니모닉 메커니즘을 이용한 향상된 보안성과 사용자 경험을 제공하는 로그인 인증 시스템 연구
Study on a Login Authentication system that provides enhanced Security and User Experience using a Mnemonic Mechanism
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
오늘날 웹과 모바일 애플리케이션에서 로그인 인증 시스템은 사용자의 신원을 확인하고, 서비스에 대한 접근 권한을 제어하는 핵심 기능이다. 다양한 인증 방식이 존재하며 각 인증 방식은 기술적 특성과 보안 요구사항에 따라 설계되었기 때문에 각 방식은 보안성, 사용 편의성, 구현 난이도 등에서 차이가 있다. 본 논문에서는 BIP39 즉, 니모닉 코드를 활용한 인증 시스템 개선안을 제안한다. 기존 아이디/비밀번호, OAuth, OTP, SNS 연동, JWT 등 다양한 인증 방식의 한계를 분석하고, 니모닉 기반 인증 시스템의 장단점 및 안전성을 평가하였다. 제안된 시스템은 높은 엔트로피를 통한 강한 보안성과 사용자 친화적인 인터페이스, 크로스 플랫폼 호환성을 제공한다. 또한 블록체인 기술 강점을 웹 서비스 인증에 접목하여 보다 안전하고 효율적인 인증 시스템의 새로운 패러다임을 제시하였다.
Abstract
In today’s web and mobile applications, login authentication systems are a core function that verifies the identity of users and controls access to services. Although various authentication methods exist, each authentication method is designed according to technical characteristics and security requirements, so each method has differences in security, usability, and implementation difficulty. In this paper, we propose a new authentication system using BIP39 (Bitcoin Improvement Proposal 39) mnemonic code. We analyzed the limitations of various authentication methods such as existing ID/password, OAuth, OTP, SNS-based method, and JWT, and evaluated the advantages, disadvantages, and safety of the mnemonic-based authentication system. The proposed system provides strong security through high entropy, a user-friendly interface, and cross-platform compatibility, and presents a new paradigm of a more secure and efficient authentication mechanism by incorporating the strengths of blockchain technology into web service authentication. However, we also identified new challenges such as the importance of mnemonic code management and research on better convenience.
참고문헌 (21)
- ALSaleem, Bandar Omar, "Multi-factor authentication to systems login", 2021 National Computing Colleges Conference (NCCC), pp.1~4 (2021), IEEE
- Chen, C. Y., "A fair and dynamic password authentication system", 2011 2nd International Conference on Artificial Intelligence, Management Science and Electronic Commerce (AIMSEC), pp.4505~4509 (2011), IEEE
- Hardt, Dick, "The OAuth 2.0 authorization framework", No. rfc6749, ~ (2012)
- Jones, Michael, "Json web token (jwt)", No. rfc7519, ~ (2015)
- Juang, Kevin A., "Using system-generated mnemonics to improve the usability and security of password authentica-tion", Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 56(1), pp.506~510 (2012), SAGE Publications
- Kaur, Navpreet, "A comparative analysis of various multistep login authentication mechanisms", International Journal of Computer Applications, 127(9), pp.20~26 (2015)
- Ko, Moo Nam, "Social-networks connect services", Computer, 43(8), pp.37~43 (2010)
- Leiner, Barry M., "The past and future history of the Internet", Communications of the ACM, 40(2), pp.102~108 (1997)
- "Bip39"[URL]
- Rahmatulloh, A., "Performance comparison of signed algorithms on JSON Web Token", IOP Conference Series:Materials Science and Engineering, 550(1), pp.012023~ (2019), IOP Publishing
- Shaik, Cheman, "UNFORGETTABLE USER DEFINED SEED PHRASE FOR CRYPTOCURRENCY WALLETS", ~
- Sheng, Dalian Wu Zhia, "Multilevel Au-thentication for Social Network", JOIV: International Journal on Informatics Visual-ization, 2(3-2), pp.220~224 (2018)
- Wang, Hui, "The achilles heel of OAuth: a multi-platform study of OAuth-based authentication", Proceedings of the 32nd Annual Conference on Computer Security Applications, pp.167~176 (2016)