• Convergence Security Journal
• /
• v.22 no.4
• /
• pp.179-188
• /
• 2022

Password authentication schemes (PAS) are the most common mechanisms used to ensure secure communication in open networks. Mathematical-based cryptographic authentication schemes such as factorization and discrete logarithms have been proposed and provided strong security features, but they have the disadvantage of high computational and message transmission costs required to construct passwords. Fairuz et al. therefore argued for an improved cryptographic authentication scheme based on two difficult fixed issues related to session key consent using the smart card scheme. However, in this paper, we have made clear through security analysis that Fairuz et al.'s protocol has security holes for Privileged Insider Attack, Lack of Perfect Forward Secrecy, Lack of User Anonymity, DoS Attack, Off-line Password Guessing Attack.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.9
• /
• pp.3858-3869
• /
• 2020

In this paper, we propose a hash-chain based friendly force identification protocol for personal combatants equipped with a personal combat system in a tactical wireless network. It is imperative in military operations to effectively and quickly identify friendly forces. If the identification of friendly forces is not correct, this can cause friendly fire. In current ground operations, the identification of friendly forces by personal combatants is neither secure nor safe. To address this issue, the proposed protocol uses a hash-chain to determine if a detected person is friendly. Only friendly forces with the same materials that are assigned before they deploy can construct an initial hash-chain. Moreover, the hash-chain is changed at specific times. The performance of the proposed protocol is evaluated on the assumption that the secret key is leaked, which is the worst scenario in the security research field. We verify that the proposed protocol is secure for the various attack scenarios, such as message replay attack, fabrication attack, and Denial of Service attack.

• The Transactions of The Korean Institute of Electrical Engineers
• /
• v.59 no.3
• /
• pp.657-663
• /
• 2010

Today, rapid evolution of Internet makes various types of services in ubiquitous environment are intelligent and active. As a result, user's demand on high quality of life increases and health care service based on ubiquitous environment draws a lot of attention. However, user's private information used for health care service is illegally distributed and exposed, causing serious individual and social problems. Therefore, this thesis is intended to suggest a secure health care service to prevent unauthorized third party's access and to protect user's privacy in health care systems. The proposed scheme establishes a session key through communication channel between health care system and user based on explicit mutual authentication and provides secure communication and access control, improving security as one of the leading health care systems.

• The Transactions of the Korean Institute of Electrical Engineers P
• /
• v.54 no.4
• /
• pp.217-223
• /
• 2005

In this paper, we have proposed a secure dynamic ID allocation protocol using mutual authentication on the RFID tag. Currently, there are many security protocols focused on the low-price RFID tag. The conventional low-price tags have limitation of computing power and rewritability of memory. The proposed secure dynamic ID allocation protocol targets to the high-performance RFID tags which have more powerful performance than conventional low-price tag by allocating a dynamic ID to RFID using mutual authentication based on symmetric encryption algorithm. This protocol can be used as a partial solution for ID tracing and forgery.

• Journal of Communications and Networks
• /
• v.14 no.6
• /
• pp.606-613
• /
• 2012

In a smart grid environment, data for the usage and control of power are transmitted over an Internet protocol (IP)-based network. This data contains very sensitive information about the user or energy service provider (ESP); hence, measures must be taken to prevent data manipulation. Mutual authentication between devices, which can prevent impersonation attacks by verifying the counterpart's identity, is a necessary process for secure communication. However, it is difficult to apply existing signature-based authentication in a smart grid system because smart meters, a component of such systems, are resource-constrained devices. In this paper, we consider a smart meter and propose an efficient mutual authentication protocol. The proposed protocol uses a matrix-based homomorphic hash that can decrease the amount of computations in a smart meter. To prove this, we analyze the protocol's security and performance.

• The Transactions of the Korea Information Processing Society
• /
• v.5 no.8
• /
• pp.2083-2090
• /
• 1998

In this paper, we propose two authentication exchange schemes which combine public key-based mutual authentication with a Diffie-Hellman key derivation exchange. The security of key exchange of the proposed schemes depends on the discrete logarithm problem. The ,securtly of the etity authentication depends on that of the signature mechanism to be used in the proposed scheme. In comparisun with the Kerberos, X.509 exchanges, and ISO 3-way authentication protocol, the proposed schemes are not only simple and efficient. but also are resistant to the full range of replay and interceptiun attacks.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.17 no.1
• /
• pp.1-12
• /
• 2022

An insider's information security incidents continue to occur, there is a growing demand for strengthening information security within the organization. However, when strict information security policies and rules are applied to employees of the organization, it can result as an information security stress and resistance behavior. The purpose of this study is to suggest the causes of insiders' negative information security behavior and factors that mitigate the cause. In particular, the study identifies how the mutual influence of individual (psychological empowerment) and organizational (justice climate) factors mitigates negative behavior. In this study, a sample was obtained by surveying workers of organizations that reflect information security policies to insiders, and hypothesis testing was performed by structural equation modeling. As a result of the analysis, role stress had a partial mediating effect on the effect of psychological empowerment on security policy resistance, and the justice climate strengthened the effect of psychological empowerment. Our results suggest a direction for reducing insider information security policy resistance, so it helps to establish a strategy for achieving internal information security goals.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.47 no.1
• /
• pp.25-34
• /
• 2010

The IEEE 802.16-2004 standard has a security sub-layer in the MAC layer called, Privacy Key Management (PKM). However, several researches have been published to address the security vulnerabilities of IEEE 802.16-2004. After the IEEE 802.16-2004 standard, a new advanced and revised standard was released as the IEEE 802.16e-2005 amendment which is foundation of Mobile WiMAX network supporting handoffs and roaming capabilities. PKMv2 in Mobile WiMAX includes EAP authentication, AES-based authenticated encryption, and CMAC or HMAC message protection. However, Mobile WiMAX still has a problem of security architecture such as a disclosure of security context in network entry, a lack of secure communication in network domain, and a necessity of efficient handover supporting mutual authentication because Mobile WiMAX security has mainly concentrated on between SS and BS communication. Based on the investigation results, we propose a novel mobile WiMAX security architecture, called RObust and Secure MobilE WiMAX (ROSMEX), to prevent the new security vulnerabilities.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.463-472
• /
• 2012

This paper propose a security method that performs mutual authentication between the SIP UA and the server, check for integrity of the signaling channel and protection of SDP information for VoIP using a One-Time Password. To solve the vulnerability of existing HTTP Digest authentication scheme in SIP, Various SIP Authentication schemes have been proposed. But, these schemes can't meet security requirements of SIP or require expensive cryptographic operations. Proposed method uses OTP that only uses hash function and is updated each authentication. So Proposed method do not require expensive cryptographic operations but performs user authentication efficiently and safely than existing methods. In addition, Proposed method verifies the integrity of the SIP messages and performs SDP encryption/decryption through OTP that used for user authentication. So Proposed method can reduce communication overhead when applying S/MIME or TLS.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.2C
• /
• pp.132-139
• /
• 2012

In 2011, Woosik Bae proposed a NLMAP(New Low-cost Mutual Authentication Protocol) in RFID based on hash function. They argued that minimize computation such as random number generation. In addition, NLMAP is safe against replay attack, spoofing attack, traffic analysis and eavesdropping attack due to using mutual authentication. So, when applied to RFID system has advantage such as providing a high level of security at a lower manufacturing cost. However, unlike their argue, attacker can obtain Tag's hash computed unique identification information. This paper proves possible the location tracking and spoofing attack using H(IDt) by attacker. In addition, we propose the improved a mutual authentication protocol in RFID based on hash function and CRC code. Also, our protocol is secure against various attacks and suitable for efficient RFID systems better than NLMAP.