차세대 IoT Infrastructure 인증 프로토콜에 대한 취약점 분석
Vulnerability Analysis for an Next Generation IoT Infrastructure Authentication Protocol
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
기존 인프라를 대체할 6G와 사물인터넷으로의 전환이 예상되고 있지만, 이러한 전환의 이점은사용자의 개인정보보호와 보안이 보장되어야만 실현될 수 있다. 스마트카드 기반 원격 사용자 인증 프로토콜은 전환을 빠르게 할 수 있지만, 불안정성과 과도한 계산으로 인해 많은 프로토콜은 차세대 네트워크의 요구사항을 충족할 수 없었다. 최근 Rana 등은 다양한 보안 취약점을 개선하여 차세대 IoT 인프라를 위한 안전하고 경량화된 원격 사용자 인증 프로토콜을 제안하면서, 제안된 프로토콜이 주요보안 위협으로부터 안전하고 6G/IoT 인프라에 적합하다고 주장하였다. 본 논문에서는 Rana 등이 제안한 프로토콜의 동작과정 및 취약점을 분석하여, Rana 등이 제안한 프로토콜이 offline smartcard attack, lack of perfect forward secrecy, dos attack, bits mismatch, insider attack에 취약하다는 것을 밝혔다.
Abstract
The transition to 6G and IoT is expected to replace existing infrastructure, but the benefits can only be realized when users' privacy and security are guaranteed. Smartcard-based remote user authentication protocols can speed up the transition, but due to instability and over-calculation, most protocols are not meeting the requirements of next-generation networks. Recently, Lana and others have proposed a safe and light remote user authentication protocol for the next-generation IoT infrastructure by improving various security vulnerabilities. The proposed protocol claims to be safe from major security threats and suitable for IoT infrastructure. In this paper, we analyze the operational processes and vulnerabilities of the protocols proposed by Rana et al. and find that the proposed protocols are vulnerable to offline smart card attacks, complete forward secret racks, DOS attacks, bit mismatch, and insider attacks.
참고문헌 (26)
- Im Chol-Hong, "A Study on IoT and Big Data Application for Energy Facility Safety Management", 정보화연구, 18(1), pp.52~63 (2021), 한국엔터프라이즈아키텍처학회[DOI]
- Sun-Pyo Lee, "Development of a high-speed collector for multi-source data gathering in Smart Factory", 정보화연구, 16(2), pp.137~146 (2019), 한국엔터프라이즈아키텍처학회[DOI]
- Sangsoon Lim, "Low-Power Wireless Interference Detection System in the IoT Environment", 정보화연구, 15(2), pp.229~236 (2018), 한국엔터프라이즈아키텍처학회[DOI]
- L. Lamport, "Password authentication with insecure communication", Commun. ACM, 24(11), pp.770~772 (1981)
- M. L. Das, "A dynamic ID-based remote user authentication scheme", IEEE Trans. Consum. Electron, 50(2), pp.629~631 (2004)
- I. E. Liao, "Security enhancement for a dynamic IDbased remote user authentication scheme", International Conference on Next Generation Web Services Practices, NWeSP 05 (2005), IEEE
- E. J. Yoon, "Improving the dynamic ID-based remote mutual authentication scheme", OTM Confederated International Conferences on the Move To Meaningful Internet Systems, pp.499~507 (2006), Springer
- Y. Y. Wang, "A more efficient and secure dynamic ID-based remote user authentication scheme", Comput. Commun, 32(4), pp.583~585 (2009)
- S. Kumari, "An improved remote user authentication scheme with key agree-ment", Comput. Electr. Eng, 40(6), pp.1997~2012 (2014)
- Y. F. Chang, "Untraceable dynamic-identity-based remote user authentication scheme with verifiable password update", Int. J. Commun. Syst, 27(11), pp.3430~3440 (2014)
- S. D. Kaul, "Security enhancement of an improved remote user authentication scheme with key agreement", Wirel. Pers. Commun, 89(2), pp.621~637 (2016)
- M. Rana, "A secure and lightweight authentication scheme for next generation IoT infrastructure, Computer Communi-cations", pp.85~96 (2021), Elsevier
- T. Eisenbarth, "On the power of power analysis in the real world: A complete break of the KeeLoq code hopping scheme", Annual International Cryptology Conference, pp.203~220 (2008), Springer
- D. Dolev, "On the security of public key protocols", IEEE Trans. Inform. Theory, 29(2), pp.198~208 (1983)
- X. Cao, "Breaking a remote user authentication scheme for multi-server architecture", IEEE Commun. Lett, 10(8), pp.580~581 (2006)
- K. Mansoor, "Securing IoT-based RFID systems : A robust authentication protocol using symmetric cryptography", Sensors, 19(21) (2019)
- C. Lin, "Security and privacy for the internet of drones, Challenges and solutions", IEEE Commun. Mag, 56(1), pp.64~69 (2018)
- A. Ghani, "Security and key management in IoT-based wireless sensor networks", Int. J. Commun. Syst, 32(16) (2019)
- Z. Ali, "Securing smart city surveillance : A lightweight authentication mechanism for unmanned vehicles", IEEE Access, 8, pp.43711~43724 (2020)
- S. Venkatraman, "A hybrid deep learning image-based analysis for effective malware detection", J. Inf. Secur. Appl, 47, pp.377~389 (2019)
- C. Benzaid, "Fast authentication in wireless sensor networks", Future Gener. Comput. Syst, 55, pp.362~375 (2016)
- P. Kocher, "Introduction to differential power analysis", J. Cryptogr. Eng, 1(1), pp.5~27 (2011)
- T. S. Messerges, "Examining smart-card security under the threat of power analysis attacks", IEEE Trans Comput, 51(5), pp.541~552 (2002)
- M. Darwish, "Formal Analysis of an Authentication Protocol Against External Cloud-Based Denial-of-Service(DoS)Attack", International Journal for Information Security Research, 3(1), pp.400~407 (2013)
- S. Rajamanickam, "Insider Attack Protection : Lightweight Password-Based Authentication Techniques Using ECC", IEEE System Journal, 14(2), pp.1972~1893 (2020)
- Jong-Geon Kim, "Weakness of blockchain-based electronic-health recording and sharing scheme", Journal of Digital Contents Society, 22(8), pp.1281~1288 (2021), Digital Contents Society[DOI]