• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.12
• /
• pp.481-490
• /
• 2016

Bluetooth utilizes a symmetric key that is exchanged at the first pairing to establish a secure channel. There are four authentication modes which enables device authentication, Just work, Passkey Entry, Out of Band, and Numeric Comparison. Up to now, Just work has been considered as the authentication mode that is vulnerable to Man-In-The-Middle (MITM) Attack. In addition, it is possible to intentionally change any authentication mode to Just work mode, in order to succeed in MITM Attack under Just work mode. However, this kind of attacks have just worked under the assumption that users should not notice that authentication mode was changed. In this paper, We analyze the specification of Secure Simple Pairing, LE Legacy Pairing and LE Secure Connection Pairing. When using Passkey Entry mode on each approach, it seems the MITM attack is possible. Also it offers Passkey Entry MITM attack that does not require assumptions about the user's fault, because it isn't change verification process of the authentication mode unlike traditional attacks. We implement the proposed MITM attacks. Also we presents a scenario in which an attack can be exploited and a countermeasure.

• Journal of Information Processing Systems
• /
• v.10 no.1
• /
• pp.92-102
• /
• 2014

In recent years, there has been growing interest in secure pairing, which refers to the establishment of a secure communication channel between two mobile devices. There are a number of descriptions of the various types of out-of-band (OOB) channels, through which authentication data can be transferred under a user's control and involvement. However, none have become widely used due to their lack of adaptability to the variety of mobile devices. In this paper, we introduce a new OOB channel, which uses accelerometer-based gesture input. The gesture-based OOB channel is suitable for all kinds of mobile devices, including input/output constraint devices, as the accelerometer is small and incurs only a small computational overhead. We implemented and evaluated the channel using an Apple iPhone handset. The results demonstrate that the channel is viable with completion times and error rates that are comparable with other OOB channels.

• Journal of information and communication convergence engineering
• /
• v.10 no.4
• /
• pp.343-348
• /
• 2012

ZigBee Network is enabling technology for home automation, surveillance and monitoring system. For better secure network environment, secure and robust security model is important. The paper proposes an application, attribute-based proxy re-encryption on ZigBee networks. The method can distribute the authority to designated sensor nodes to decrypt re-encrypted ciphertext with associated attributes. However, a previous method is required to compute complex pairing operations. The high complexity is not suited to low resource device sensor networks, and it does not provide routing security either. To resolve these problems, we present a novel mechanism. The method can reduce overhead by imposing overhead to full function devices and ensure routing paths as well.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06d
• /
• pp.95-100
• /
• 2010

높은 이동성 및 휴대성을 갖는 모바일 디바이스의 기술적 발전은 사용자로 하여금 보다 높은 수준의 통합된 편의 기능 제공이 요구되고 있다. 이러한 예로 기존 물리적 지갑에 보관하던 플라스틱 신용카드, 멤버쉽 카드, 신분증 등의 개인정보를 모바일 디바이스 안에 저장 관리하는 모바일 지갑 서비스가 현실화되고 있다. 모바일 지갑을 통한 상거래 서비스를 이용할 시 디바이스에 저장된 각종 개인정보가 근거리 무선통신 기술을 통해 다른 모바일 기기나 지불서버에 전달되는 데, 이 무선전송 구간은 근원적으로 많은 보안 취약점을 갖고 있다. 따라서 본 논문에서는 모바일 지갑 응용 서비스에 모바일 기기간 안전한 키 설정 시 공개키 인증서를 활용하지 않고 두 기기간 공유키 검증을 할 수 있는 세션 키 검증 기술들을 분석하고, 해당기술들을 구현하여 모바일 지갑 결제 테스트베드에 포팅한 실험 결과를 통한 성능분석 결과를 제시한다. 본 성능평가를 통해 향후 다양한 모바일 기기 특성에 따른 최적의 세션 키 공유 키 검증 방법 선택 시 유용한 근거자료로 활용할 수 있을 것으로 기대된다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.4
• /
• pp.1892-1903
• /
• 2016

Mobile social network is becoming more and more popular with respect to the development and popularity of mobile devices and interpersonal sociality. As the amount of social data increases in a great deal and cloud computing techniques become developed, the architecture of mobile social network is evolved into cloud-based that mobile clients send data to the cloud and make data accessible from clients. The data in the cloud should be stored in a secure fashion to protect user privacy and restrict data sharing defined by users. Ciphertext-policy attribute-based encryption (CP-ABE) is currently considered to be a promising security solution for cloud-based mobile social network to encrypt the sensitive data. However, its ciphertext size and decryption time grow linearly with the attribute numbers in the access structure. In order to reduce the computing overhead held by the mobile devices, in this paper we propose a new Outsourcing decryption and Match-then-decrypt CP-ABE algorithm (OM-CP-ABE) which firstly outsources the computation-intensive bilinear pairing operations to a proxy, and secondly performs the decryption test on the attributes set matching access policy in ciphertexts. The experimental performance assessments show the security strength and efficiency of the proposed solution in terms of computation, communication, and storage. Also, our construction is proven to be replayable choosen-ciphertext attacks (RCCA) secure based on the decisional bilinear Diffie-Hellman (DBDH) assumption in the standard model.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.427-438
• /
• 2012

The SCADA(Supervisory Control and Data Acquisition) systems are used to control some critical national infrastructures such as electricity, gas, and water distribution systems. Recently, there are many researches on key management scheme for secure communication due to change to the open network environment. We propose a new key management method which is established on ID-based cryptosystem using pairing on MTU(Master Terminal Unit), Sub-MTU, and RTU(Remote Terminal Unit). Furthermore, we present a redistribution protocol of private key of each device and a system recovery protocol as a countermeasure of exposure of KMS(Key Management System) master key which is occurred by some unexpected accidents or malicious attacks.