• International Journal of Internet, Broadcasting and Communication
• /
• 제8권1호
• /
• pp.7-18
• /
• 2016

Several authentication methods have been developed to make use of tokens in the mobile networks and smart payment systems. Token used in smart payment system is genearated in place of Primary Account Number. The use of token in each payment transaction is advantageous because the token authentication prevents enemy from intercepting credit card number over the network. Existing token authentication methods work together with the cryptogram, which is computed using the shared key that is provisioned by the token service provider. Long lifetime and repeated use of shared key cause potential brawback related to its vulnerability against the brute-force attack. This paper proposes a per-transaction shared key mechanism, where the per-transaction key is agreed between the mobile device and token service provider for each smart payment transaction. From server viewpoint, per-transaction key list is easy to handle because the per-transaction key has short lifetime below a couple of seconds and the server does not need to maintain the state for the mobile device. We analyze the optimum size of the per-transaction shared key which satisfy the requirements for transaction latency and security strength for secure payment transactions.

• 한국디지털정책학회:학술대회논문집
• /
• 한국디지털정책학회 2003년도 창립학술대회
• /
• pp.45-57
• /
• 2003

In recent years, the number of digital content transaction has increased dramatically, in main, owing to the innovation of IT technology. At the same time, it creates new problems which have never been found in traditional transactions. Especially, due to the easy-copy characteristics of digital content, the illegal usage of digital content proliferates. Also the conflicts between seller an d buyer in digital content transactions on cyberspace market take place frequently because contracts were made without face-to-face discussion. The increase of illegal usage and conflict in digital content market would diminish motivation of creators for their work, furthermore break down digital content market on cyberspace. Digital content transaction authentication system would play an important role in creating sound digital content market. Especially, it would make big contribution to reducing the number of conflict between seller and buyer. In this context, the main objective of this study is to suggest operational model of digital content transaction authentication and to explain critical success factors in organizing digital content transaction authentication system.

• 정보보호학회논문지
• /
• 제24권5호
• /
• pp.931-939
• /
• 2014

결제를 위한 이전의 웹 접근 인증 시스템의 웹 혹은 모바일 채널은 단지 사용자 인증만을 위한 것이며 사용자와 은행 및 금융 기관과의 인증은 이루어지지 않고 있다. 따라서 본 논문은 웹 기반 결제 시스템을 위한 사용자와 은행 및 금융 기관과의 상호 인증이 가능한 결제 거래 인증 모드를 제안한다. 제안한 시스템은 유선 전자 거래를 위한 안전한 전자 거래 (Secure Electronic Transaction : SET)를 무선 네트워크를 위한 결제 시스템으로 설계하였다. 또한 거래 인증 모드를 사용한 이 시스템은 SET 단점인 유선의 카드 기반 거래를 대신하여, 무선의 계좌 기반 거래를 지원 할 수 있다. 따라서 고객은 고객과 고객 은행 사이의 상호 인증으로 고객 은행 사이트에 다시 로그인할 필요 없이 잔고를 확인할 수 있다.

• 디지털산업정보학회논문지
• /
• 제6권4호
• /
• pp.131-142
• /
• 2010

Due to the development of the Internet, Internet banking that we are liberated from time and space has evolved into banking system. So modern life became comfortable. However, Dysfunction (malicious Information leakage and hacking etc.) of the Internet development has become a serious social problem. According to this, The need for security is rapidly growing. In this paper, we proposed the Internet Banking Authentication System using a dual-channel in OTP(One Time Password) authentication. This technology is that A user transfer transaction information to Bank through one Internet channel then bank transfer transaction information to user using the registered mobile phone or smart phone. If user confirm transaction information then bank request user's OTP value. User create OTP value and transfer to bank and bank authenticate them throgth the ARS. If authentication is pass then transaction permitted. Security assessment that the proposed system, the security requirement that the confidentiality and integrity, authentication, repudiation of all of the features provide a key length is longer than the current Internet banking systems, such as using encryption, the security provided by the Financial Supervisory Service Level 1 rating can be applied to more than confirmed.

• 인터넷정보학회논문지
• /
• 제23권4호
• /
• pp.65-72
• /
• 2022

본 논문에서는 암호 없는(Passwordless) 사용자 환경에서 제로 트러스트(zero trust) 기반 복합 생체 인증을 제안한다. 다양한 FIDO 2.0(Fast Identity Online) 거래 인증 플랫폼 연동을 위한 메타버스와 연계를 설계한다. 특히, 스마트 단말기의 위치정보와 지자기 센서, 가속기 센서 및 복합인증(MFA, Multi-Factor Authentication)을 위한 생체정보 등을 적용한다. 이때, 조도 및 온도/습도 등 상황인식을 바탕으로 2차 인증으로 복잡한 인증을 통해 사용자 환경에 따른 적응형 복합 인증 플랫폼을 제시한다. 그 결과 사용자 환경에 따라 지문인식과 홍채인식, 얼굴인식, 음성 등 행동 패턴으로 다양한 제로 트러스트를 기반으로 2차 사용자 인증이 가능하다. 또한 FIDO 플랫폼의 복합 통합 인증 연계 결과를 확인하고, FIDO2.0을 이용한 거래 인증 연계 플랫폼의 인증 정확도를 개선하고자 한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권4호
• /
• pp.1864-1876
• /
• 2016

Card-Not-Present (CNP) transactions taking place remotely over the Internet are becoming more prevalent. Cardholder authentication should be provided to prevent the CNP fraud resulting from the theft of stored credit card numbers. To address the security problems associated with CNP transactions, the use of a virtual card number derived from the transaction details for the payment has been proposed, instead of the real card number. Since all of the virtual card number schemes proposed so far are based on a password shared between the cardholder and card issuer, transaction disputes due to the malicious behavior of one of the parties involved in the transaction cannot be resolved. In this paper, a new virtual card number scheme is proposed, which is associated with the cardholder's public key for signature verification. It provides strong cardholder authentication and non-repudiation of the transaction without deploying a public-key infrastructure, so that the transaction dispute can be easily resolved. The proposed scheme is analyzed in terms of its security and usability, and compared with the previously proposed schemes.

• 정보보호학회논문지
• /
• 제21권1호
• /
• pp.187-199
• /
• 2011

모바일뱅킹에서 사용자인증과 거래승인을 보호하는 것은 매우 중요하다. 스마트폰에 설치된 악성 프로그램은 사용자가 입력하는 비밀을 얻어내거나 거래내용을 조작하여 사용자에게 승인하도록 유도할 수도 있다. 이 논문에서는 사용자의 비밀과 거래승인을 보호하기 위한 연구들의 보안성과 편의성을 분석하고, 이를 바탕으로 사용자의 비밀을 보호하고 문서의 내용을 조작하는 공격에 대응하는 방법을 제안한다.

• 한국산학기술학회논문지
• /
• 제12권3호
• /
• pp.1350-1355
• /
• 2011

클라이언트 서버 환경하에서 정당한 클라이언트를 인증하고 시스템 자원들을 보호하는 일은 매우 중요한 이슈 중에 하나이다. 즉, 인가받지 않은 사용자들에 의해 시스템이 보안 공격을 막아내기 위해서는 사용자의 아이디와 패스워드로는 불충분하다. 본 논문에서는 클라이언트 인증키와 서버 인증키를 사용하는 안전한 데이터베이스 인증모델을 제안하였다. 제안모델은 2개의 인증키를 사용하여 보안성을 높이고자 하였는데, 클라이언트와 서버간 데이타베이스 트랜잭션을 처리할 때 서로의 인증 패스워드를 관리하여 사용자의 별도의 입력 작업 없이 사용자 패스워드에 더하여 인증패스워드를 사용함으로써 시스템의 보안성을 높여줄 수 있는 안전한 인증모델을 제시하고자 하였다.

• ETRI Journal
• /
• 제39권1호
• /
• pp.135-144
• /
• 2017

Recently, mobile phones have been recognized as the most convenient type of mobile payment device. However, they have some security problems; therefore, mobile devices cannot be used for unauthorized transactions using anonymous data by unauthenticated users in a cloud environment. This paper suggests a mobile payment system that uses a certificate mode in which a user receives a paperless receipt of a product purchase in a cloud environment. To address mobile payment system security, we propose the transaction certificate mode (TCM), which supports mutual authentication and key management for transaction parties. TCM provides a software token, the transaction certificate token (TCT), which interacts with a cloud self-proxy server (CSPS). The CSPS shares key management with the TCT and provides simple data authentication without complex encryption. The proposed self-creating protocol supports TCM, which can interactively communicate with the transaction parties without accessing a user's personal information. Therefore, the system can support verification for anonymous data and transaction parties and provides user-based mobile payments with a paperless receipt.

• 디지털산업정보학회논문지
• /
• 제6권3호
• /
• pp.31-36
• /
• 2010

In this paper, We propose a transaction signing-based authentication scheme for protecting sinkhole attacks in wireless sensor networks. Sinkhole attack makes packets that flow network pass through attacker. So, Sinkhole attack can be extended to various kind of attacks such as denial of service attacks, selective delivery or data tamper etc. We analyze sinkhole attack methods in directed diffusion based wireless sensor networks. For the purpose of response to attack method, Transaction signing-based authentication scheme is proposed. This scheme can work for those sensor networks which use directed diffusion based wireless sensor networks. The validity of proposed scheme is provided by BAN logic.