피싱과 파밍 공격에 대응하기 위한 인증 프로토콜 설계
Design Of A Secure Authentication Protocol Against Phishing And Pharming Attacks
1
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
As individuals spend more time doing social and economic life on the web, the importance of protecting privacy against Phishing and Pharming attacks also increases. Until now, there have been researches on the methods of protection against Phishing and Pharming. However, these researches don’t provide efficient methods for protecting privacy and don’t consider Pharming attacks. In this paper, we propose an authentication protocol that protects user information from Phishing and Pharming attacks. In this protocol, the messages passed between clients and servers are secure because they authenticate each other using a hash function of password and location information which are certificated to clients and servers only. These messages are used only once, so that the protocol is secure from replay attacks and man-in-the-middle attacks. Furthermore, it is also secure from Pharming attacks.
Abstract
As individuals spend more time doing social and economic life on the web, the importance of protecting privacy against Phishing and Pharming attacks also increases. Until now, there have been researches on the methods of protection against Phishing and Pharming. However, these researches don’t provide efficient methods for protecting privacy and don’t consider Pharming attacks. In this paper, we propose an authentication protocol that protects user information from Phishing and Pharming attacks. In this protocol, the messages passed between clients and servers are secure because they authenticate each other using a hash function of password and location information which are certificated to clients and servers only. These messages are used only once, so that the protocol is secure from replay attacks and man-in-the-middle attacks. Furthermore, it is also secure from Pharming attacks.
참고문헌 (17)
- "새로운 사이버위협 : 피싱" (2005), 한국정보보호진흥원
- "피싱과 안티피싱 기술의 동향" (2008), 정보통신연구진흥원
- Cunter Ollmann, "The Pharming Guide", ~ (2005)
- "Gartner"[URL]
- Daisuke Miyamoto, "SPS: A Simple Filtering Algorithm to Thwart Phishing Attacks", LNCS, 3837, pp.195~209 (2005)
- Tie-Yan Li, "Trust on Web Browser: Attack vs. Defense", In proceedings of the International Conference on Applied Cryptography and Network Security, pp.241~253 (2003)
- "Google Safe Browsing"[URL]
- "Microsoft Phishing Filterin IE7"[URL]
- "Cloudmark"[URL]
- "EarthLink Toolbar"[URL]
- B. Ross, "Stronger Password Authentication Using Browser Extentions", In proceedings of Usenix Security Symposium (2005)
- Building Anti-Phishing Browser Plug-Ins: An Experience Report, "Thomas Raffetseder", ~
- Chow, "Client-Side Defense against Web-based Identity Theft", In proceedings of Network and Distributed System security Symposium (2004)
- Christine E. Drake, "Anatomy of a Phishing Email", In proceedings of CEAS'04 (2004)
- Lorrie Cranor, "Phinding Phish: An Evaluation of Anti-Phishing Toolbars", ~ (2006)
- Giuseppe Ateniese, "A New Approach to DNS Security(DNSSEC)", In proceedings of the 8th ACM conference on Computer and Communications Security, pp.86~95 (2001)
- David Wagner, "Analysis of the SSL 3.0 protocol", The Second USENIX Workshop on Electronic Commerce Proceedings (1996)