생체정보 기반의 Lin et al.'s 다중서버 사용자 인증 스킴에 대한 안전성 분석
Cryptanalysis of Biometric-based to Lin et al'.s Multi-Server User Authentication Scheme
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
생체인식기술의 활용은 쇼핑몰, 의료시스템, 금융권을 중심으로 스마트폰, 태블릿PC 등 모든 스마트기기에 기술이 적용되고 있으며 생체기술의 핵심은 인증기능이다. 인증은 등록된 사용자가 원격서버에서 신원확인의 유효성을 검증하는 것이다. 또한 원격서버에 접근할 수 있게 해주는 기본적인 보안 서비스이다. 암호, 스마트카드 및 생체인식은 인증에서 자주 사용되는 세 가지 요소이다. 다양한 멀티서버 환경에서 원격사용자 인증 스킴들이 많은 연구자들에 의해 제시되었다. Lin et al.‘s은 Baruah et al.’s의 스킴이 다중서버환경에서 위장공격, 스마트카드 도난공격 등에 취약하다고 주장하고 개선된 스킴을 제안하였다. 그러나 Lin et al.‘s의 인증 스킴을 분석한 결과 일부 파라미터 계산의 취약함이 존재하였다. 그것은 사용자와 서버가 공모하였거나 사용자의 스마트카드가 도난 되었을 때 위장공격, 스마트카드 도난공격, 재생공격, 서비스거부공격에 취약함을 드러냈다. 이와 같이 본 논문에서는 Lin et al'.s 스킴의 취약성을 논리적으로 재분석하고 비교한다.
Abstract
The use of biomedical technology has been applied to all smart devices such as smart phones and tablet PCs, mainly shopping malls, medical systems, and financial institutions. The core of biomedical technology is the authentication function. Authentication verifies the validity of the identity at the remote server by the registered user. It is also a basic security service that allows access to remote servers. Passwords, smart cards, and biometrics are three commonly used elements in authentication. Remote user authentication schemes for various multi-server environments have been proposed by many researchers. Lin et al.'s suggested that the scheme of Baruah et al.'s is vulnerable to impersonation attacks, smart card theft attacks, etc. in a multi-server environment and proposed an improved scheme. However, there is a weakness of some parameter calculations as a result of Lin et al.'s analysis of the authentication scheme. It was revealed that users and servers were colluding, or when users' smart cards were stolen, they were vulnerable to impersonation attacks, smart card stolen attacks, replay attacks, and denial of service attacks. Thus, this paper logically reanalyzes and compares the vulnerabilities of the Lin et al 's scheme.
참고문헌 (17)
- W. J. Tsaur, "A smart card-based remote scheme for password authentication in multi-server Internet services", Computer Standard &Interfaces, 27(1), pp.39~51 (2004)
- J. L. Tsai, "Efficient multi-server authentication scheme based on one-way hash function without verification table", Computers & Security, 27(3), pp.115~121 (2008)
- Y. P. Liao, "A secure dynamic ID based remote user authentication scheme for multi-server environment", Computer Standards &Interfaces, 31(1), pp.24~29 (2009)
- H. C. Hsiang, "Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment", Computer Standards & Interfaces, 31(6), pp.1118~1123 (2009)
- T. Wan, "Cryptanalysis of two dynamic identity based authentication schemes for multi-server architecture", Communications, China, 11(11), pp.125~134 (2014)
- T. S. Messerges, "Examining smart-card security under the threat of power analysis attacks", IEEE Transactions on Computers, 51(5), pp.541~552 (2002)
- C. T. Li, "An efficient biometrics-based remote user authentication scheme using smart cards", Journal of Network and Computer Applications, 33(1), pp.1~5 (2010)
- J. Moon, "An Improvement of Robust Biometrics-Based Authentication and Key Agreement Scheme for Multi-Server Environments Using Smart Cards", PLoS ONE, 10(12), pp.1~15 (2015)
- Y. R. Lu, "An enhanced biometric-based authentication scheme for telecare medicine information systems using elliptic curve cryptosystem", Journal of Medical Systems, 39(32), pp.1~8 (2015)
- Y. Choi, "Security improvement on biometric based authentication scheme for wireless sensor networks using fuzzy extraction", International Journal of Distributed Sensor Networks, 2016, pp.1~16 (2016)
- C. Li, "An efficient biometrics-based remote user authentication scheme using smart card", Journal of Network and Computer Applications, 33, pp.1~5 (2010)
- X. Li, "Cryptanalysis and improvement of a biometrics-based remote user authentication scheme using smart cards", Journal of Network and Computer Applications, 34, pp.73~79 (2011)
- M. C. Chuang, "An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics", Expert Systems with Applications, 41(4), pp.1411~1418 (2014)
- D. Mishra, "A secure user anonymity-preserving biometric-based multiserver authenticated key agreement scheme using smart cards", Expert Systems with Applications, 41(18), pp.8129~8143 (2014)
- K. C. Baruah, "An improved biometric-based multi-server authentication scheme using smart card", International Journal of Security and Its Applications, 9(1), pp.397~408 (2015)
- Y. Lin, "An enhanced biometric-based three factors user authentication scheme for multi-server environments", International Journal of Security and Its Applications, 10(1), pp.315~328 (2016)
- Y. Dodis, "Fuzzy extractors: How to generate strong keys from biometrics and other noisy data", Advances in Cryptology, 3027, pp.523~540 (2004)