비밀번호 훔쳐보기로부터 안전한 기술을 내장시킨 비밀번호 입력기의 설계 및 구현
Design and Implementation of Pinpad using Secure Technology from Shoulder Surfing Attack
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
비밀번호를 입력하는 과정에서 가장 큰 보안 위협은 비밀번호를 훔쳐보는 것이다. 비밀번호 훔쳐보기는 비밀번호를 입력하는 과정을 옆에서 지켜보고 비밀번호를 획득하려고 하는 행위로서 비밀번호를 획득하는 가장 전통적인 방법이며 강력한 보안 위협이다. 본 논문에서는 인지심리학에 기초한 비밀번호 훔쳐보기로부터 안전한 기술인 역동 인증 체계(DAS)라 불리는 비밀번호 입력 기술을 제안하였다. 그리고 제안한 역동 인증 체계의 비밀번호 훔쳐보기에 대한 안전성을 직관적인 관점, 훔쳐보기 실험, 이론적인 분석으로 구분하여 검증하였다. 비밀번호 훔쳐보기로부터 안정성이 입증된 역동 인증 체계를 내장시킨 비밀번호 입력기를 설계하여 구현하였다. 구현한 비밀번호 입력기는 일반 패스워드 입력방식 보다 훔쳐보기 공격자의 비밀번호 획득 확률을 현저하게 낮출 수 있으므로 은행에서 운영하는 금융자동화기기에 적용 및 운영되기에 적합한 것으로 평가를 받아 금융기관에서 도입하여 활용되고 있다.
Abstract
When entering the PIN(personal identification number), the greatest security threat is shoulder surfing attack. Shoulder surfing attack is watching the PIN being entered from over the shoulder to obtain the number, and it is the most common and at the same time the most powerful security threat of stealing the PIN. In this paper, a psychology based PINpad technology referred to as DAS(Dynamic Authentication System) that safeguards from shoulder surfing attack was proposed. Also, safety of the proposed DAS from shoulder surfing attack was tested and verified through intuitive viewpoint, shoulder surfing test, and theoretical analysis. Then, a PINpad with an internal DAS that was certified for its safety from shoulder surfing attack was designed and produced. Because the designed PINpad significantly decreases the chances for shoulder surfing attackers being able to steal the PIN when compared to the ordinary PINpad, it was determined to be suitable for use at ATM(automated teller machine)s operated by banks and therefore has been introduced and is being used by many financial institutions.
참고문헌 (24)
- Alfred J. Menezes, "Applied Cryptography" (1997), CRC Press
- 금융감독원, "영국의 인터넷뱅킹 관련 사기 피해 증가", 금융감독정보, 통권 : 396, pp.43~44 (2006)
- "the free encyclopedia"[URL]
- TTA(Telecommunications Technology Association), "Standard of Contact Type IC Card Terminal", Telecommunications Technology Association, ~ (2003)
- C.Y. Han, "An Empirical Study on the Use of POS System for Inventory Efficiency", Journal of Korean Industrial Information Systems Society, 10(1), pp.81~88 (2005)
- Jablon,P.D, "Strong password-only authenticated key exchange", ACM SIGCOMM Computer Communication Review, 26(5), pp.5~20 (1996)
- Halevi, S, "Public-key cryptography and password protocols", ACM Conference on Computer and Communications Security, pp.122~131 (1998)
- Bellovin, M.S, "Augmented encrypted key exchange:Password-based protocol secure against dictionary attack and password file compromise", Proceedings of the 1st ACM Conference on Computer and Communications Security, pp.244~250 (1993)
- Halevi, S, "Public-key cryptography and password protocols", ACM Conference on Computer and Communications Security, pp.122~131 (1998)
- Li, Zhi, "An Association-Based Graphical Password Design Resistant to Shoulder-Surfing Attack", 2005 IEEE International Conference on Multimedia and Expo(ICME-05), pp.245~248 (2005)
- Lei, M, "Virtual password using random linear functions for on-line services,ATM machines,and pervasive computing", Computer communications, 31(18), pp.4367~4375 (2008)
- Park, S.B, "Authenticated key exchange protocol secure against off-line dictionary attack and server compromise", Lecture Notes in Computer Science, 3032, pp.924~931 (2004)
- Park, S.B, "New authentication system", Lecture Notes in Computer Science, 3032, pp.1095~1098 (2004)
- Park, S.B, "User authentication protocol based on human memorable password and using ECC", Lecture Notes in Computer Science, 3032, pp.1091~1094 (2004)
- 소리나무미디어, "일회용 비밀번호 생성 및 해석 방법", 대한민국 특허청, ~ (2007)
- "image based password systems"[URL]
- D. Kirovski, "Click Passwords", 21st IFIP International Information Security Conference, pp.351~363 (2006)
- "Passfaces: Two Factor Authentication, Graphical Password"[URL]
- Manu Kumar, "Reducing Shoulder-surfing by Using Gaze-based Password Entry", Proceedings of the 3rd symposium on Usable Privacy and Security(SOUPS 2007), pp.13~19 (2007)
- Nemeth, Garth Snyder, "Linux Administration Handbook" (2006), Prentice Hall PTR
- Edward K. Vogel, "Neural activity predicts individual differences in visual working memory capacity", Nature, 428, pp.748~15115 (2004)
- 박승배, "타인의 관찰에 의한 패스워드 노출로부터 안전한 패스워드 시스템", 정보처리학회논문지C, 10(2), pp.141~144 (2003), 한국정보처리학회
- 박승배, "디지털 지문 이미지를 잡음원으로 사용하는 안전하고 효율적인 난수 생성기", 정보처리학회논문지D, 10(3), pp.541~546 (2003), 한국정보처리학회
- "리듬패스 & 참아이디"[URL]