스마트카드와 생체정보를 이용한 다중서버 인증스킴의 취약성 분석
Vulnerability Analysis on Multi-Server Authentication Scheme using Smart Card and Biometric Data
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
과거에는 대부분의 패스워드 인증스킴들이 다중서버환경에는 부적합한 단일서버환경에 기반을 두고 있었다. 그러나 최근에는 멀티서버 환경에서 패스워드와 생체정보에 의한 원격 사용자 인증스킴에 중점을 두고 많은 연구가 이루어지고 있다. 본 논문에서는 Mishra et al'.s 가 제안한 다중서버 환경에서 사용자 인증스킴의 취약점을 분석한다. 그동안 식별자 및 패스워드기반의 다중서버 환경에 대한 스킴들이 많이 제안되었으나 패스워드추측공격과 사전공격 등으로 안전성에 취약성이 발견되었다. 이와 같은 취약성을 극복하기 위하여 다중서버환경과 분산네트워크에서 사용될 수 있는 생체정보를 이용한 다중서버 인증스킴을 제안한 이래 많은 연구가 이루어져 왔다. Mishra et al'.s 스킴은 Chuang et al'.s 스킴의 취약점을 방지하기 위해 사용자 인증 파라미터 h(PSK)를 사용하여 개선하였다. 그러나 Mishra et al'.s 스킴은 사용자/서버 위장공격, 서비스거부공격, 가장공격과 중간자공격에 취약하다. 본 논문에서는 C&C 스킴을 분석하고 개선하여 제안한 Mishra et al'.s 스킴의 취약성과 문제점을 재분석하고 비교한다.
Abstract
In the past, most of the existing password authentication schemes are based on a single server environment which are inadequate for the multi-server environments. But recently, researches have been performed focusing on the remote user authentication scheme by password and bio-metric data in a multi-server environment. The following study analyzes weaknesses in user Authentication schemes in multiple server environments as suggested by Mishra et al’.s. Over the years, various identifier and password based schemes for multiple server environments have been suggested. However, they have been found of password guessing or dictionary attack based vulnerabilities. In order to overcome such weaknesses, there's been many papers since then that suggested various multiple server verification schemes that utilize biometric data for use in multiple server environments and distributed networks. In order to prevent weaknesses in Mishra et al'.s scheme and Chuang et al'.s scheme, the user verification parameter h(PSK) was utilized to improve upon the weaknesses. However, Mishra et al'.s scheme is vulnerable to user/server spoof attack, denial of service attack, impersonation attack, and man-in-the-middle attack. The following study analyzes C&C scheme and improves it, in order to reanalyze and compare weaknesses and problems to Mishra et al'.s scheme.
참고문헌 (15)
- H. C. Hsiang., "Improvement of the secure dynamic ID based remote user authentication scheme for multi-server environment", Computer Standards &Interfaces, 31, pp.1118~1123 (2009)
- S. K. Sood., "2011A secure dynamic identity based authentication protocol for multi-server architecture", Journal of Network and Computer Applications, 34(2), pp.609~618 (2011)
- 신광철, "A Study on Weakness of a Secure Dynamic Identify based Remote User Authentication scheme for Multi-server Environment using Smart Card", 한국지식정보기술학회 논문지, 10(5), pp.523~536 (2015), 한국지식정보기술학회
- P. Kocher., "Differential power analysis", Advances in Cryptology—RYPTO ’99, Lecture Notes in Computer Science, pp.388~397 (1999), Springer
- T. S. Messerges., "Examining smart-card security under the threat of power analysis attacks", IEEE Transactions on Computers, 51(5), pp.541~552 (2002)
- C. T. Li., "An efficient biometrics-based remote user authentication scheme using smart cards", Journal of Network and Computer Applications, 33(1), pp.1~5 (2010)
- W. S. Juang, "Efficient multi-server password authenticated key agreement using smart cards, Consumer Electronics", IEEE Transactions on, 50(1), pp.251~255 (2004)
- J. L. Tsai, "Efficient multi-server authentication protocol based on one-way hash function without verification table", Computers & Security, 27(3), pp.115~121 (2008)
- Y. P. Liao, "A secure dynamic ID based remote user authentication scheme for multi-server environment", Computer Standards and Interfaces, 31(1), pp.24~29 (2009)
- D. Yang., "A biometric password-basedmulti-server authentication scheme with smart card", Proceedings of the International Conference on Computer Design and Applications(ICCDA ’10), 5, pp.554~559 (2010)
- E. -J. Yoon., "Robust biometrics-based multiserver authentication with key agreement scheme for smart cards on elliptic curve cryptosystem", The Journal of Supercomputing, 63(1), pp.235~255 (2013)
- B. Wang., "A smart card based efficient and secured multi-server authentication scheme", Wireless Personal Communications, 68(2), pp.361~378 (2013)
- M. C. Chuang., "An anonymous multi-server authenticated key agreement scheme based on trust computing using smart cards and biometrics", Expert Systems with Applications, 41(4), pp.1411~1418 (2014)
- D. Mishra., "A secure user anonymity-preserving biometricbased multi-server authenticated key agreement scheme using smart cards", Expert Systems with Applications, 41(18), pp.8129~8143 (2014)
- C. Kaufman, "Internet key exchange (ikev2)protocol", ~ (2005)