• 한국컴퓨터정보학회논문지
• /
• 제22권9호
• /
• pp.65-71
• /
• 2017

This paper proposes a smart phone authentication method based on user's behavior and habit that is an authentication method against shoulder surfing attack and brute force attack. As smart phones evolve not only storage of personal data but also a key means of financial services, the importance of personal information security in smart phones is growing. When user authentication of smart phone, pattern authentication method is simple to use and memorize, but it is prone to leak and vulnerable to attack. Using the features of the smart phone pattern method of the user, the pressure applied when touching the touch pad with the finger, the size of the area touching the finger, and the time of completing the pattern are used as feature vectors and applied to user authentication security. First, a smart phone user models and stores three parameter values as prototypes for each section of the pattern. Then, when a new authentication request is made, the feature vector of the input pattern is obtained and compared with the stored model to decide whether to approve the access to the smart phone. The experimental results confirm that the proposed technique shows a robust authentication security using subjective data of smart phone user based on habits and behaviors.

• International Journal of Internet, Broadcasting and Communication
• /
• 제9권3호
• /
• pp.35-43
• /
• 2017

In 2013, Lee-Lie proposed secure smart card based authentication scheme of Zhu's authentication for TMIS which is secure against the various attacks and efficient password change. In this paper, we discuss the security of Lee-Lie's smart card-based authentication scheme, and we have shown that Lee-Lie's authentication scheme is still insecure against the various attacks. Also, we proposed the improved scheme to overcome these security problems of Lee-Lie's authentication scheme, even if the secret information stored in the smart card is revealed. As a result, we can see that the improved smart card based user authentication scheme for TMIS is secure against the insider attack, the password guessing attack, the user impersonation attack, the server masquerading attack, the session key generation attack and provides mutual authentication between the user and the telecare system.

• 디지털산업정보학회논문지
• /
• 제14권4호
• /
• pp.125-134
• /
• 2018

Lamport firstly suggested password base authentication scheme and then, similar authentication schemes have been studied. Due to the development of Internet network technology, remote user authentication using smart card has been studied. Li et al. analyzed authentication scheme of Chen et al. and then, Li et al. found out the security weakness of Chen et al.'s scheme such forward secrecy and the wrong password login problem, and proposed an a new smart card based user password authentication scheme. But Liu et al. found out that Li et al.'s scheme still had security problems such an insider attack and man-in-the-middle attack and then Liu et al. proposed an efficient and secure smart card based password authentication scheme. This paper analyzed Liu et al.'s authentication and found out that Liu et al.'s authentication has security weakness such as no perfect forward secrecy, off-line password guessing attack, smart-card loss attack, and no anonymity. And then, this paper proposed security enhanced efficient smart card based password authentication scheme using fuzzy extraction technology.

• 디지털산업정보학회논문지
• /
• 제14권2호
• /
• pp.27-33
• /
• 2018

User authentication scheme is a method for controlling unauthorized users' access to securely share the services and resources provided by the server and for verifying users with access rights. Initial user authentication scheme was based on passwords. Nowadays, various authentication schemes such as ID based, smart-card based, and attribute based are being researched. The study of Lee et al. suggested a user authentication scheme that provides forward secrecy and protects anonymity of users. However, it is vulnerable to attacks by outsiders and attackers who have acquired smart-cards. In this paper, we propose a modified smart-card authentication scheme to complement the weakness of the previous studies. The proposed user authentication scheme provides the security for the ID guessing attack and the password guessing attacks of the attacker who obtained the login request message and the user's smart-card.

• 한국정보통신학회논문지
• /
• 제21권2호
• /
• pp.301-308
• /
• 2017

스마트폰의 대중화와 인터넷의 발전으로 많은 사람들이 스마트폰을 이용하여 본인확인 인증절차를 진행한다. 스마트폰을 이용하면 개인용 데스크탑 컴퓨터를 이용하는 상황보다 쉽고 빠르게 인증이 가능하기 때문이다. 하지만 인터넷 해킹 기술과 악성코드 배포 기술이 빠르게 진화하고 공격형태도 더 다양해짐에 따라서 모바일 환경에 적합한 인증방법이 요구되고 있다. 인증방법으로는 소지기반 인증, 지식기반 인증, 생체기반 인증, 패턴기반 인증, 다중요소 인증 등의 방법이 있다. 본 논문에서는 스마트폰을 이용하여 수집 가능한 정보를 인증요소로 활용하는 사용자 인증 메커니즘을 제안한다. 제안 인증 메커니즘을 사용하면 본인의 스마트폰 정보 및 환경정보를 숨김 인증요소로 활용하여 타인에게 노출이 안된 상태에서 인증과정을 진행할 수 있는 장점이 있다. 제안 인증 메커니즘을 이용한 사용자 인증 시스템을 구현하여 적용성, 편의성, 보안성을 기준으로 효용성을 평가하였다.

• 디지털산업정보학회논문지
• /
• 제10권1호
• /
• pp.81-87
• /
• 2014

Password-based authentication using smart card provides two factor authentications, namely a successful login requires the client to have a valid smart card and a correct password. While it provides stronger security guarantees than only password authentication, it could also fail if both authentication factors are compromised ((1) the user's smart card was stolen and (2) the user's password was exposed). In this case, there is no way to prevent the adversary from impersonating the user. Now, the new technology of biometrics is becoming a popular method for designing a more secure authentication scheme. In terms of physiological and behavior human characteristics, biometric information is used as a form of authentication factor. Biometric information, such as fingerprints, faces, voice, irises, hand geometry, and palmprints can be used to verify their identities. In this article, we review the biometric-based authentication scheme by Cheng et al. and provide a security analysis on the scheme. Our analysis shows that Cheng et al.'s scheme does not guarantee any kind of authentication, either server-to-user authentication or user-to-server authentication. The contribution of the current work is to demonstrate these by mounting two attacks, a server impersonation attack and a user impersonation attack, on Cheng et al.'s scheme. In addition, we propose the enhanced authentication scheme that eliminates the security vulnerabilities of Cheng et al.'s scheme.

• 디지털융복합연구
• /
• 제20권5호
• /
• pp.637-642
• /
• 2022

심전도(ECG, electrocardiogram) 신호를 이용한 본인 인증기술은 기존의 바이오 인증을 대체할 수 있는 본인 인증기술로 주목받고 있다. 디지털 전자키를 인식하는 장치를 차량에 탑재하여 자동차와 무선으로 데이터를 송수신할 수 있게 하고, 스마트폰 등을 활용해 자동차의 차 문을 잠금 또는 해제하거나, 시동을 걸 수 있는 기능을 스마트폰을 통해 차량 제어할 수 있다. 그러나 스마트키는 보안에 취약하여 이를 해결하고 운전자의 편의성을 제공하기 위해 바이오 인증기술을 적용한 스마트키를 연구하였다. 심전도를 이용한 개인인증 알고리즘을 시계 형태의 웨어러블 디바이스에 탑재하여 바이오인증을 하고 개인인증이 완료되면 자동차의 스마트키 기능을 할 수 있었다. 인증율 95%를 달성하였다. 운전자는 스마트키를 소지할 필요가 없고, 분실 및 해킹에 안전하게 보호할 수 있는 대안으로 스마트키를 제안한다. 심전도를 이용한 개인 인증기술을 활용한 스마트키는 개인인증을 통해 다양한 분야에 적용이 가능하고 향후 심전도를 이용한 본인확인 장치 등에 적용할 수 있는 방법을 연구할 계획이다.

• Journal of Communications and Networks
• /
• 제14권6호
• /
• pp.606-613
• /
• 2012

In a smart grid environment, data for the usage and control of power are transmitted over an Internet protocol (IP)-based network. This data contains very sensitive information about the user or energy service provider (ESP); hence, measures must be taken to prevent data manipulation. Mutual authentication between devices, which can prevent impersonation attacks by verifying the counterpart's identity, is a necessary process for secure communication. However, it is difficult to apply existing signature-based authentication in a smart grid system because smart meters, a component of such systems, are resource-constrained devices. In this paper, we consider a smart meter and propose an efficient mutual authentication protocol. The proposed protocol uses a matrix-based homomorphic hash that can decrease the amount of computations in a smart meter. To prove this, we analyze the protocol's security and performance.

• 한국산업정보학회논문지
• /
• 제16권1호
• /
• pp.9-19
• /
• 2011

Secure and efficient authentication schemes over insecure networks have been a very important issue with the rapid development of networking technologies. Wang et al. proposed a remote user authentication scheme using smart cards. However, recently, Chen et al. pointed out that their scheme is vulnerable to the impersonation attack and the parallel session attack, and they proposed an enhanced authentication scheme. Chen et al. claimed that their scheme is secure against the various attacks. However, we have found that their scheme cannot resist the parallel attack and the stolen smart card attack. Therefore, in this paper, we show the security flaws in Chen et al.'s scheme and propose an improved remote user authentication scheme using tamper-resistant smart cards to solve the problem of Chen et al.'s scheme. We also analyze our scheme in terms of security and performance.

• 융합보안논문지
• /
• 제14권7호
• /
• pp.91-99
• /
• 2014

NFC(Near Field Communication)는 13.56MHz 주파수 대역에서 기기 간 데이터 교환 무선 통신기술이다. NFC Forum에서는 NFC Device와 NFC Tag간 데이터 교환을 위한 메시지 형식인 NDEF(NFC Data Exchange Format), 메시지 내의 탑재 가능한 레코드 유형을 정의한 NFC RTD(Record Type Definition), 기존의 종이포스터를 대체할 Smart Poster RTD, 레코드의 진위성과 무결성을 보장하기 위한 Signature RTD를 정의하였다. 그러나 기존 스마트 포스터 인증기법은 가장 빈번하게 일어나는 스마트 포스터 인증 과정에서 방대한 보안 기반구조인 PKI(Public Key Infrastructure) 및 인증서를 통해 스마트 포스터의 공개키 유효성을 확인하는 과정과 인증경로 상에 있는 인증서를 포함한다는 문제점을 가지고 있다. 따라서 본 논문에서는 스마트 포스터 인증과정에서 PKI와 인증서를 사용하지 않고 인증 URL, 서명, 공개키를 통해 스마트 포스터의 공개키의 유효성을 확인하여 스마트 포스터를 인증하는 기법을 제안하고 구현하였다.