick user authentication through biometric information collected from embedded sensors. However, the biometric authentication method is sometimes rejected due to social and cultural environment, security vulnerabilities, and misrecognition rate. Thus, conventional authentication methods such as PIN and pattern authentication are still mainly used. Consider the latest foldable and bendable smartphones. These devices may be vulnerable to social engineering attacks as they use conventional authentication methods without considering their form factors. In this study, therefore, we propose an authentication method using partial elements of PIN and pattern authentication as a way to increase the security of the conventional authentication methods and consider the recent form factors. According to the performance evaluation results, our method provides improved safety compared to the conventional methods.

• KIPS Transactions on Computer and Communication Systems
• /
• v.7 no.5
• /
• pp.127-136
• /
• 2018

In this paper, we propose a PIN entry method that combines with machine learning technique on smartphone. We use not only a PIN but also touch time intervals and locations as factors to identify whether the user is correct or not. In the user registration phase, a remote server was used to train/create a machine learning model using data that collected from end-user device (i.e. smartphone). In the user authentication phase, the pre-trained model and the saved PIN was used to decide the authentication success or failure. We examined that there is no big inconvenience to use this technique (FRR: 0%) and more secure than the previous PIN entry techniques (FAR : 0%), through usability and security experiments, as a result we could confirm that this technique can be used sufficiently. In addition, we examined that a security incident is unlikely to occur (FAR: 5%) even if the PIN is leaked through the shoulder surfing attack experiments.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.15 no.12
• /
• pp.2670-2678
• /
• 2011

Because of the development of IPTV, user is provided service of multimedia data regardless the location. But the number of users who try to get service of IPTV game illegally is also increasing. In this paper, user authentication protocol in IPTV housing using PIN code not to access easily for teenagers not to access to prohibited games. The proposed protocol combines authority data in IPTV household and creates a disposable password using PIN code to prevent teenagers from accessing illegally to the prohibited games and saves the data in certification server and set-top box to prevent forced accessing.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.135-141
• /
• 2011

Recent advances in mobile devices and development of various mobile applications dealing with private information of users made user authentication in mobile devices a very important issue. This paper presents a new user authentication method based on touch screen interfaces. This method uses for authentication the PIN digits as well as the exact locations the user touches to input these digits. Our method is fully compatible with the regular PIN entry method which uses numeric keypads, and it provides better usability than the behavioral biometric schemes because its PIN registration process is much simpler. According to our experiments, our method guarantees EERs of 12.8%, 8.3%, and 9.3% for 4-digit PINs, 6-digit PINs, and 11-digit cell phone numbers, respectively, under the extremely conservative assumption that all users have the same PIN digits and cell phone numbers. Thus we can guarantee much higher performance in identification functionality by applying this result to a more practical situation where every user uses distinct PIN and sell phone number. Finally, our method is far more secure than the regular PIN entry method, which is verified by our experiments where attackers are required to recover a PIN after observing the PIN entry processes of the regular PIN and our method under the same level of security parameters.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1138-1141
• /
• 2010

모바일 기기나 ATM에서의 사용자 인증에는 PIN(Personal Identification Number)이 주로 사용된다. 그 이유는, PIN은 사용자가 외우기 쉽고 단순한 UI(User Interface)로 구현이 가능하다는 장점이 있기 때문이다. 하지만 PIN은 어깨너머 공격에 취약하다는 단점이 있다. 기존의 연구들은 이미지 기반, 인식 기반, PIN과 이미지의 혼합방식을 이용한 다양한 사용자 인증 방법들을 제안하였다. 하지만 이들 연구는 모바일의 작은 화면을 고려하지 않아 구현이 어렵거나, 어깨너머 공격에 취약하거나, 사용자에게 기억에 대한 부담을 증가시키는 등의 문제점이 있다. 본 논문에서는 PIN과 패턴 이미지를 결합하여 모바일 기기에 적합하면서, 어깨너머 공격에 대해 기존의 방법들에 비해 안전하고 사용자가 외워야 하는 기호(숫자, 이미지 등)가 적은 사용자 인증 방법을 제안한다.

• Journal of IKEEE
• /
• v.13 no.4
• /
• pp.89-95
• /
• 2009

Recently, IC cards are used to protect personal information and to have user verification. Among them, the usage of Java Cards which can contain applications after issuing are increasing and installing several applets on Java card is possible. When Java Cards are used, applet works after completing user identification. In this paper, we designed, embodied and verified the mechanism of user identification process according to PIN setting of applets; Stored_PIN, Install_PIN and Update_PIN. These several applications of Java cards will be used for user identification independently or multiply, while using diverse user identification.

• Journal of Industrial Convergence
• /
• v.21 no.2
• /
• pp.117-123
• /
• 2023

In the fintech environment, Smart phones are mainly used for various service. User authentication technology is required to use safe services. Authentication is performed by transmitting authentication information to the server when the PIN or password is entered and touch the button completing authentication. But A post-attack is possible because the smudge which is the trace of using screen remains instead of recording attack with a camera or SSA(Shoulder Surfing Attack). To prevent smudge attacks, users must erase their fingerprints after authentication. In this study, we proposed a technique to determine whether to erase fingerprints. The proposed method performed erasing fingerprint which is the trace of touching after entering PIN and designed the security keypads that processes instead of entering completion button automatically when determined whether the fingerprint has been erased or not. This method suggests action that must erase the fingerprint when entering password. By this method, A user must erase the fingerprint to complete service request and can block smudge attack.