중간자공격에 취약한 다중서버 인증스킴의 보안분석
Cryptanalysis of Multi-server Authentication Scheme Vulnerable to MITM Attack
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
오늘날 의료기관에서는 안전하고 효율적인 전자 의료처리가 가능한 원격 의료정보시스템(TMIS)을 구현하여 사용 중에 있다. 인터넷의 편리한 접근성으로 원격의료서비스는 증가하고 있는 가운데 의료데이터와 개인정보보호가 절실하다. 이와 같이 TMIS를 비롯하여 온라인 쇼핑, 원격 감시, 온라인 뱅킹 등과 같은 분야에 적용하기 위해서는 다중서버기술과 인증기술이 필수적이다. 생체인식은 가장 신뢰할 수 있는 인증자이며 TMIS의 원격인증에 권장되고 있다. 그러나 기존의 TMIS는 단일서버 환경의 인증시스템을 고려하고 있다. 이러한 방식은 생체데이터에서 오류가 발생할 확률이 높다. 악의적인 공격자는 공개 채널을 통해 교환된 메시지를 쉽게 수정, 삽입, 삭제 및 가로챌 수 있기 때문에 다중 서버환경에서 안전하고 강력한 보안 인증 및 키 동의(AKA) 방식의 인증프로토콜이 필요하다. 2020년, Ali et al.'s는 다중 서버환경에서 개인정보 및 보안을 위한 3개의 요소(파라미터)를 이용한 대칭키 기반 인증 및 키동의 스킴을 제안했다. 그러나 Ali et al.'s 스킴은 중간자(MITM)공격에 의한 세션 키 노출과 스마트카드 도난에 따른 위장공격을 포함하여 많은 취약점을 가지고 있으며 특히 프로토콜에서 필수적인 상호인증이 보장되지 않는다는 것을 분석하고 증명해 보인다.
Abstract
Today, many hospitals and medical institutions implement authentication protocols and Telecare Medicine Information System (TMIS) to enable confidential and efficient electronic medical transactions. Convenient access to the Internet is increasing telemedicine services. Among them, protection of medical data and personal information is necessary. Therefore, multi-server and authentication technology are essential for application to fields such as TMIS, online shopping, remote monitoring, and online banking. Biometrics is one of the most trusted authenticators and is currently recommended for use with TMIS for remote authentication. However, most of the existing TMIS is considering the authentication system based on a single server environment. This method has a high probability of causing errors in biometric data. Malicious attackers can easily modify, insert, delete and intercept messages exchanged over public channels. Therefore, in a multi-server environment, a secure and strong security authentication and key agreement(AKA: Authentication and Key Agreement) authentication protocol is required. In 2020, Ali et al.’s proposed a three-factor symmetric key-based authentication and key agreement scheme for privacy and security in a multi-server environment. However, Ali et al.’s scheme has many flaws, including session key exposure and man-in-the-middle (MITM) attacks and spoofing attacks. In particular, it analyzes and proves that there is no mutual authentication in this protocol. Ali et al.’s proposed a three-factor symmetric key-based authentication and key agreement scheme for privacy and security in a multi-server environment. However, Ali et al.’s scheme has many flaws, including session key exposure and man-in-the-middle (MITM) attacks and spoofing attacks. In particular, it analyzes and proves that there is no mutual authentication in this protocol.
참고문헌 (18)
- Y. Zhang, "Ubiquitous wsn for healthcare : Recent advances and future prospects", IEEE Internet of Things Journal, 1(4), pp.311~318 (2014)
- U. Gogate, "Information and Communication Technology for Intelligent Systems", pp.341~349 (2019), Springer
- S. Barman, "A secure authentication protocol for multi-server-based e-healthcare using a fuzzy commitment scheme", IEEE Access, 7, pp.12557~12574 (2019)
- S. A. Chaudhry, "An enhanced lightweight anonymous biometric based authentication scheme for tmis", Multimedia Tools and Applications, 77(5), pp.5503~5524 (2018)
- K. Mahmood, "An enhanced anonymous identity-based key agreement protocol for smart grid advanced metering infrastructure", International Journal of Communication Systems, 32(16), pp.e4137~ (2019)
- A. Ghani, "Security and key management in iot-based wireless sensor networks: An authentication protocol using symmetric key", International Journal of Communication Systems, 32(16), pp.e4139~ (2019)
- S. Hussain, "Comments on biometrics-based privacy-preserving user authentication scheme for cloud-based industrial internet of things deployment", IEEE Internet of Things Journal, 6(6), pp.10936~10940 (2019)
- B. A. Alzahrani, "An anonymous device to device authentication protocol using ecc and self certifi ed public keys usable in internet of things based autonomous devices", Electronics, 9(3), pp.520~532 (2020)
- S. Challa, "An efficient ecc-based provably secure three-factor user authentication and key agreement protocol for wireless healthcare sensor networks", Computers &Electrical Engineering, 69, pp.534~554 (2018)
- K. Mansoor, "Securing iot-based rfi d systems : A robust authentication protocol using symmetric cryptography", Sensors, 19(21), pp.1~24 (2019)
- S. A. Chaudhry, "Correcting design flaws : An improved and cloud assisted key agreement scheme in cyber physical systems", Computer Communications, 153, pp.527~537 (2020)
- Q. Pu, "Strong authentication scheme for telecare medicine information systems", Journal of medical systems, pp.2609~2619 (2012)
- H. M. Chen, "An effi cient and secure dynamic id-based authentication scheme for telecare medical information systems", J. Med. Syst, pp.54~62 (2012)
- Q. Jiang, "A privacy enhanced authentication scheme for telecare medical information systems", J. Med. Syst., 37, pp.9897~ (2013)[DOI]
- K. W. Kim, "On the security of two remote user authentication schemes for telecare medical information systems", Journal of medical systems (2014)[DOI]
- Z. Ali, "ITSSAKA-MS : An improved three-factor symmetric-key based secure AKA scheme for multi-server environments", IEEE Access, 8, pp.193375~193379 (2020)
- T. S. Messerges, "Examining smart-card security under the threat of power analysis attacks", IEEE Trans. Comput, 51(5), pp.541~552 (2002)
- 신광철, "익명성 및 기밀성을 강화한 원격 사용자 인증스킴 설계에 관한 연구", 한국지식정보기술학회 논문지, 14(1), pp.11~24 (2019), 한국지식정보기술학회[DOI]